4 ms·

If GitHub could guarantee that the code Copilot had ingested was only made with OSS licenses, then I don't see what the problem is. But as far as I understand,

If GitHub could guarantee that the code Copilot had ingested was only made with OSS licenses, then I don't see what the problem is. But as far as I understand, GitHub trained Copilot on any public repository on GitHub, meaning even if it doesn't have a license specified (so the user publishing it still has the copyright to it), then I don't see how it can be OK.

hooby 4y ago
many OSS licenses require attribution
saghul 4y ago
Even if it was trained with OSS licenses, some of them require proper attribution, which copilot doesn’t do. Now, where the threshold is for substantial derivative work in order to require attribution is an interesting question.
thelastbender12 4y ago
It is hard to see how verifying licenses is a solvable problem, when licensing for code dependencies can be transitive. For ex - if I copy code from a GPL codebase like Linux and create a Github repository with an MIT license.
- danuker 4y ago
  You should be able to choose flavors of the model trained only on public-domain code which does not require attribution, for example. But that would mean Microsoft acknowledging license violations.
  - thelastbender12 4y ago
    Sorry, to be clear, I meant even if a Github user asserts their code is public-domain/no-attribution/unlicensed, they could have lifted it off a codebase that doesn't allow it. It would be tricky for Github to establish the code was indeed original and hence their agreement with the user allows them to train their models on it.
    - danuker 4y ago
      > they could have lifted it off a codebase that doesn't allow it Ah. But then someone else is guilty of redistributing code without permission. But you're suggesting, GitHub should implement something like ContentID but for code. Which should be cheaper (since code is cheap to analyze, while videos are much more bandwidth-intense). And this would kill two birds with one stone.
galoisgirl 4y ago
Here's an example: https://twitter.com/ChrisGr93091552/status/1539731632931803137 https://twitter.com/ChrisGr93091552/status/15397316329318031... > I checked if it had code I had written at my previous employer that has a license allowing its use only for free games and requiring attaching the license. yeah it does
- nl 4y ago
  That's a pretty bad example. He prompted it using the exact function header taken from the code he is complaining about. It'd be much more interesting if he setup a function that was doing a similar thing but with different parameter types and names, and a different order of parameters (ie, like a real problem).
  - triknomeister 4y ago
    Does that matter? A code provided should be provided with the license needed to use the code, otherwise the user is opening themselves up to litigation. Hence why I agree with another comment somewhere that Microsoft is banking on software developers not litigating about use of their open source code in closed source projects.
redox99 4y ago
Maybe when you accepted GitHub ToS you gave them permission for your code to be used for ML training.
- eloisius 4y ago
  I can’t say I remember the terms saying anything to the effect of granting Microsoft a perpetual unlimited license in addition to whatever license I package with the code when I signed up. Not doubting it, but I would have expected that to raise some suspicion long before Copilot was around.
  - redox99 4y ago
    It could be something as innocuous as "you allow your code to be analyzed, processed or otherwise handled by Github software" I suppose, which wouldn't raise suspicion.

hooby 4y ago

many OSS licenses require attribution

saghul 4y ago

Even if it was trained with OSS licenses, some of them require proper attribution, which copilot doesn’t do. Now, where the threshold is for substantial derivative work in order to require attribution is an interesting question.

thelastbender12 4y ago

It is hard to see how verifying licenses is a solvable problem, when licensing for code dependencies can be transitive. For ex - if I copy code from a GPL codebase like Linux and create a Github repository with an MIT license.

danuker 4y ago
You should be able to choose flavors of the model trained only on public-domain code which does not require attribution, for example. But that would mean Microsoft acknowledging license violations.
- thelastbender12 4y ago
  Sorry, to be clear, I meant even if a Github user asserts their code is public-domain/no-attribution/unlicensed, they could have lifted it off a codebase that doesn't allow it. It would be tricky for Github to establish the code was indeed original and hence their agreement with the user allows them to train their models on it.
  - danuker 4y ago
    > they could have lifted it off a codebase that doesn't allow it Ah. But then someone else is guilty of redistributing code without permission. But you're suggesting, GitHub should implement something like ContentID but for code. Which should be cheaper (since code is cheap to analyze, while videos are much more bandwidth-intense). And this would kill two birds with one stone.

galoisgirl 4y ago

Here's an example: https://twitter.com/ChrisGr93091552/status/1539731632931803137 https://twitter.com/ChrisGr93091552/status/15397316329318031... > I checked if it had code I had written at my previous employer that has a license allowing its use only for free games and requiring attaching the license. yeah it does

nl 4y ago
That's a pretty bad example. He prompted it using the exact function header taken from the code he is complaining about. It'd be much more interesting if he setup a function that was doing a similar thing but with different parameter types and names, and a different order of parameters (ie, like a real problem).
- triknomeister 4y ago
  Does that matter? A code provided should be provided with the license needed to use the code, otherwise the user is opening themselves up to litigation. Hence why I agree with another comment somewhere that Microsoft is banking on software developers not litigating about use of their open source code in closed source projects.

redox99 4y ago

Maybe when you accepted GitHub ToS you gave them permission for your code to be used for ML training.

eloisius 4y ago
I can’t say I remember the terms saying anything to the effect of granting Microsoft a perpetual unlimited license in addition to whatever license I package with the code when I signed up. Not doubting it, but I would have expected that to raise some suspicion long before Copilot was around.
- redox99 4y ago
  It could be something as innocuous as "you allow your code to be analyzed, processed or otherwise handled by Github software" I suppose, which wouldn't raise suspicion.