8 ms·

Adding to this: I run product security for a large enterprise, and I've already gotten the ball rolling on prohibiting copilot for all the reasons above. It's

Adding to this: I run product security for a large enterprise, and I've already gotten the ball rolling on prohibiting copilot for all the reasons above. It's too big a risk. I'd be shocked if GitHub could remedy the negative impressions minted in the last day or so. Even with other compensating controls around open source management, this flies right under the radar with a c130's worth of adverse consequences.

fragmede 5y ago
Do you also block stack overflow and give guidance to never copy code from that website or elsewhere on the Internet? I'm legitimately curious - my org internally officially denounces the copying of stack overflow snippets. Thankfully for my role it's moot as I mostly work with an internal non-public language, for better or worse, and I have no idea how well that's followed elsewhere in the wider company.
- mediaman 5y ago
  Who really copies stack overflow snippets verbatim? It's usually just easier to refer to it for help figuring out the right structure and then adapt it for your own needs. Usually it needs customization for your own application anyway (variables, class instances, etc).
  - canadev 5y ago
    Yeah! I've uh, ... never copied a bit of code into my repo verbatim, right? yeah right. I wish. (Not saying every dev does this)
    - TillE 5y ago
      I've copied plenty of Microsoft sample code verbatim, because the Win32 API sucks and their samples usually get the error handling right. But, I can't think of a single scenario where I've copied something from Stack Overflow. I'm searching for the idea of how to solve a problem, and typically the relevant code given is either too short to bother copying, or it's long and absolutely not consistent with how I want to write it.
      - Noumenon72 5y ago
        "Too short to bother copying"? I copy single words of text to avoid typing and typos. I would never type out even a single line of code when I could paste and edit.
        alisonkisk 5y ago
        That's fair use.
        vanous 5y ago
        > "Too short to bother copying"? I copy single words of text to avoid typing and typos. I would never type out even a single line of code when I could paste and edit. Very honest suggestion: learn how to touch type. You can still copy if needed, but your typed input will be much faster.
        Noumenon72 5y ago
        I'm somewhere between 45-75 wpm. But Ctrl+C Ctrl+V can type 300wpm! Typing when you could paste is like having that Github Copilot put the right sentence right in front of you and you decide to type over it instead. Not only does it feel like wasted and robotic effort, typing everything leads to RSI. I'm not sure why people disagree. Another symptom is that I insist on aliases for everything while others type out all the commands every time. Maybe I get distracted by the words when I type and lose my train of thought?
        Retric 5y ago
        You need to highly the correct test first and move the curser to the correct location to paste text. I bet you can type 123123 several times faster than you can highlight that text in this comment and past it into a reply.
        ec109685 5y ago
        Double click to select a word is fast, and then you are in per word selection mode.
  - blooalien 5y ago
    I don't think I've ever copied code directly from any of the Stack* sites. I generally read all the answers (and comments) and then use what I learn to write my own (hopefully better) code specific to my needs.
    - corobo 5y ago
      Yeah my experience has always been "ohhh that solution makes sense" then I go write it myself If nothing else this whole copilot thing is helping ease some chronic imposter syndrome
  - bartread 5y ago
    Ha! Well, I think a lot of people copy code from StackOverflow verbatim once at least - including me. Of course it turned out the code I'd blindly inserted into my project contained a number of bugs. In one or two cases, quite serious ones. This, even though it was the accepted answer. It was probably more effort to fix up the code I'd copy pasta'd than write it from scratch. Since then I've never copied and pasted from StackOverflow verbatim.
  - baud147258 5y ago
    I think I did a few times, usually for languages that I wasn't going to spend to much time with (so no benefits in figuring how to do it from the answers) and for specific tasks.
- samtheprogram 5y ago
  Anything posted to Stack Overflow has a specific (Creative Commons IIRC) license associated with it. The same is not true of GitHub Copilot, and in fact their FAQ doesn’t specify a license at all, probably because they are technically unable to since it is trained on a wide variety of code from differing licenses (and code not written by a human is currently a grey area for copyright). The FAQ simply says to use it at your own risk.
- gunapologist99 5y ago
  Apples and oranges: Stack overflow snippets are explicitly granted under a permissive license, as long as you attribute. https://stackoverflow.com/help/licensing https://stackoverflow.com/help/licensing It appears that the code that copilot is using is created under a huge variety of licenses, making it risky. On the other hand, a small snippet in a function that is derived from many existing pieces of other code may fall under fair use, even if it is not under an open source license of some sort.
  - comex 5y ago
    Except that CC-BY-SA is not a permissive license; the SA part is a form of copyleft. It's just that nobody enforces it. From the text [1]: - "[I]f You Share Adapted Material You produce [..] The Adapter’s License You apply must be a Creative Commons license with the same License Elements, this version or later, or a BY-SA Compatible License." - "Adapted Material means material [..] that is derived from or based upon the Licensed Material" (emphasis added) - "Adapter's License means the license You apply to Your Copyright and Similar Rights in Your contributions to Adapted Material in accordance with the terms and conditions of this Public License.' - "You may not offer or impose any additional or different terms or conditions on, or apply any Effective Technological Measures to, Adapted Material that restrict exercise of the rights granted under the Adapter's License You apply." A program that includes a code snippet is unquestionably a derived work in most cases. That means that if you include a Stack Overflow code snippet in your program, and fair use does not apply, then you have to license the entire program under the CC-BY-SA. Alternately, you can license it under the GPLv3, because the license has a specific exemption allowing you to relicense under the GPLv3. For open source software under permissive licenses, it may actually be okay to consider the entire program as licensed under the CC-BY-SA, since permissive licenses are typically interpreted as allowing derived works to be licensed under different licenses; that's how GPL compatibility works. But you'd have to be careful you don't distribute the software in a way that applies any Effective Technological Measures, aka DRM. Such as via app stores, which often include DRM with no way for the app author to turn it off. (It may actually be better to relicense to the GPL, which 'only' prohibits adding additional terms and conditions, not the mere use of DRM. But people have claimed that the GPL also forbids app store distribution because the app store's terms and conditions count as additional restrictions.) For proprietary software where you do typically want to impose "different terms or conditions", this is a dead end. Note that copying extremely short snippets, or snippets which are essentially the only way to accomplish a task, may be considered fair use. But be careful; in Oracle v. Google, Google's accidental copying of 9 lines of utterly trivial code [2] was found to be neither fair use nor "de minimis", and thus infringing. Going back to Stack Overflow, these kinds of surprising results are why Creative Commons itself does not recommend using its licenses for code. But Stack Overflow does so anyway. Good thing nobody ever enforces the license! See also: https://opensource.stackexchange.com/questions/6777/can-i-use-source-code-licensed-under-cc-by-sa-for-commercial-closed-source-proje https://opensource.stackexchange.com/questions/6777/can-i-us... [1] https://creativecommons.org/licenses/by-sa/4.0/legalcode https://creativecommons.org/licenses/by-sa/4.0/legalcode [2] https://majadhondt.wordpress.com/2012/05/16/googles-9-lines/ https://majadhondt.wordpress.com/2012/05/16/googles-9-lines/
- summerlight 5y ago
  Google (and most of other big techs I guess?) also explicitly prohibit employees from use of stack overflow code snippets.
  - Noumenon72 5y ago
    I tried Googling this and couldn't find it. I also don't want to believe it because it seems like the world suddenly turned into an apocalyptic hellscape with no place for developers like me. Do you have a source?
    - xen0 5y ago
      I work at Google. SO definitely comes up during copyright/IP training. The basic idea is 'reading SO answers to learn how to solve a problem is fine, copying/transcribing the code is not'. Google is quite paranoid re. copyright and licenses.
    - jhugo 5y ago
      I don't have a source to link, but I've also been told this by someone who works at Google. Is copy-pasting stuff verbatim from SO really that much of a thing? I use SO plenty, but have never considered taking anything verbatim.
    - summerlight 5y ago
      First, I work at Google and its onboard training explicitly mentions Stack Overflow as a forbidden example due to CC-BY-SA license (SA is the problematic part). The following link is the official reference. https://opensource.google/docs/thirdparty/licenses/#restricted https://opensource.google/docs/thirdparty/licenses/#restrict...
- ljm 5y ago
  That's actually an attack vector: mirror SO using their open-sourced DB and inject malware into the suggestions, or change the text before it enters the clipboard. People blindly copy/pasting aren't going to notice.
alblue 5y ago
Same here. I’ve directed our teams and infra managers that we must be able to block the use of copilot for our firm’s code. Id be very surprised if the other large enterprises that I have worked at downs doing exactly the same thing. Too much legal risk, for practically no benefit.

fragmede 5y ago

Do you also block stack overflow and give guidance to never copy code from that website or elsewhere on the Internet? I'm legitimately curious - my org internally officially denounces the copying of stack overflow snippets. Thankfully for my role it's moot as I mostly work with an internal non-public language, for better or worse, and I have no idea how well that's followed elsewhere in the wider company.

mediaman 5y ago
Who really copies stack overflow snippets verbatim? It's usually just easier to refer to it for help figuring out the right structure and then adapt it for your own needs. Usually it needs customization for your own application anyway (variables, class instances, etc).
- canadev 5y ago
  Yeah! I've uh, ... never copied a bit of code into my repo verbatim, right? yeah right. I wish. (Not saying every dev does this)
  - TillE 5y ago
    I've copied plenty of Microsoft sample code verbatim, because the Win32 API sucks and their samples usually get the error handling right. But, I can't think of a single scenario where I've copied something from Stack Overflow. I'm searching for the idea of how to solve a problem, and typically the relevant code given is either too short to bother copying, or it's long and absolutely not consistent with how I want to write it.
    - Noumenon72 5y ago
      "Too short to bother copying"? I copy single words of text to avoid typing and typos. I would never type out even a single line of code when I could paste and edit.
      - alisonkisk 5y ago
        That's fair use.
      - vanous 5y ago
        > "Too short to bother copying"? I copy single words of text to avoid typing and typos. I would never type out even a single line of code when I could paste and edit. Very honest suggestion: learn how to touch type. You can still copy if needed, but your typed input will be much faster.
        Noumenon72 5y ago
        I'm somewhere between 45-75 wpm. But Ctrl+C Ctrl+V can type 300wpm! Typing when you could paste is like having that Github Copilot put the right sentence right in front of you and you decide to type over it instead. Not only does it feel like wasted and robotic effort, typing everything leads to RSI. I'm not sure why people disagree. Another symptom is that I insist on aliases for everything while others type out all the commands every time. Maybe I get distracted by the words when I type and lose my train of thought?
        Retric 5y ago
        You need to highly the correct test first and move the curser to the correct location to paste text. I bet you can type 123123 several times faster than you can highlight that text in this comment and past it into a reply.
        ec109685 5y ago
        Double click to select a word is fast, and then you are in per word selection mode.
- blooalien 5y ago
  I don't think I've ever copied code directly from any of the Stack* sites. I generally read all the answers (and comments) and then use what I learn to write my own (hopefully better) code specific to my needs.
  - corobo 5y ago
    Yeah my experience has always been "ohhh that solution makes sense" then I go write it myself If nothing else this whole copilot thing is helping ease some chronic imposter syndrome
- bartread 5y ago
  Ha! Well, I think a lot of people copy code from StackOverflow verbatim once at least - including me. Of course it turned out the code I'd blindly inserted into my project contained a number of bugs. In one or two cases, quite serious ones. This, even though it was the accepted answer. It was probably more effort to fix up the code I'd copy pasta'd than write it from scratch. Since then I've never copied and pasted from StackOverflow verbatim.
- baud147258 5y ago
  I think I did a few times, usually for languages that I wasn't going to spend to much time with (so no benefits in figuring how to do it from the answers) and for specific tasks.
samtheprogram 5y ago
Anything posted to Stack Overflow has a specific (Creative Commons IIRC) license associated with it. The same is not true of GitHub Copilot, and in fact their FAQ doesn’t specify a license at all, probably because they are technically unable to since it is trained on a wide variety of code from differing licenses (and code not written by a human is currently a grey area for copyright). The FAQ simply says to use it at your own risk.
gunapologist99 5y ago
Apples and oranges: Stack overflow snippets are explicitly granted under a permissive license, as long as you attribute. https://stackoverflow.com/help/licensing https://stackoverflow.com/help/licensing It appears that the code that copilot is using is created under a huge variety of licenses, making it risky. On the other hand, a small snippet in a function that is derived from many existing pieces of other code may fall under fair use, even if it is not under an open source license of some sort.
- comex 5y ago
  Except that CC-BY-SA is not a permissive license; the SA part is a form of copyleft. It's just that nobody enforces it. From the text [1]: - "[I]f You Share Adapted Material You produce [..] The Adapter’s License You apply must be a Creative Commons license with the same License Elements, this version or later, or a BY-SA Compatible License." - "Adapted Material means material [..] that is derived from or based upon the Licensed Material" (emphasis added) - "Adapter's License means the license You apply to Your Copyright and Similar Rights in Your contributions to Adapted Material in accordance with the terms and conditions of this Public License.' - "You may not offer or impose any additional or different terms or conditions on, or apply any Effective Technological Measures to, Adapted Material that restrict exercise of the rights granted under the Adapter's License You apply." A program that includes a code snippet is unquestionably a derived work in most cases. That means that if you include a Stack Overflow code snippet in your program, and fair use does not apply, then you have to license the entire program under the CC-BY-SA. Alternately, you can license it under the GPLv3, because the license has a specific exemption allowing you to relicense under the GPLv3. For open source software under permissive licenses, it may actually be okay to consider the entire program as licensed under the CC-BY-SA, since permissive licenses are typically interpreted as allowing derived works to be licensed under different licenses; that's how GPL compatibility works. But you'd have to be careful you don't distribute the software in a way that applies any Effective Technological Measures, aka DRM. Such as via app stores, which often include DRM with no way for the app author to turn it off. (It may actually be better to relicense to the GPL, which 'only' prohibits adding additional terms and conditions, not the mere use of DRM. But people have claimed that the GPL also forbids app store distribution because the app store's terms and conditions count as additional restrictions.) For proprietary software where you do typically want to impose "different terms or conditions", this is a dead end. Note that copying extremely short snippets, or snippets which are essentially the only way to accomplish a task, may be considered fair use. But be careful; in Oracle v. Google, Google's accidental copying of 9 lines of utterly trivial code [2] was found to be neither fair use nor "de minimis", and thus infringing. Going back to Stack Overflow, these kinds of surprising results are why Creative Commons itself does not recommend using its licenses for code. But Stack Overflow does so anyway. Good thing nobody ever enforces the license! See also: https://opensource.stackexchange.com/questions/6777/can-i-use-source-code-licensed-under-cc-by-sa-for-commercial-closed-source-proje https://opensource.stackexchange.com/questions/6777/can-i-us... [1] https://creativecommons.org/licenses/by-sa/4.0/legalcode https://creativecommons.org/licenses/by-sa/4.0/legalcode [2] https://majadhondt.wordpress.com/2012/05/16/googles-9-lines/ https://majadhondt.wordpress.com/2012/05/16/googles-9-lines/
summerlight 5y ago
Google (and most of other big techs I guess?) also explicitly prohibit employees from use of stack overflow code snippets.
- Noumenon72 5y ago
  I tried Googling this and couldn't find it. I also don't want to believe it because it seems like the world suddenly turned into an apocalyptic hellscape with no place for developers like me. Do you have a source?
  - xen0 5y ago
    I work at Google. SO definitely comes up during copyright/IP training. The basic idea is 'reading SO answers to learn how to solve a problem is fine, copying/transcribing the code is not'. Google is quite paranoid re. copyright and licenses.
  - jhugo 5y ago
    I don't have a source to link, but I've also been told this by someone who works at Google. Is copy-pasting stuff verbatim from SO really that much of a thing? I use SO plenty, but have never considered taking anything verbatim.
  - summerlight 5y ago
    First, I work at Google and its onboard training explicitly mentions Stack Overflow as a forbidden example due to CC-BY-SA license (SA is the problematic part). The following link is the official reference. https://opensource.google/docs/thirdparty/licenses/#restricted https://opensource.google/docs/thirdparty/licenses/#restrict...
ljm 5y ago
That's actually an attack vector: mirror SO using their open-sourced DB and inject malware into the suggestions, or change the text before it enters the clipboard. People blindly copy/pasting aren't going to notice.

alblue 5y ago

Same here. I’ve directed our teams and infra managers that we must be able to block the use of copilot for our firm’s code. Id be very surprised if the other large enterprises that I have worked at downs doing exactly the same thing. Too much legal risk, for practically no benefit.