4 ms·

This is exactly why people have issue with Github's Copilot. It's not the technology, but the fact that any code you pushed to GitHub in the past 13 years is n

This is exactly why people have issue with Github's Copilot. It's not the technology, but the fact that any code you pushed to GitHub in the past 13 years is now 'accessible' to anyone. Private repo? Paid account? Deleted repo five years ago? Deleted repo today? Proprietary code? Embarassing commits? Accidental API keys or passwords in commits? All 'available'. It feels like the entirety of GitHub was just 'leaked', and converted into a marketable product. Would you push your code to a service if you knew it could be read by anyone one to ten years from now? Even if you paid to keep it a secret?

danielbln 5y ago
Wasn't Codex (the tech underlying CoPilot) trained on purely publicly available repos?
- IshKebab 5y ago
  Yes. nomercy400 is wrong.
- WillDaSilva 5y ago
  The issue of deleted repositories being available through it would still exist. Whether or not GitHub should be blamed for that is another matter.
  - lolinder 5y ago
    Once you put something on the internet, you should assume it still exists out there somewhere even after deleting it. Even before copilot, all credentials that end up in a repo needed to be changed. I'm not sure what's supposed to be different now.
- lars 5y ago
  Yes, it was. From their site: "It has been trained on a selection of English language and source code from publicly available sources, including code in public repositories on GitHub."
lolinder 5y ago
I'm not sold on the product, but it's important to note that GitHub Copilot was only trained on public repos, which means nothing should be out in the open that wasn't already made public by the authors.[0] > GitHub Copilot is powered by OpenAI Codex, a new AI system created by OpenAI. It has been trained on a selection of English language and source code from publicly available sources, including code in public repositories on GitHub. [0] https://copilot.github.com/ https://copilot.github.com/
jeroenhd 5y ago
I know that some people have uploaded the Microsoft research kernel or even the leaked Windows source code to github at some point. I wonder what Microsoft will do when snippets from that code start appearing in your code because of copilot. I'm guessing their lawyers wouldn't accept "the robot did it" as an excuse in that case. I'm tempted to just throwing stuff like "AWS_KEY=" at the algorithm and see how many working credentials I can steal from private repos.
- enriquto 5y ago
  > I'm tempted to just throwing stuff like "AWS_KEY=" at the algorithm and see Anybody tried? What does actually happen if you do this kind of thing? I can think of a few more obvious "script kiddie" ideas, but I won't post them here lest a copilot developer sees it and closes all the elementary stuff.
ForHackernews 5y ago
> Would you push your code to a service if you knew it could be read by anyone one to ten years from now? Even if you paid to keep it a secret? I'm old enough to remember when "assume anything you put in cleartext online is public" was received wisdom. We were taught that if you want to keep something private, keep it encrypted on your own local media. Or, failing that, at least on a server you control.

danielbln 5y ago

Wasn't Codex (the tech underlying CoPilot) trained on purely publicly available repos?

IshKebab 5y ago
Yes. nomercy400 is wrong.
WillDaSilva 5y ago
The issue of deleted repositories being available through it would still exist. Whether or not GitHub should be blamed for that is another matter.
- lolinder 5y ago
  Once you put something on the internet, you should assume it still exists out there somewhere even after deleting it. Even before copilot, all credentials that end up in a repo needed to be changed. I'm not sure what's supposed to be different now.
lars 5y ago
Yes, it was. From their site: "It has been trained on a selection of English language and source code from publicly available sources, including code in public repositories on GitHub."

lolinder 5y ago

I'm not sold on the product, but it's important to note that GitHub Copilot was only trained on public repos, which means nothing should be out in the open that wasn't already made public by the authors.[0] > GitHub Copilot is powered by OpenAI Codex, a new AI system created by OpenAI. It has been trained on a selection of English language and source code from publicly available sources, including code in public repositories on GitHub. [0] https://copilot.github.com/ https://copilot.github.com/

jeroenhd 5y ago

I know that some people have uploaded the Microsoft research kernel or even the leaked Windows source code to github at some point. I wonder what Microsoft will do when snippets from that code start appearing in your code because of copilot. I'm guessing their lawyers wouldn't accept "the robot did it" as an excuse in that case. I'm tempted to just throwing stuff like "AWS_KEY=" at the algorithm and see how many working credentials I can steal from private repos.

enriquto 5y ago
> I'm tempted to just throwing stuff like "AWS_KEY=" at the algorithm and see Anybody tried? What does actually happen if you do this kind of thing? I can think of a few more obvious "script kiddie" ideas, but I won't post them here lest a copilot developer sees it and closes all the elementary stuff.

ForHackernews 5y ago

> Would you push your code to a service if you knew it could be read by anyone one to ten years from now? Even if you paid to keep it a secret? I'm old enough to remember when "assume anything you put in cleartext online is public" was received wisdom. We were taught that if you want to keep something private, keep it encrypted on your own local media. Or, failing that, at least on a server you control.