9 ms·

Does Copilot already display the licenses of the code it might insert/suggest, or assure the developer, that the inserted/suggested code is not a verbatim copy

Does Copilot already display the licenses of the code it might insert/suggest, or assure the developer, that the inserted/suggested code is not a verbatim copy of existing code? How can developers be sure, that they are not violating licenses by using Copilot?

anon2020dot00 4y ago
My sincere question is what if a developer looks at some GPL code, and then that developer encounters a situation in a corporate project where-in he uses the GPL code from memory, is that already a violation? So to avoid a violation a developer needs to perform a mind-wipe?
- eat_lemons 4y ago
  There are many instances of people not even being able to see the code in question, see clean room engineering An example for wine/proton/reactos developers from a moderator on the forum about the leaked windows xp code: "You look at the code? You worked for MS? No dev for us! It's that easy." https://reactos.org/forum/viewtopic.php?t=20189 https://reactos.org/forum/viewtopic.php?t=20189 There are many instances of large lawsuits where just seeing the old code made you in eligible to even touch the new code
- deleted 4y ago
  [deleted]
- bladegash 4y ago
  I’d be even more curious (more philosophically than anything) as to who is liable for the mishap if Copilot suggests something that ends up violating a license. Is it the developer? The developer’s company? GitHub? Maybe the “AI” is the ultimate scapegoat (“we can’t be liable for what our helpful robot decides to do”)!
  - carschno 4y ago
    The details might differ per country, but my non-lawyer intuition clearly says that you are responsible for the code you publish, no matter what tool has suggested it.
    - bladegash 4y ago
      I’m sure at the end of the day that would be the case in most sane legal systems. However, it does seem almost impractical in reality for anyone to do anything about it (kind of like Uber/Lyft/Airbnb making something so commonplace so quickly that the regulations they broke became meaningless).
    - deleted 4y ago
      [deleted]
  - theplumber 4y ago
    It's the developer. Just because you copy/paste something you find on SO or Google or Githib doesn't absolve you of copyright infridgements
    - ska 4y ago
      In most jurisdictions, if the developer is an employee the legal liability is with the company.
- sp332 4y ago
  It's arguable. Copyright cares a lot about provenance, transformation, and commercial consequences. It all comes down to what you can afford to litigate. Some projects go to extreme lengths, like Wine not accepting code from anyone who has seen leaked Windows sources.
- kweingar 4y ago
  If the code is nontrivial, then yes, it is a violation. To be in compliance, you need to write your own code. If I am writing a novel and I copy a section verbatim from another novel, I am infringing on the other novelist's copyright, regardless of whether I wrote it from memory or not. And this makes sense. For a trivial operation, there might be only one way to write the code. That's not copyright infringement, just like you're not infringing on an author's copyright by occasionally writing a sentence that was similar to theirs. For a nontrivial operation, you can easily write your own code without copying someone else's work. Remember also that you can use others' ideas. Copyright only cares about the code itself. If there's a clever trick that you've seen someone use, you're free to use the same clever trick as long as 1) they didn't patent it and 2) you're not actually copying their code
  - danuker 4y ago
    fair use != trivial
    - marcosdumay 4y ago
      It's not about fair use. If you have a problem that can only be solved by one specific implementation, that implementation is not copyrightable because it has no creativity behind it.
- hourago 4y ago
  > that developer encounters a situation in a corporate project where-in he uses the GPL code from memory If you draw Micky Mouse from memory, Disney still owns the copyright.
duxup 4y ago
From my experience with it the suggestions are so generic it's hard to imagine anyone has a legit license to "formatDateISO....() {code here}". Maybe I'm using it wrong but I've hardly seen it pump out a mass volume of code.
- bladegash 4y ago
  Nope, have had the same experience as you and am of a similar opinion!
- lelandfe 4y ago
  You really only need one example to offset this anecdote, so here you are: https://mobile.twitter.com/mitsuhiko/status/1410886329924194309 https://mobile.twitter.com/mitsuhiko/status/1410886329924194... Copyright violations are a genuine concern from the outputted code, GitHub themselves have admitted it may emit raw training data rarely.
  - natefinch 4y ago
    There is logic to ensure that copilot does not emit exact duplicates of code in the training set... but that logic is significantly newer than that tweet.
    - lelandfe 4y ago
      Link? I couldn't find anything "significantly newer" than 7/2/21 (though I'm sure GitHub is doing a lot here). They had this blog post 6/30/21 regarding efforts on avoiding raw code: https://github.blog/2021-06-30-github-copilot-research-recitation/ https://github.blog/2021-06-30-github-copilot-research-recit.... They concluded: > We will both continue to work on decreasing rates of recitation, as well as making its detection more precise.
      - natefinch 4y ago
        Source: I work on the copilot team.
deleted 4y ago
[deleted]
bladegash 4y ago
Others may have a different experience, but I have never seen Copilot offer suggestions anywhere near complicated/unique enough for it to matter. That’s not a knock on Copilot, I think it’s a great product and I happily subscribed today after using it the last few months!
- lm28469 4y ago
  It's my experience too. It's a fancy autocomplete that works about 30% of the time for me, I'm not actually sure I'm saving time by using it.
lelandfe 4y ago
Previously discussed at length here: https://news.ycombinator.com/item?id=27773157 https://news.ycombinator.com/item?id=27773157 > or assure the developer, that the inserted/suggested code is not a verbatim copy of existing code No, it does not do that. > How can developers be sure, that they are not violating licenses by using Copilot There are no clear answers.
- nimbius 4y ago
  from Microsofts standpoint the shot across the bow for open source licenses is clear: do you have enough lawyers and experts to convince a gerontocracy of the legislative branch of the US government that its not "okay because its AI" because if you dont, then thanks for the code nerd.
  - deleted 4y ago
    [deleted]
  - tannhaeuser 4y ago
    Idk if MS is on the safe here. There's a straightforward legal theory for suing, and also parties such as EFF and others with a war chest and the determination to clarify this. Does MS provide indemnification to Copilot customers/users if those are sued by others? My advice would be to stay clear of Copilot.
  - LegitShady 4y ago
    it sounds like a good basis for a class action lawsuit, where the class are the people who own the licensed code whose license microsoft is ignoring.
    - account42 4y ago
      Can't wait to get my three fiddy for my open source repos.
    - anonymoushn 4y ago
      Seems like I'll get paid for this a while after I get paid for TurnItIn selling a product based on stealing my work
injidup 4y ago
From the FAQ """ We built a filter to help detect and suppress the rare instances where a GitHub Copilot suggestion contains code that matches public code on GitHub. You have the choice to turn that filter on or off during setup. With the filter on, GitHub Copilot checks code suggestions with its surrounding code for matches or near matches (ignoring whitespace) against public code on GitHub of about 150 characters. If there is a match, the suggestion will not be shown to you. We plan on continuing to evolve this approach and welcome feedback and comment. """
- pydry 4y ago
  I remember reading something like this just before somebody proved that it would recite Carmack's square root algorithm word for word.
- lucideer 4y ago
  > the rare instances That's a bold statement considering how easy it was for testers to quickly find examples of this in initial testing. > against public code on GitHub ... and how some of those examples found were from code not hosted on Github. Ultimately though, what matters here is not whether this is true but whether it's plausible enough for legal departments in companies buy it.
  - treesprite82 4y ago
    Do you recall/have a link to such examples? Would be interesting to try them again with the filter. The example I can remember was Carmack's* quick square root - but I'd probably call that "folk code" given it was passed down/altered before being misattributed to the Quake dev, and appears in hundreds of Github repos (many with permissive licenses like WTFPL, so a well-intentioned human may do the same).
  - lelandfe 4y ago
    https://github.blog/2021-06-30-github-copilot-research-recitation/ https://github.blog/2021-06-30-github-copilot-research-recit... > That corresponds to one recitation event every 10 user weeks > This investigation demonstrates that GitHub Copilot can quote a body of code verbatim, yet it rarely does so, and when it does, it mostly quotes code that everybody quotes, typically at the beginning of a file, as if to break the ice A year old post now, YMMV.
AdmiralAsshat 4y ago
The fact that GitHub is now charging for this feature smells like a lawsuit waiting to happen. They're now literally profiting from potentially stolen GPL code.

anon2020dot00 4y ago

My sincere question is what if a developer looks at some GPL code, and then that developer encounters a situation in a corporate project where-in he uses the GPL code from memory, is that already a violation? So to avoid a violation a developer needs to perform a mind-wipe?

eat_lemons 4y ago
There are many instances of people not even being able to see the code in question, see clean room engineering An example for wine/proton/reactos developers from a moderator on the forum about the leaked windows xp code: "You look at the code? You worked for MS? No dev for us! It's that easy." https://reactos.org/forum/viewtopic.php?t=20189 https://reactos.org/forum/viewtopic.php?t=20189 There are many instances of large lawsuits where just seeing the old code made you in eligible to even touch the new code
deleted 4y ago
[deleted]
bladegash 4y ago
I’d be even more curious (more philosophically than anything) as to who is liable for the mishap if Copilot suggests something that ends up violating a license. Is it the developer? The developer’s company? GitHub? Maybe the “AI” is the ultimate scapegoat (“we can’t be liable for what our helpful robot decides to do”)!
- carschno 4y ago
  The details might differ per country, but my non-lawyer intuition clearly says that you are responsible for the code you publish, no matter what tool has suggested it.
  - bladegash 4y ago
    I’m sure at the end of the day that would be the case in most sane legal systems. However, it does seem almost impractical in reality for anyone to do anything about it (kind of like Uber/Lyft/Airbnb making something so commonplace so quickly that the regulations they broke became meaningless).
  - deleted 4y ago
    [deleted]
- theplumber 4y ago
  It's the developer. Just because you copy/paste something you find on SO or Google or Githib doesn't absolve you of copyright infridgements
  - ska 4y ago
    In most jurisdictions, if the developer is an employee the legal liability is with the company.
sp332 4y ago
It's arguable. Copyright cares a lot about provenance, transformation, and commercial consequences. It all comes down to what you can afford to litigate. Some projects go to extreme lengths, like Wine not accepting code from anyone who has seen leaked Windows sources.
kweingar 4y ago
If the code is nontrivial, then yes, it is a violation. To be in compliance, you need to write your own code. If I am writing a novel and I copy a section verbatim from another novel, I am infringing on the other novelist's copyright, regardless of whether I wrote it from memory or not. And this makes sense. For a trivial operation, there might be only one way to write the code. That's not copyright infringement, just like you're not infringing on an author's copyright by occasionally writing a sentence that was similar to theirs. For a nontrivial operation, you can easily write your own code without copying someone else's work. Remember also that you can use others' ideas. Copyright only cares about the code itself. If there's a clever trick that you've seen someone use, you're free to use the same clever trick as long as 1) they didn't patent it and 2) you're not actually copying their code
- danuker 4y ago
  fair use != trivial
  - marcosdumay 4y ago
    It's not about fair use. If you have a problem that can only be solved by one specific implementation, that implementation is not copyrightable because it has no creativity behind it.
hourago 4y ago
> that developer encounters a situation in a corporate project where-in he uses the GPL code from memory If you draw Micky Mouse from memory, Disney still owns the copyright.

duxup 4y ago

From my experience with it the suggestions are so generic it's hard to imagine anyone has a legit license to "formatDateISO....() {code here}". Maybe I'm using it wrong but I've hardly seen it pump out a mass volume of code.

bladegash 4y ago
Nope, have had the same experience as you and am of a similar opinion!
lelandfe 4y ago
You really only need one example to offset this anecdote, so here you are: https://mobile.twitter.com/mitsuhiko/status/1410886329924194309 https://mobile.twitter.com/mitsuhiko/status/1410886329924194... Copyright violations are a genuine concern from the outputted code, GitHub themselves have admitted it may emit raw training data rarely.
- natefinch 4y ago
  There is logic to ensure that copilot does not emit exact duplicates of code in the training set... but that logic is significantly newer than that tweet.
  - lelandfe 4y ago
    Link? I couldn't find anything "significantly newer" than 7/2/21 (though I'm sure GitHub is doing a lot here). They had this blog post 6/30/21 regarding efforts on avoiding raw code: https://github.blog/2021-06-30-github-copilot-research-recitation/ https://github.blog/2021-06-30-github-copilot-research-recit.... They concluded: > We will both continue to work on decreasing rates of recitation, as well as making its detection more precise.
    - natefinch 4y ago
      Source: I work on the copilot team.

deleted 4y ago

[deleted]

bladegash 4y ago

Others may have a different experience, but I have never seen Copilot offer suggestions anywhere near complicated/unique enough for it to matter. That’s not a knock on Copilot, I think it’s a great product and I happily subscribed today after using it the last few months!

lm28469 4y ago
It's my experience too. It's a fancy autocomplete that works about 30% of the time for me, I'm not actually sure I'm saving time by using it.

lelandfe 4y ago

Previously discussed at length here: https://news.ycombinator.com/item?id=27773157 https://news.ycombinator.com/item?id=27773157 > or assure the developer, that the inserted/suggested code is not a verbatim copy of existing code No, it does not do that. > How can developers be sure, that they are not violating licenses by using Copilot There are no clear answers.

nimbius 4y ago
from Microsofts standpoint the shot across the bow for open source licenses is clear: do you have enough lawyers and experts to convince a gerontocracy of the legislative branch of the US government that its not "okay because its AI" because if you dont, then thanks for the code nerd.
- deleted 4y ago
  [deleted]
- tannhaeuser 4y ago
  Idk if MS is on the safe here. There's a straightforward legal theory for suing, and also parties such as EFF and others with a war chest and the determination to clarify this. Does MS provide indemnification to Copilot customers/users if those are sued by others? My advice would be to stay clear of Copilot.
- LegitShady 4y ago
  it sounds like a good basis for a class action lawsuit, where the class are the people who own the licensed code whose license microsoft is ignoring.
  - account42 4y ago
    Can't wait to get my three fiddy for my open source repos.
  - anonymoushn 4y ago
    Seems like I'll get paid for this a while after I get paid for TurnItIn selling a product based on stealing my work

injidup 4y ago

From the FAQ """ We built a filter to help detect and suppress the rare instances where a GitHub Copilot suggestion contains code that matches public code on GitHub. You have the choice to turn that filter on or off during setup. With the filter on, GitHub Copilot checks code suggestions with its surrounding code for matches or near matches (ignoring whitespace) against public code on GitHub of about 150 characters. If there is a match, the suggestion will not be shown to you. We plan on continuing to evolve this approach and welcome feedback and comment. """

pydry 4y ago
I remember reading something like this just before somebody proved that it would recite Carmack's square root algorithm word for word.
lucideer 4y ago
> the rare instances That's a bold statement considering how easy it was for testers to quickly find examples of this in initial testing. > against public code on GitHub ... and how some of those examples found were from code not hosted on Github. Ultimately though, what matters here is not whether this is true but whether it's plausible enough for legal departments in companies buy it.
- treesprite82 4y ago
  Do you recall/have a link to such examples? Would be interesting to try them again with the filter. The example I can remember was Carmack's* quick square root - but I'd probably call that "folk code" given it was passed down/altered before being misattributed to the Quake dev, and appears in hundreds of Github repos (many with permissive licenses like WTFPL, so a well-intentioned human may do the same).
- lelandfe 4y ago
  https://github.blog/2021-06-30-github-copilot-research-recitation/ https://github.blog/2021-06-30-github-copilot-research-recit... > That corresponds to one recitation event every 10 user weeks > This investigation demonstrates that GitHub Copilot can quote a body of code verbatim, yet it rarely does so, and when it does, it mostly quotes code that everybody quotes, typically at the beginning of a file, as if to break the ice A year old post now, YMMV.

AdmiralAsshat 4y ago

The fact that GitHub is now charging for this feature smells like a lawsuit waiting to happen. They're now literally profiting from potentially stolen GPL code.