6 ms·

> If you look at the GitHub Terms of Service, no matter what license you use, you give GitHub the right to host your code and to use your code to improve their

by jefftk 5y ago

> If you look at the GitHub Terms of Service, no matter what license you use, you give GitHub the right to host your code and to use your code to improve their products and features. So with respect to code that’s already on GitHub, I think the answer to the question of copyright infringement is fairly straightforward. This doesn't sound right. Alice writes code, and releases it under some restrictive license (GPL, something source-available, etc). Bob uploads it to GitHub, correctly labeled as GPL. Regardless of GitHub's TOS, Bob isn't able to give GitHub any additional rights to the code beyond what Alice gave him. I think the later discussion about whether this falls under Fair Use is the important question.

pc86 5y ago
If Bob is unable to give GitHub the rights that GitHub demands, then it means Bob was unable to lawfully upload the code to GitHub in the first place. You're making an argument that Bob violated GitHub's terms, not that GitHub is violating Alice's (though that may also be true).
- jefftk 5y ago
  GitHub's primary business is hosting open source software. There's no way they are going to claim that every user who uploaded code without owning the full rights is violating their TOS.
  - dogleash 5y ago
    >There's no way they are going to claim that every user who uploaded code without owning the full rights is violating their TOS. If they're taken to court and that part of the TOS is relevant to the issue, then yes, they can and will argue exactly that.
    - eitland 5y ago
      Well then let's hope the judges apply the same standards as when criminals claim they wasn't aware that the money they got was being laundered through them.
      - blackoil 5y ago
        Doesn't banks/financial institutions have similar protection. Unless someone can prove that they were aware of it or it makes substantial part of operations. I haven't heard of Google being sued when play store cards are used bu fraud victims.
        eitland 5y ago
        > Unless someone can prove that they were aware of it or it makes substantial part of operations. In Norway I think the rule is often "is aware of it or should have been aware of it". > I haven't heard of Google being sued when play store cards are used by fraud victims. Banks try to prevent cards from being abused and I guess Google try to. For example when someone tried to buy jewelry in an American store with my stolen card number the card was immediately locked. Sometimes something slips through though and banks won't be held accountable for that. The difference here is that there is no way GitHub cannot be aware that people upload personal projects from EU and copies of open source projects etc without agreement from the copyright holder. Besides the easily missed clause in the terms there is nothing to prevent it. Now if they'd done any reasonable effort to inform about it: a couple of blog posts over the years, a "Please note:" banner, even mentioning it in discussions here on HN before doing this that would have counted to their defense. As far as I am aware no such thing happened.
    - jefftk 5y ago
      That would destroy their business.
- ipaddr 5y ago
  That's moving the goalposts after the fact. What about all of the code that existed before Microsoft purchased them and before new licease language was introduced?
  - mikeryan 5y ago
    TOS language is usually not grandfathered in.
  - lindenksv85 5y ago
    All of these terms of service have an assignment provision that allows the provider to assign the agreement to an acquirer. So the license you gave to GitHub moves to Microsoft (though here the license likely remains with GitHub because they are an independent subsidiary). All of these agreements also say they can unilaterally change terms whenever. The terms are generally always broad enough to cover these circumstances.
- mikeryan 5y ago
  You’re right that Bob’s the infringer here and not GitHub. But I’m not sure where that would place the derived work that’s eventually used. Which is the point of the article a bit. GitHub is likely not infringing but it’s also not absolving the end user of any infringement. Neat trick. That being said I think the risk is minimal enough that I’d be pretty comfortable with using it.
- eitland 5y ago
  I learned here on HN that contracts are supposed to be a "meeting of minds". And in EU, as a consumer, you can pretty much ignore most EULAs because they aren't valid if they break EU consumer protections. Now if your interpretation is correct the idea of a meeting of minds falls completely on its face. And, as a lot of individuals also upload their projects to GitHub, GitHub is on shaky ground there as well. I think most EULAs have clauses like these in them but we are always told that it is because of crazy American lawyers and nothing to worry about. If Microsoft decides to prove once and for all that we should worry about ridiculously broad claims in EULAs I think it will be hard for GitHub to continue to operate in more sane jurisdictions.
  - otterley 5y ago
    > I learned here on HN that contracts are supposed to be a "meeting of minds". HN is not law school and you would be well-advised not to treat it as one. There's a ton of false information about the law flying around here and not nearly enough educated people or time to correct it all. If you want to know the law, go to law school, or ask a practicing lawyer.
    - dragonwriter 5y ago
      > > I learned here on HN that contracts are supposed to be a "meeting of minds". > HN is not law school and you would be well-advised not to treat it as one. There's a ton of false information about the law flying around here and not nearly enough educated people or time to correct it all. Since I learned the exact same thing about contracts being supposed to be a “meeting of the minds” in the first week of Contracts in law school (and much of the rest of Contracts was rules that have been developed operationalizing that principle), while I would agree with your “HN is not law school...” rant as a general rule, I don’t think its germane to the quoted statement.
      - otterley 5y ago
        The problem is that people here tend to take a true generalization and form incorrect conclusions from it in the absence of proper legal education. That’s why I advise caution.
- kuratkull 5y ago
  Violating the TOS is not illegal, Bob would be in breach and GitHub could take measures against Bob's account. Github would be violating Alice's copyright license though, that is legally enforceable
  - lindenksv85 5y ago
    Sort of. DMCA protects service providers against copyright infringement claims related to stuff uploaded to their services by third parties. So long as they adhere to DMCA requests, they’re not violating copyright law themselves.
    - bigwavedave 5y ago
      > Sort of. DMCA protects service providers against copyright infringement claims related to stuff uploaded to their services by third parties. So long as they adhere to DMCA requests, they’re not violating copyright law themselves. This is probably an extremely stupid question as I'm neither a lawyer nor an ML dev (merely an humble backend developer), but let's say that the above situation applies and that Github has taken down Bob's repo as per Alice's DMCA request. However, let's say that in between Bob uploading the offending code and Alice submitting the DMCA request, Github used Bob's repo as part of a training set for Copilot. Now that they've complied with the takedown request, does Github have to restore Copilot to an earlier state that hadn't yet been trained by Bob's repo? Does this question even make sense since I only know the absolute barest bones of ML?
      - rented_mule 5y ago
        Also not a lawyer, but I've been around ML for a while. The question makes perfect sense to me! It takes some amount of time to comply with a takedown notice. For example, time passes between receiving Alice's notice and taking down Bob's repo. I would expect Copilot's model(s) to be retrained periodically in order to remain relevant. The next retraining could exclude Alice's code. That might be a longer window than the case of the repo takedown, but as long as it doesn't take too long they might be okay? There are incremental training approaches that evolve models over time rather than completely retraining them. In my experience, complete retraining is a far more common approach because the highly path dependent nature of incremental training can lead to outcomes that are hard to manage. For example, what if you discover bad training data like repos that collect anti-patterns? Or Alice's takedown notice? You typically want your models to be able to "unsee" things and that's hard with purely incremental training. Even when incremental approaches are used, there is often an occasional complete retraining to overcome such issues. To be clear, I have no idea what training approach is used for Copilot.
- lucideer 5y ago
  IANAL but having read the ToS, I think the author is failing to distinguish between "Your Content" and "Content You Uploaded". GH's ToS don't prevent Bob uploading content Bob doesn't own. The ToS does require Bob to grant GH a licence to use any content uploaded that Bob owns. It doesn't prevent Bob uploading others' content nor does it ask Bob to grant GH licence to it. --- If you're reading the ToS yourself, the keyword to look out for is "Your Content", which is defined in their Definitions section as such: > “User-Generated Content” is Content, written or otherwise, created or uploaded by our Users. > "Your Content" is Content that you create or own. The licence grant to GH is only on "Your Content", not on "User-Generated Content" (i.e. content you upload, which may be yours or someone else's)

by jefftk 5y ago

pc86 5y ago

If Bob is unable to give GitHub the rights that GitHub demands, then it means Bob was unable to lawfully upload the code to GitHub in the first place. You're making an argument that Bob violated GitHub's terms, not that GitHub is violating Alice's (though that may also be true).

jefftk 5y ago
GitHub's primary business is hosting open source software. There's no way they are going to claim that every user who uploaded code without owning the full rights is violating their TOS.
- dogleash 5y ago
  >There's no way they are going to claim that every user who uploaded code without owning the full rights is violating their TOS. If they're taken to court and that part of the TOS is relevant to the issue, then yes, they can and will argue exactly that.
  - eitland 5y ago
    Well then let's hope the judges apply the same standards as when criminals claim they wasn't aware that the money they got was being laundered through them.
    - blackoil 5y ago
      Doesn't banks/financial institutions have similar protection. Unless someone can prove that they were aware of it or it makes substantial part of operations. I haven't heard of Google being sued when play store cards are used bu fraud victims.
      - eitland 5y ago
        > Unless someone can prove that they were aware of it or it makes substantial part of operations. In Norway I think the rule is often "is aware of it or should have been aware of it". > I haven't heard of Google being sued when play store cards are used by fraud victims. Banks try to prevent cards from being abused and I guess Google try to. For example when someone tried to buy jewelry in an American store with my stolen card number the card was immediately locked. Sometimes something slips through though and banks won't be held accountable for that. The difference here is that there is no way GitHub cannot be aware that people upload personal projects from EU and copies of open source projects etc without agreement from the copyright holder. Besides the easily missed clause in the terms there is nothing to prevent it. Now if they'd done any reasonable effort to inform about it: a couple of blog posts over the years, a "Please note:" banner, even mentioning it in discussions here on HN before doing this that would have counted to their defense. As far as I am aware no such thing happened.
  - jefftk 5y ago
    That would destroy their business.
ipaddr 5y ago
That's moving the goalposts after the fact. What about all of the code that existed before Microsoft purchased them and before new licease language was introduced?
- mikeryan 5y ago
  TOS language is usually not grandfathered in.
- lindenksv85 5y ago
  All of these terms of service have an assignment provision that allows the provider to assign the agreement to an acquirer. So the license you gave to GitHub moves to Microsoft (though here the license likely remains with GitHub because they are an independent subsidiary). All of these agreements also say they can unilaterally change terms whenever. The terms are generally always broad enough to cover these circumstances.
mikeryan 5y ago
You’re right that Bob’s the infringer here and not GitHub. But I’m not sure where that would place the derived work that’s eventually used. Which is the point of the article a bit. GitHub is likely not infringing but it’s also not absolving the end user of any infringement. Neat trick. That being said I think the risk is minimal enough that I’d be pretty comfortable with using it.
eitland 5y ago
I learned here on HN that contracts are supposed to be a "meeting of minds". And in EU, as a consumer, you can pretty much ignore most EULAs because they aren't valid if they break EU consumer protections. Now if your interpretation is correct the idea of a meeting of minds falls completely on its face. And, as a lot of individuals also upload their projects to GitHub, GitHub is on shaky ground there as well. I think most EULAs have clauses like these in them but we are always told that it is because of crazy American lawyers and nothing to worry about. If Microsoft decides to prove once and for all that we should worry about ridiculously broad claims in EULAs I think it will be hard for GitHub to continue to operate in more sane jurisdictions.
- otterley 5y ago
  > I learned here on HN that contracts are supposed to be a "meeting of minds". HN is not law school and you would be well-advised not to treat it as one. There's a ton of false information about the law flying around here and not nearly enough educated people or time to correct it all. If you want to know the law, go to law school, or ask a practicing lawyer.
  - dragonwriter 5y ago
    > > I learned here on HN that contracts are supposed to be a "meeting of minds". > HN is not law school and you would be well-advised not to treat it as one. There's a ton of false information about the law flying around here and not nearly enough educated people or time to correct it all. Since I learned the exact same thing about contracts being supposed to be a “meeting of the minds” in the first week of Contracts in law school (and much of the rest of Contracts was rules that have been developed operationalizing that principle), while I would agree with your “HN is not law school...” rant as a general rule, I don’t think its germane to the quoted statement.
    - otterley 5y ago
      The problem is that people here tend to take a true generalization and form incorrect conclusions from it in the absence of proper legal education. That’s why I advise caution.
kuratkull 5y ago
Violating the TOS is not illegal, Bob would be in breach and GitHub could take measures against Bob's account. Github would be violating Alice's copyright license though, that is legally enforceable
- lindenksv85 5y ago
  Sort of. DMCA protects service providers against copyright infringement claims related to stuff uploaded to their services by third parties. So long as they adhere to DMCA requests, they’re not violating copyright law themselves.
  - bigwavedave 5y ago
    > Sort of. DMCA protects service providers against copyright infringement claims related to stuff uploaded to their services by third parties. So long as they adhere to DMCA requests, they’re not violating copyright law themselves. This is probably an extremely stupid question as I'm neither a lawyer nor an ML dev (merely an humble backend developer), but let's say that the above situation applies and that Github has taken down Bob's repo as per Alice's DMCA request. However, let's say that in between Bob uploading the offending code and Alice submitting the DMCA request, Github used Bob's repo as part of a training set for Copilot. Now that they've complied with the takedown request, does Github have to restore Copilot to an earlier state that hadn't yet been trained by Bob's repo? Does this question even make sense since I only know the absolute barest bones of ML?
    - rented_mule 5y ago
      Also not a lawyer, but I've been around ML for a while. The question makes perfect sense to me! It takes some amount of time to comply with a takedown notice. For example, time passes between receiving Alice's notice and taking down Bob's repo. I would expect Copilot's model(s) to be retrained periodically in order to remain relevant. The next retraining could exclude Alice's code. That might be a longer window than the case of the repo takedown, but as long as it doesn't take too long they might be okay? There are incremental training approaches that evolve models over time rather than completely retraining them. In my experience, complete retraining is a far more common approach because the highly path dependent nature of incremental training can lead to outcomes that are hard to manage. For example, what if you discover bad training data like repos that collect anti-patterns? Or Alice's takedown notice? You typically want your models to be able to "unsee" things and that's hard with purely incremental training. Even when incremental approaches are used, there is often an occasional complete retraining to overcome such issues. To be clear, I have no idea what training approach is used for Copilot.
lucideer 5y ago
IANAL but having read the ToS, I think the author is failing to distinguish between "Your Content" and "Content You Uploaded". GH's ToS don't prevent Bob uploading content Bob doesn't own. The ToS does require Bob to grant GH a licence to use any content uploaded that Bob owns. It doesn't prevent Bob uploading others' content nor does it ask Bob to grant GH licence to it. --- If you're reading the ToS yourself, the keyword to look out for is "Your Content", which is defined in their Definitions section as such: > “User-Generated Content” is Content, written or otherwise, created or uploaded by our Users. > "Your Content" is Content that you create or own. The licence grant to GH is only on "Your Content", not on "User-Generated Content" (i.e. content you upload, which may be yours or someone else's)