8 ms·
Tell HN: GitHub Copilot can now block suggestions matching public code
As of a few minutes ago, it prompted me to update my settings:
"GitHub Copilot can allow or block suggestions matching public code. See GitHub Copilot FAQ to learn more."
The FAQ appears to be missing.
- streetcat1 4y agoSo what other code it was trained on: private code?
- smoldesu 4y agoWell, AI doesn't just repeat the things you feed it (particularly text transformers like the one here). Most of the time, the AI will have a "context", or a field of relevant text that is tokenized and preserved in-memory when generating more text. I'd presume that Copilot uses your current file as context, so it can infer simple things like variable names and libraries that you're using. From there, the model can do a pretty good job walking it's way down the decision tree that leads you to a working program. So, in a lot of ways, the majority of it's responses are actually original, just "inspired" by surrounding code. Now, as we found, telling the bot to solve for `Q_rsqrt` is something of a creative dead-end: the AI has only come across that a few times, and most likely they were implemented the same. So, with all that being said, I think this is a fine solution to the problem (as long as it works well).
- toxik 4y agoIn a sense, it's like asking a classical pianist to "complete this tune", and then start playing Für Elise. They'll almost certainly play the rest of the original tune - as they should!
- Waterluvian 4y agoI love that. I also love that the opposite can be true: they’ll riff on a classical piece and create something new that still fits the key and time and feel of the initial piece.
- aaaaaaaaaaab 4y agoTime to generate thousands of public repos filled with copilot-generated code!
- chirau 4y agoThis was announced when they announced GA a few days ago, no?
- WithinReason 4y agoYes, this option was there since it came out of beta
- theobeers 4y agoIt's in the FAQ. Scroll to the bottom of this page: https://github.com/features/copilot/ https://github.com/features/copilot/ "What can I do to reduce GitHub Copilot's suggestion of code that matches public code? "We built a filter to help detect and suppress the rare instances where a GitHub Copilot suggestion contains code that matches public code on GitHub. You have the choice to turn that filter on or off during setup. With the filter on, GitHub Copilot checks code suggestions with its surrounding code for matches or near matches (ignoring whitespace) against public code on GitHub of about 150 characters. If there is a match, the suggestion will not be shown to you. We plan on continuing to evolve this approach and welcome feedback and comment."
- deleted 4y ago[deleted]
- frizlab 4y agoAnd is there a way to tell GitHub _not_ to analyse repos that I own?
- pmohun 4y agoIt will be interesting to see the next version of robots.txt that begins to appear in public repos to prevent this type of data scraping.
- comboy 4y agoIf somebody starts going around neighborhood shooting paint balls, requiring everybody to wear "please don't shoot paint balls at me" t-shirts seems like a suboptimal solution. If somebody left a code with some license 10 years ago, then that's how he published it and it should be respected. If there are some additional files, changes or checkboxes required on the author side (who may be dead btw), then it is a theater not a solution. I could totally go with let's abandon licenses (but would prefer starting with patents), what's online is ours. But if we want to keep them then the license itself is enough of a statement. It's not like we have a hard time writing software which interprets them... it's more like "but we would have to do a big refactoring".
- Retr0id 4y agoYes, there is an account setting checkbox labeled "Allow GitHub to use my code snippets for product improvements" - https://github.com/settings/copilot https://github.com/settings/copilot I'm a bit confused how this will work in practice, because I don't see how they can retrain their entire model every time someone toggles that setting.
- cypress66 4y agoIf you ask it for a function that reverses a string in JS, I'm sure the solution will match public code. Doesn't this filter very heavily limit its usefulness?
- remram 4y agoThat's a good point. This filter is probably both insufficient and too limiting.
- donkarma 4y agoit's still GPL infringing
- DannyBee 4y agoIt's never that simple :)
- vault 4y agoI've always used MIT or Apache for my public repos, but I don't feel comfortable if they build a product based on subscriptions using my code. What license should I use, to avoid copilot being trained on my code? Ignoring the fact they are not currently respecting the licenses...
- tylersmith 4y agoThere is no copyright license that allows the public to read code but not learn from it.
- nequo 4y agoIsn’t the point of MIT that the code can be reused in whatever way and for whatever purpose they please? (As long as the copyright notice is retained of course, which in this case isn’t.) I’ve begun leaning heavily toward GPL for this reason.
- CameronNemo 4y agoAGPL is the most aggressive copyleft license available, but even that can't stop a well funded tech giant from taking whatever they want. You need to use AGPL, and retain a well-researched legal team.
- glouwbug 4y agoSo they got complaints that copilot generated public code and then as aftermath they hashed all public snippets to bandaid their GPL offense?
- nojito 4y agoThis is likely due to amazons version of copilot offering this feature.
- Gentil 4y agoThere was many personally identifying information leaks when it initially launched. Which suggests that they snooped through OSS code and violated any licenses. Here are 2 answers to the main two things copilot sympathizers ask. 1. How do you know Co-pilot violated OSS licenses? > The aforementioned PII and secrets emitted. And IIRC a support personnel said they even copied GPL licensed code. So there is nothing stopping them from copying MIT licensed ones. Which is still a violation without attribution. So no reason for the benefit of the doubt. 2. Humans copy code all the time. So why can't an AI? Or something along the lines of it... The answer is 2 parted. 1. A human can only copy so much. Most of them are not in bad faith. And those who are in bad faith are not a humongous portion. An AI just scrapes the code in mass scale which is impossible for a human even with automation. It's also easier for it to learn from this training data compared to someone scrapping the data and maintaining a DB. This is such a common sense thing. None of the laws, policies or systems are made for AI in mind. So it is just a careless thing to say. 2. If are not adhering to OSS licenses then YOU ARE in violation. So if you are not called out or punished, DOESN'T MEAN you are right. Just means you are getting away with it. This is just a PR exercise for MS. They already have the data and the product. A nobody has the balls to question them. The normalization of these bad behaviors with their good PR being "the guardians of the OSS" is literally taunting the entire OSS community. This is where I hoped FSF, EFF, SFConservancy or any other group would step up. Nothing so far. Just yelling into the void hoping MS will suddenly do the right thing.
- nojito 4y agoCoPilot using code to train a model doesn’t violate any software licenses.
- ClumsyPilot 4y agothe model includes chunks of that code, they copied it into their model
- SXX 4y agoLet's train AI on leaked source code of Microsoft, Nvidia and other commercial companies and find out how soon such project going to be sued and shutdown via DMCA. Might also include source-available code like Unreal Engine, etc.
- amelius 4y agoCopilot: it is easier to ask for forgiveness than to ask for permission.
- naikrovek 4y agothe thing that gets me most about all of this is that so many developers here believe, truly, that they are the only people on earth who can write certain things in code. and that because of that, their code is extremely valuable, and should never be found in the hands of another person. Those same people put their code in public repos on GitHub, with permissive license(s), and don't opt-out of Github's use of their code for things like copilot. Those same people are now mad at Microsoft because of copilot, and not mad at Amazon for their competing service which does the same things.
- amarshall 4y ago> don't opt-out of Github's use of their code for things like copilot. How does one opt-out, aside from not making the source available at all?
- cmeacham98 4y agoGitHub allows you to opt your repos out if (and only if) you pay for Copilot.
- trashcan 4y agoNot true. I just opted out and I do not pay for it.
- soraki_soladead 4y agoIf the model is learning the nature of code and synthesizing new code then it may not violate some licenses. When people do this its usually fine. However, if the model is simply compressing code it sees into the model weights, just memorizing snippets, then outputting those snippets, that’s much more likely to violate licenses. Like when people copy+paste from some licensed code without attribution (even if realistically nothing is enforced most of the time). The truth is likely somewhere in the middle. Lets say 20% of code is stored directly in the weights but the rest is synthesized. That’s a problem for the whole product. We already know models do a little bit of both depending on the data coverage. Common structures like if/then, loops, etc. are probably “understood” because the model saw them in lots of contexts. However, specific functions, especially those that are seen only a few times in much the same contexts are more likely to be copied. There’s a spectrum here from shortcut learning to understanding. OSS doesn’t really have the access or resources to evaluate this. Github isn’t really incentivized to share any analysis they’ve done here. What’s interesting to me is that their solution to this problem is to put the issue on their users/customers. By default, crawl everything public, ignorant of licenses, and if the customer has license concerns its on them to disable public code matching.
- kromem 4y agoThe problem only occurs when you are using it to fill mostly empty files, particularly in empty projects. In an actual codebase the frequency you are getting 'snippets' is less than 1%, not 20%. This was discussed in the FAQ for the beta. The straw man around this topic is wild. Anyone who has actually used it should know that in an existing project, it very heavily matches the output flavoring to the existing codebase. When there isn't anything to match, it only has the training data to pull from. Demoing the edge case where it is set up to fail and then pointing and saying "look at how it failed" is a bit silly. And continuing to harp on it in the comments on a piece about how now there's literally a setting to prevent even those edge cases is perhaps even moreso.
- bryanrasmussen 4y agoHas anyone produced any variation of the most popular licenses in which the code is not available for training a machine learning model? That would seem to be the most reasonable starting point for addressing concerns here.
- cmeacham98 4y agoGitHub claims their use of code for Copilot is fair use (i.e. license wouldn't matter). Nobody has challenged this in court yet to my knowledge.
- littlestymaar 4y agoI'm pretty sure they are right, but that doesn't mean that using code generated by copilot is though. Like fair use allows Google to index images and expose them in Google Image, but using an image found there elsewhere is almost always copyright infringement (unless you're lucky and the image was in the public domain). Not a lawyer though.
- bryanrasmussen 4y agoindexing has robots.txt to define fine grained rules for what you want to be indexable, github repos only have public or private. So I think there needs to be some way of determining it. If they think it's fair use that also means they wouldn't think it was wrong to train it on public repos in gitlab, etc. Do they already train on repos outside Github?
- littlestymaar 4y agoI don't think you can opt out of fair use in jurisdictions where the concept exist (that would ruin the concept pretty quickly). And robot.txt is merely netiquette, it isn't enforceable in court AFAIK. That being said, by using only github-hosted code, they sidestepped the question of whether this is actually fair use, because it's part of there ToS. And there is no way to opt out someone's ToS either, unless you delete your account altogether.
- natly 4y agoIf you copy a piece of GPL code but change the whitespace or some arbitrary number that produces the same output, does that still still break the license (if you don't make the source public)?
- remram 4y agoYes > if you don't make the source public I'm not sure what you mean by that, the GPL only has constraints for redistribution. If you don't distribute anything (publicly or not), there is no way to break the GPL.
- DannyBee 4y agoAssuming the code you modify is protectible in the first place, then yes, this sort of trivial modification or derivative would be covered by GPL and have to abide by its rules. But just because you slap a license on something does mean you actually can enforce it.
- notRobot 4y agoYes. If you copy and modified then code, it doesn't change the fact that you copied it.
- deleted 4y ago[deleted]
- ipaddr 4y agoNo because you only need to make the source available on request from the original developer(s).
- fartcannon 4y agoIntellectual Property Laundering
- ThrowawayR2 4y ago"'Information wants to be free!' ... but not ours though." "'There's no such thing as intellectual property' ... except mine. Don't you dare touch my IP. I"ll sue!" "'Downloading a copy doesn't deprive the copyright owner of anything' ... hey, stop stealing my code. Thief! Pirate!" The irony of the anti-IP and pro-FOSS crowd failing to live up to their own professed philosophy is profound.
- fartcannon 4y agoGPL
- tylersmith 4y agoA large portion of the "FOSS" cherishes IP law and using it to enforce source availability of derivative works.
- BiteCode_dev 4y agoI immediatly checked the box. Peace of mind for what I put in my code, and honestly codepilot would still be useful even with having only access to the local code base.
- muzani 4y agoI selected "Allow" on suggestions matching public code. I feel like I'm on the FBI watchlist now.