36 ms·

GitHub Copilot, with “public code” blocked, emits my copyrighted code

• deworms 4y ago
  It prints this code because you have it open in another editor tab. Wish people who don't know at all how it works stopped acting all outraged when they're laughably wrong.
  • lupire 4y ago
    Can you link to more info about this? If this is accurate, many people aren't aware.
    • defasdefbe 4y ago
      Code Snippets Data Depending on your preferred telemetry settings, GitHub Copilot may also collect and retain the following, collectively referred to as “code snippets”: source code that you are editing, related files and other files open in the same IDE or editor, URLs of repositories and files paths. https://github.com/features/copilot/#faq https://github.com/features/copilot/#faq
    • defasdefbe 4y ago
      > OpenAI Codex was trained on publicly available source code and natural language, so it works for both programming and human languages. The GitHub Copilot extension sends your comments and code to the GitHub Copilot service, and it relies on context, as described in Privacy below - i.e., file content both in the file you are editing, as well as neighboring or related files within a project. It may also collect the URLs of repositories or file paths to identify relevant context. The comments and code along with context are then used by OpenAI Codex to synthesize and suggest individual lines and whole functions. "How Does Copilot Work"
  • yjftsjthsd-h 4y ago
    > It prints this code because you have it open in another editor tab. People upthread have reproduced and demonstrated that that's not the issue here. EDIT: Actually, OP says "The variant it produces is not on my machine." - https://twitter.com/DocSparse/status/1581560976398114822 https://twitter.com/DocSparse/status/1581560976398114822 > Wish people who don't know at all how it works stopped acting all outraged when they're laughably wrong. Physician, heal thyself.
• deleted 4y ago
  [deleted]
• vlasev 4y ago
  Now if someone would write an app that checks if your licensed code can be found with Copilot, we would go full circle. It could actually be useful to see if your code is used without proper licensing?
• tpoacher 4y ago
  I have now moved all my public github projects onto sourcehut, and replaced them on github with public notices explaining why (i.e. this whole copilot saga). Yes I know that presumably that doesn't make them safer from a copilot visibility point of view ... but I had to do something.
• colesantiago 4y ago
  Github Copilot is not AI at all, it is just a dumb code regurgitator that just sells you code you wrote on GitHub and takes all the credit for it shamelessly.
  • davidgerard 4y ago
    it's totally AI, in the "legal responsibility laundering" sense. This is the main present day use case for saying "AI".
    • chlorion 4y ago
      Yeah you can just throw some "AI" into the code and suddenly people are okay with it stealing licensed code. I really thought technically inclined people would be resistant to this type of manipulation from advertisers but it seems like most people are totally going for it!
      • numpad0 4y ago
        Not just plagiarisms - today you could be subjected to consequential mistreatment "because AI told us to, not us doing". The concept of "legal responsibility laundering" GP used could cover either infringements.
  • Jevon23 4y ago
    Hopefully you understand how artists feel about DALL-E and Midjourney now.
    • pessimizer 4y ago
      I like that if you prompt these with specific artists names, they try their best to rip those particular artists off.
  • lolinder 4y ago
    I use copilot in my work every day, but only in places where I know the code cannot be regurgitated because what I'm doing has never been done before. I can write an HTML form, then prompt copilot to generate a serializable class that can be used to deserialize that form on the server. I can write a test for one of our internal apis, and for every subsequent test I can just write the name of what I expect it to check and it generates a test that correctly uses our internal APIs and verifies the expected behavior. You can have problems with the ethics of how GitHub and OpenAI produced what they did, but to describe it the way that you did requires never having really attempted to use it seriously.
• an1sotropy 4y ago
  This is a huge and looming legal problem. I wonder if what should be a big uproar about it is muted by the widespread acceptance/approval of github and related products, in which case its a nice example of how monopolies damage communities.
  • jeroenhd 4y ago
    I think it won't become a legal problem until Copilot steals code from a leaked repository (i.e. the Windows XP source code) and that code gets reused in public. Only then will we see an answer to the question "is making an AI write your stolen code a viable excuse". I very much approve of the idea of Copilot as long as the copied code is annotated with the right license. I understand this is a difficult challenge but just because this is difficult doesn't mean such a requirement should become optional; rather, it should encourage companies to fix their questionable IP problems before releasing these products into the wild, especially if they do so in exchange for payment.
    • an1sotropy 4y ago
      > I very much approve of the idea of Copilot as long as the copied code is annotated with the right license. I agree, but I somehow doubt that will ever happen. Partly because MS is motivated to muddy the waters and shift norms towards allowing more of this kind of license-defying copying (because they make money from a product that does just that), and partly because the market for the most part doesn't think clearly about these issues. Many commenters here seem really fuzzy on the fact that nearly all code is, with or without an explicit statement as such, copyrighted (thanks, Berne convention), that that copyright (with or without documentation) is owned by someone, and that it is licensing which grants use of copyrighted work under specific circumstances. So as you say, the real problem is losing information about the license. I'm grateful that the author of some LGPL'd code has triggered this discussion, since its a more consequential license w.r.t. code reuse.
• naillo 4y ago
  It's interesting if the consequence of this will be people open sourcing things way less. Would give another layer of irony to openais name.
• jonnycomputer 4y ago
  Microsoft should just train it on all their proprietary code instead. See how sanguine they are about it then.
  • naikrovek 4y ago
    who said they haven't. for something to show up verbatim in the output of a textual AI model it needs to be an input many times. I wonder if the problem is not copilot, but many people using this person's code without license or credit, and copilot being trained on those pieces of code as well. copilot may just be exposing a problem rather than creating one. I don't know much about AI, and I don't use copilot.
    • belorn 4y ago
      Microsoft have a public statement that they don't use proprietary code, only public code with public licenses. They have a lot of companies as customers who uses github, and they also use a lot third-party code in their own products.
      • stefan_ 4y ago
        Even BSD et. al. have attribution requirements - that must be a vanishingly small amount of code to be used. Me thinks the people who run GitHub (who have apparently decided to abandon the core business for the latest fun project) aren't being entirely upfront.
      • pabs3 4y ago
        I thought they said all public repos without regard to the license they are under, which could be a proprietary EULA.
    • make3 4y ago
      there's exactly no way they have
      • naikrovek 4y ago
• acoustics 4y ago
  I’ve noticed that people tend to disapprove of AI trained on their profession’s data, but are usually indifferent or positive about other applications of AI. For example, I know artists who are vehemently against DALL-E, Stable Diffusion, etc. and regard it as stealing, but they view Copilot and GPT-3 as merely useful tools. I also know software devs who are extremely excited about AI art and GPT-3 but are outraged by Copilot. For myself, I am skeptical of intellectual property in the first place. I say go for it.
  • ChildOfChaos 4y ago
    I think sadly it's just people being protective, the technology is interesting so if it doesn't hit their line of work, it's fantastic, if it does, then it's terrible. There is no arguing against it though, you can't stop it, all this stuff is coming eventually to all of these areas, might as well try and find ways to use the oppurutinies while you can while some of this is still new.
    • naillo 4y ago
      I mean we definitely can stop it. Laws are a pretty strong deterrent.
      • ghaff 4y ago
        "We" maybe can't stop it. But if there were the political will to kneecap many uses of machine learning, it's not obvious there's any reason it couldn't be done even if not 100% effective. Whether that would be a good thing is a different question.
      • faeriechangling 4y ago
        You can slow this, you can't stop it whatsoever. It's about as ultimately futile as an effort as trying to stop piracy. People are ALREADY running salesforce codegen and stable diffusion at home, you can't put the genie back in the bottle, what we'll have 20 years from now is going to make critics of these tools have nightmares. If you try to outlaw it, the day before the laws come into effect, I'm going to download the very best models out there and run it on my home computer. I'll start organising with other scofflaws and building our own AI projects in the fashion of leelachesszero with donated compute time. You can shut down the commercial versions of these tools. You can scare large corporations from banning the use of these tools by corporations. You can pull an uno reverse card and use modified versions of the tools to CHECK for copyright infringement and sue people under existing laws AND you'll probably even be able to statistically prove somebody is an AI user. But STOPPING the use of these tools? Go ahead and try, won't happen.
• faeriechangling 4y ago
  Not your repo, not your code. I celebrate Microsofts shameless plundering of Github to create new products that increase productivity. The incredible thing is that people trusted Microsoft to use their code on their terms to begin with. This is a company who has been finding ways to make open source code into a proprietary product since the 90s. Nobody can stop people from replicating what Microsoft did in the long run anyways. Eventually any consumer with enough access to source code will be able to make their own copilot. Even if copilot is criminalised Microsoft can just sell access to the entire GitHub dataset and let other people commit the "crime". Then you're right back where we started with having to sue the end users of copilot for infringement instead of Microsoft. Use private repos or face the inevitability that copilot-like products will scrape your code.
• ralph84 4y ago
  Ok. So instead of whining about it on Twitter sue GitHub. No matter what you think of Copilot, establishing some case law on AI-generated code will be beneficial to everyone.
  • mjr00 4y ago
    Whining about it on Twitter = free and easy Suing Github = signing up for a ~decade long incredibly expensive and time-consuming legal battle against one of the richest companies in the world There may be a slight difference in effort between these two options.
    • anonydsfsfs 4y ago
      Not to mention Microsoft could countersue using their enormous patent war chest, which they have a history of doing[0] [0] https://techcrunch.com/2012/03/22/microsoft-and-tivo-drop-their-patent-lawsuits-against-each-other/ https://techcrunch.com/2012/03/22/microsoft-and-tivo-drop-th...
  • ghaff 4y ago
    It goes beyond code. Also photos, art, text, etc. Be careful what you wish for. Whether you like it or not, with a stroke of a pen Congress or the Supreme Court in the US could probably wipe out the legal use of a huge amount of the training data used for ML.
    • adastra22 4y ago
      Good.
    • Jevon23 4y ago
      Good! Large corporations shouldn’t be able to profit off of other people’s data without consent or compensation.
      • drstewart 4y ago
        Great! I assume you believe all search engines should be illegal then?
• res0nat0r 4y ago
  The repo he linked to on twitter is a public repo though. Am I missing something? https://twitter.com/DocSparse/status/1581462433335762944 https://twitter.com/DocSparse/status/1581462433335762944
  • kurtoid 4y ago
    I think they're more concerned about it repeating code w/o ownership/copyright labels
  • tpxl 4y ago
    Public != copyright free.
  • taspeotis 4y ago
    > The repo he linked to on twitter is a public repo though. Am I missing something? I dunno the title says it used public code when it was meant to block public code.
• mjr00 4y ago
  Same issue with Stable Diffusion/NovelAI and certain people's artwork (eg Greg Rutkowski) being obviously used as part of the training set. More noticeable in Copilot since the output needs to be a lot more precise. Lawmakers need to jump on this stuff ASAP. Some say that it's no different from a person looking at existing code or art and recreating it from memory or using it as inspiration. But the law changes when technology gets involved already, anyway. There's no law against you and I having a conversation, but I may not be able to record it depending on the jurisdiction. Similarly, there's no law against you looking at artwork that I post online, but it's not out of question that a law could exist preventing you from using it as part of an ML training dataset.
  • Siira 4y ago
    Yes, lawmakers should come ASAP and make everybody pay rents that will ultimately not even be pocketed by the median creator/developer. What a fantastic vision! What a feast for the capitalist beast …
  • SrslyJosh 4y ago
    > Some say that it's no different from a person looking at existing code or art and recreating it from memory or using it as inspiration. Hah, no, the model encodes the code that it was trained on. This is not "recreating from memory", this is "making a copy of the code in a different format." (Modulo some variable renaming, which it's probably programmed to do to in order to obscure the source of the code.)
    • deleted 4y ago
      [deleted]
    • LtWorf 4y ago
      If I hear a song on the radio and then sing it, I still won't own the copyright.
  • avereveard 4y ago
    Not really, unless you can produce a verbatim copy of existing artwork out of stability's stable diffusion.
• williamcotton 4y ago
  Is the code in question even covered by copyright in the first place? It seems utilitarian in nature. Oh, the comments! Those are covered by copyright for sure.
  • williamcotton 4y ago
    You know, I make it a habit of not trying to get upset by downvotes but this is really absurd. What am I saying that is incorrect? Am I being rude? What exactly do you disagree with?
    • williamcotton 4y ago
      Like, should I just stop interacting with people on this website? Is that the intent? To make me just go away?
  • SrslyJosh 4y ago
    > It seems utilitarian in nature That has no bearing on copyright.
    • williamcotton 4y ago
      It absolutely does. Here’s like the first link after a DuckDuckGo search for “copyright utilitarian”: However, copyright law does not extend to useful items. Therefore, complications may arise when sculptural works are also “useful” items. In these instances, copyright law will protect purely artistic elements of a useful article as long as the useful item can be identified and exists independently of the utilitarian aspects of the article (this concept is sometimes called the “separability test”). 17 U.S.C. §. A “useful article” is an article that has a purpose beyond pure aesthetic value. https://www.rtlawoffices.com/articles/can-i-copyright-my-design-distinguishing-utilitarian-features-from-artistic-elements/ https://www.rtlawoffices.com/articles/can-i-copyright-my-des... Is it safe to assume the rest of the downvotes were from people who were also incorrect?
      • deleted 4y ago
• deleted 4y ago
  [deleted]
• jijji 4y ago
  if you're posting your code publicly on the web, its hard to get upset that people are seeing/using it
  • betaby 4y ago
    It's under the very specific license though. With your logic it's OK to train AI on a leaked Windows code then. It is/was publicly on the web.
    • lerpgame 4y ago
      code licenses will be irrelevant in a few years if you are able to refactor anything you want using ai.
      • betaby 4y ago
        Unless lawyers from the music industry step in.
    • galleywest200 4y ago
      While I agree with the first portion of your rebuttal, the second portion makes no sense as leaked code is not "you" putting it on the internet. It would be a nefarious actor doing so.
    • themoonisachees 4y ago
      Yes? Its production code that is supposed to work (keyword supposed). I'd like the code-suggestor to also be trained on AAA games source leaks.
  • qu4z-2 4y ago
    Can I introduce you to a concept called copyright? Is it fine if an author publishes a short story publicly on the web for someone else to submit it to a contest as their own work?
    • teddyh 4y ago
• thorum 4y ago
  What might be going on here is that Copilot pulls code it thinks may be relevant from other files in your VS Code project. You have the original code open in another tab, so Copilot uses it as a reference example. For evidence, see the generated comment under the Copilot completion: "Compare this snippet from Untitled-1.cpp" - that's the AI accidentally repeating the prompt it was given by Copilot.
  • naikrovek 4y ago
  • ianbutler 4y ago
    I just tested it myself, and I most certainly do not have his source open, and it reproduced his code verbatim with just the function header in a random test c file I created in the middle of a rust project I'm working on.
    • thorum 4y ago
      Ah ok.
    • defasdefbe 4y ago
      Do you have Public Code Suggestions disabled? I tried in an empty editor and it wouldn't do it.
  • stefan_ 4y ago
    Seems other people tried it? https://twitter.com/larrygritz/status/1581713252144517120 https://twitter.com/larrygritz/status/1581713252144517120
• deleted 4y ago
  [deleted]
• mdaniel 4y ago
  I didn't feel like weighing into that Twitter thread, but in the screenshot one will notice that the code generated by Copilot has secretly(?) swapped the order of the interior parameters to "cs_done". Maybe that's fine, but maybe it's not, how in the world would a Copilot consumer know to watch out for that? Double extra good if a separate prompt for "cs_done" comingles multiple implementations where some care and some don't. Partying ensues! Not to detract from the well founded licensing discussion, but who is it that finds this madlibs approach useful in coding?
  • crummy 4y ago
    In my opinion Copilot helps with the easy, boring stuff by typing what I likely would have typed anyway. The harder the code to write, the less likely I'd be to lean on Copilot.
    • JCharante 4y ago
      The only algorithm I'll accept from copilot is a rot13 function, it got the rot26 one wrong.
    • alpaca128 4y ago
      And the easy, boring, legally unproblematic stuff can already be handled by good IDE completion features. As a bonus those are actually tested and deterministic.
      • crummy 4y ago
        I use an IDE with plenty of smart completion. Copilot offers considerably more (otherwise I wouldn't use or pay for it).
• _the_inflator 4y ago
  Well, this can impose a serious risk to companies and their cloud strategy based on GitHub. Can these enterprises really make sure, that their code won’t be used to train Copilot? I am skeptical.
• Traubenfuchs 4y ago
  What keeps him from suing if he is so sure? Those pretty little licenses are a waste of storage if no one enforces them.
  • SamoyedFurFluff 4y ago
    Money. Suing is often survival of the richest.
• ilrwbwrkhv 4y ago
  Of course it does. What are you going to do? Sue them?
• jen20 4y ago
  Not entirely sure how this could happen! “naikrovek” assured me not three days ago on this very site that I was “detached from reality” [1] for thinking that this would happen again. To be fair I thought it might be at least a week or two. [1]: https://news.ycombinator.com/item?id=33194643 https://news.ycombinator.com/item?id=33194643
• ianbutler 4y ago
  I just tested it myself on a random c file I created in the middle of a rust project I'm working on, it reproduced his full code verbatim from just the function header so clearly it does regurgitate proprietary code unlike some people have said, I do not have his source so co-pilot isn't just using existing context. I've been finding co-pilot really useful but I'll be pausing it for now, and I'm glad I have only been using it on personal projects and not anything for work. This crosses the line in my head from legal ambiguity to legal "yeah that's gonna have to stop".
  • naikrovek 4y ago
    what proprietary code? the guy on Twitter is seeing his own GPL code bring reproduced. nothing proprietary there. do you have the "don't reproduce code verbatim" preference set?
    • webstrand 4y ago
      He owns the copyright to the code, and the code is not in the public domain, therefore it is proprietary code.
      • yjftsjthsd-h 4y ago
        That's not how anybody uses the word proprietary when dealing with software licensing. It's a term of art that stands in contrast to open source licenses.
        • ianbutler 4y ago
          For the record, I don't typically think in terms of the open source community. I grant that if most people are using it one way here I was likely wrong for the way it is typically used by the normal open source community, I followed up with a reply saying it would likely be more correct for me to have said "improperly licensed" to be included in the training set. Still it being private means it probably shouldn't be in the training set anyway regardless of license, because in the future, truly proprietary code could be included, or code without any license which reserves all right to the creator.
• bmitc 4y ago
  What does > with "public code" blocked mean? Are you able set a setting in GitHub to tell GitHub that you don't want your code used for Copilot training data? Is this an abuse of the license you sign with GitHub, or did they update it at some point to allow your code to be automatically used in Copilot? I'm not crazy about the idea of paying GitHub for them to make money off of my code/data.
  • galleywest200 4y ago
    The option to omit "public code" means it should, in theory, omit code that is licensed under such banners as the GPL. It does not mean "omit private repositories".
    • bmitc 4y ago
      I should have pointed out that those were two separate questions. Public code is a weird name to use for that use case.
  • defasdefbe 4y ago
    > We built a filter to help detect and suppress the rare instances where a GitHub Copilot suggestion contains code that matches public code on GitHub. You have the choice to turn that filter on or off during setup. With the filter on, GitHub Copilot checks code suggestions with its surrounding code for matches or near matches (ignoring whitespace) against public code on GitHub of about 150 characters. If there is a match, the suggestion will not be shown to you. We plan on continuing to evolve this approach and welcome feedback and comment. From the FAQ https://github.com/features/copilot/ https://github.com/features/copilot/
    • bmitc 4y ago
      That is for people using Copilot. I’d like a setting that tells GitHub to not scan my code at all. And I am curious about that sneaking into the terms in between me signing up and paying and them taking code for free. I have also never heard of “public code” being used in that way.
• psychphysic 4y ago
  Hot take, AI will steal all our jobs. Get over it.
• lerpgame 4y ago
• deworms 4y ago
  • stonogo 4y ago
    Feel free to send patches.
    • deworms 4y ago
      Why would I waste time doing this?
      • kortilla 4y ago
        Because you were already willing to waste time panning his code on a public forum. Maybe do something constructive instead of destructive if your time is so precious.
        • google234123 4y ago
          > Maybe do something constructive instead of destructive if your time is so precious. How does the first part of this follow the second? Being constructive likely takes more time.
  • __turbobrew__ 4y ago
    Ok, post your code for us to scrutinize
• ahmedbaracat 4y ago
  “ AI-focused products/startups lack a business model aligning the incentives of both the company and the domain experts (Data Dignity)” https://blog.barac.at/a-business-experiment-in-data-dignity https://blog.barac.at/a-business-experiment-in-data-dignity Yes I am quoting myself
• CapsAdmin 4y ago
  I would imagine the root problem here is people taking copyrighted code, pasting it in their project and disregarding the license. To me this seems common, especially when it comes to toy, test and hobby projects. I don't see how copilot or similar tools can solve this problem without vetting each project.
  • deleted 4y ago
    [deleted]
  • yjftsjthsd-h 4y ago
    That's an entirely plausible explanation, but it doesn't mean that Microsoft has any less of a legal nightmare on their hands.
    • CapsAdmin 4y ago
      I'm not really sure what I think about this. How responsible should Microsoft be for someone's badly licensed code on their platform? If they somehow had the ability to ban projects using stolen snippets of code, I don't think I'd dare to host my hobby projects there. If you can't trust that the code in a project is compatible with the license of the project then the only option I see is that copilot cannot exist. I love free software and whatnot, but I have a feeling this situation would've been quite different if copilot was made by the free software community and accidentally trained on some non free code..
      • yjftsjthsd-h 4y ago
        > I love free software and whatnot, but I have a feeling this situation would've been quite different if copilot was made by the free software community and accidentally trained on some non free code.. Precisely. Would it be okay for me to publish some code as GPL because my buddy gave it to me and promised that it was totally legit and I could use it and it definitely wasn't copy-pasted from one of the Windows source leaks? > If you can't trust that the code in a project is compatible with the license of the project then the only option I see is that copilot cannot exist. It might be possible to feed it only manually-vetted inputs, but yes; as it currently is, Copilot appears to be little but a massive copyright-infringement engine.
• deepspace 4y ago
  This shows how copyright is all screwed up. Let's say the code in question is based on a published algorithm, maybe Yuster and Zwick, (I did not check). What exactly gives Davis a better claim to the copyright than the inventors of the algorithm? Yes, I know software is copyrightable while algorithms are not, but it is not at all clear to my why that should be the case. The effort of translating an algorithm into code is trivial compared to designing the algorithm in the first place, no?
  • heavyset_go 4y ago
    You can patent an algorithm if you want to protect it.
    • jeroenhd 4y ago
      (in some countries)
  • clnq 4y ago
    To be honest, it would probably benefit all of humanity if we stopped rewriting the same code to then fix the same bugs in it, and instead just used each other's algorithms to do meaningful work. I work for a large tech company whose lawyers definitely care that my code doesn't train an AI model somewhere much more than I do. On the contrary, I would really like to open source all of my work - it would make it more impactful and would demonstrate my skills. It makes me a bit sad that my life's work is going to be behind lock and key, visible to relatively few people. Not to mention that the hundreds of thousands of work hours, energy and effort that will be spent to replicate it all over my industry in all other lock-and-key companies makes the industry as a whole tremendously inefficient. I hope that AI models like Copilot will finally show to the very litigious tech companies that their intellectual property has been all over the public domain from the start. And we can get over a lot of the petty algorithm IP suits that probably hold back all tech in aggregate. We should all be working together, not racing against each other in the pursuit of shareholder value. Historically, mathematicians used to keep their solutions secret in the interest of employment in the middle ages. So there used to be mathematicians that could, for example, solve certain quadratic equations but it took centuries before all humanity could not benefit from this knowledge. I believe this is what is happening with algorithms now. And it is very counter-progress in my opinion.
• zaps 4y ago
  Drunk conspiracy theory: Nat knew Copilot would be a complete nightmare and bailed.
• deleted 4y ago
  [deleted]
• deleted 4y ago
  [deleted]
• Waterluvian 4y ago
  I think people may be drastically over-valuing their code. If it was emitting an entire meaningful product, that would be something else. But it’s emitting nuts and bolts. If the issue is more specifically copyright infringement, then leverage the legal apparatus in place for that. Their lawyers might listen better. This is not a strongly held opinion and if you disagree I would love to hear your constructive thoughts!
  • jacooper 4y ago
    I mean it starts like this, but if Copilot gets a pass, companies might just use AI as a way to launder code and avoid complying with Free licenses.
    • ShamelessC 4y ago
      Having worked for a couple of big companies with IT, you should know they are effectively all breaking the law already in this regard (except for maybe hardware companies) because it’s basically impossible to enforce and no one cares. The best way to make sure your code isn’t copied is not to publish it.
      • drran 4y ago
        Can you name one of these big, rich, and careless companies, please?
        • ShamelessC 4y ago
          Uh, vaguely? [Someone who isn't me] is aware of this happening at an american retailer. It basically happens like this: "Oh this code solves our problems and has a nice community around it for network effects!" **developers proceed to adopt codebase without checking the license** **months later** "Oh, huh this license has some interesting language in it..." Then the employee doesn't mention it; because the risk of having to re-do a bunch of work feels higher than the risk of getting in trouble for violating a license. Basically, unless it's Oracle; people just kinda shrug it off as a "wontfix". My whole thing is that any system depending on people to read and follow a license is quite flawed in terms of enforcement, and is largely designed specifically so that powerful encumbents can make claims, not individual developers. Laws have to be enforced or people will ignore them. If there's no practical way to enforce a law that doesn't involve violating freedoms - you're kinda fucked.
• D13Fd 4y ago
  If the code is public, my guess is that someone else stole it and added it to an open source repo without authorization. Microsoft may have then picked it up from there.
  • SrslyJosh 4y ago
    This just means that if you use Copilot for work, you're exposing yourself and/or your employer to unknown legal liability. =)
    • teaearlgraycold 4y ago
      Not sure how you’d get caught if your code is kept private.
      • chlorion 4y ago
        If you are releasing binaries that are publicly accessible it is possible to get caught. Statically linked binaries for example have parts of libraries embedded into them. There exists tools that can analyze the binary and try to detect signatures from a shared library in the binary. In the past there were (and probably still are) companies who provided services to help with finding people who have linked in your code so you could take whatever action you wanted against them. I can't recall a specific company name right now but a little bit of Googling would likely bring up some examples.
        • teaearlgraycold 4y ago
          Yeah but it's not going to be a part of a library. It'll be a few lines of code from a library.
    • Ukv 4y ago
      If the code is ostensibly available under permissive licenses, a well-intentioned human will also make the same mistake.
    • snotrockets 4y ago
• IncRnd 4y ago
  Other than the legality of this code being copied almost verbatim - who is the person who would use it? A person who would use it could also write it. If they cannot write it, why would they ever use this very specific code that magically appeared?
  • Barrin92 4y ago
    for the same reason people copy random snippets from stackoverflow without understanding how they work. There's a large amount of people who care more about getting a job done than really understanding how the tools work they're using. There is absolutely zero doubt in my mind that copilot et al will lead to the absolute proliferation of half baked code even more than all the other mundane ways to copy&paste do.
    • IncRnd 4y ago
      > There is absolutely zero doubt in my mind that copilot et al will lead to the absolute proliferation of half baked code even more than all the other mundane ways to copy&paste do. Agreed. That was my point.
• crazygringo 4y ago
  As some other commenters have noted, it seems like the copyrighted code is being copied and pasted into many other codebases (shadowgovt says they found 32,000 hits), which are then (illegally) representing an incorrect license. So obviously the source of the error is one or more third parties, not Microsoft, and it's obviously impossible for Microsoft to be responsible in advance for what other people claim to license. It does make you wonder, however, if Microsoft ought to be responsible for obeying a type of "DCMA takedown" request that should apply to ML models -- not on all 32,000 sources but rather on a specified text snippet -- to be implemented the next time the model is trained (or if it's practical for filters to be placed on the output of the existing model). I don't know what the law says, but it certainly seems like a takedown model would be a good compromise here.
  • snotrockets 4y ago
    They could have spent effort (read: money) to validate the content of the corpus the model is trained on.
  • matheusmoreira 4y ago
    > So obviously the source of the error is one or more third parties, not Microsoft, and it's obviously impossible for Microsoft to be responsible in advance for what other people claim to license. No. Look at the insane YouTube copystrike situation. Why shouldn't Microsoft be held to the same standards?
    • crazygringo 4y ago
      I can't tell what you're arguing. You seem to be suggesting that YouTube is doing insane things, and that therefore... Microsoft should also be doing insane things? Also a major problem with YouTube is not with DCMA itself, but it how it implements the system to allow for abusive takedowns without repercussions for the abusers.
  • BeefWellington 4y ago
    Uhh, I'm gonna have to disagree hard on this take: > So obviously the source of the error is one or more third parties, not Microsoft, and it's obviously impossible for Microsoft to be responsible in advance for what other people claim to license. Copilot is Github's product, and Microsoft owns Github. They are responsible for how that product functions. In this case, they should be held responsible for the training data they used for the ML model. Giving them the benefit of the doubt here, at minimum they chose which random third parties to believe were honest and correct. Without giving them the benefit of the doubt, they lied about what data sets they used to train it. To try and put it simpler, let's say a company comes along and tells the world "we're selling this cool book-writing robot, don't worry it won't ever spit out anyone else's books" and then the robot regurgitates an entire chapter from Stephen King's Pet Sematary, is that the fault of Stephen King or the person selling the robot?
• seanwilson 4y ago
  For DALL-E and Stable Diffusion, the model size is an order of magnitude smaller than the total size of all the training set images? So it's not possible for the model to regurgitate every image in the training set exactly? For Copilot, is there a similar argument? Or its model is large enough to contain the training set verbatim?
  • numpad0 4y ago
    How small is DALL-E/SD, compared to say, training dataset images shrank to 120x120, JPEG compressed at q=0.3, compressed as .tar.bz2?
    • ShamelessC 4y ago
      > The data can comfortably be downloaded with img2dataset (240TB in 384, 80TB in 224) https://laion.ai/blog/laion-5b/ https://laion.ai/blog/laion-5b/ Not exactly what you asked, but hopefully useful? The model weights are about 4 GiB I believe.
    • wccrawford 4y ago
      IIRC, 2.5 billion images were used to create a 4.5GB dataset. That is less than 2 bytes per original image.
  • drpixie 4y ago
    Mentioning DALL-E, you've hit on something. The world seems slightly mad about these things that produce "almost" pictures from text. We forgive DALL-E when it produces a twisted eye or an impossible perspective, because its result is "close enough" that we recognise something and grant the image intention. So now you've got me waiting for DALL-Ecode. Give DALL-Ecode a description, it produces code. "DALL-Ecode: Code that is sufficiently close to what you'd expect that you'll try to use it." "DALL-Ecode: Code that looks like it does what is needed." "DALL-Ecode: Good enough to compile, good enough to get through a code review (just not good enough to get through testing)."
• fencepost 4y ago
  Seems simple enough to start addressing. Don't sue Microsoft, subpoena them as part of your suit against unnamed companies violating the license. Request information on all public and private repositories that were generated in part using Copilot and which contain relevant code from which the licensing info has been stripped. After all, Microsoft may not itself be infringing so there may not be a cause of action against them by the copyright holders - but there's probably cause against the (unknowing) infringers and they may have cause.
  • Spivak 4y ago
    > Request information on all public and private repositories that were generated in part using Copilot and which contain relevant code from which the licensing info has been stripped. No court is ever going give you that subpoena nor would it even be possible to comply with it even if granted. You might get “show me all the repositories used in the training data for Copilot that contain that snippet.”
    • fencepost 4y ago
      No court is ever going give you that subpoena nor would it even be possible to comply with it even if granted. Quite possible, but the details could be tweaked to be more viable. The underlying message of "your tools have done us wrong and we're going to drag your customers who benefitted in" could still get through.
• HeckFeck 4y ago
  If we try enough permutations then we might eventually reproduce either Office or Windows source code. Then MS will take notice.
• thrwawy74 4y ago
  So.. say Microsoft retrained Copilot on code only explicitly marked as open-source. As an activist or vandal you could start publishing proprietary code with fraudulent license files to pollute Copilot again. This could be terribly fun.
• renewiltord 4y ago
  Doesn't seem like a problem to me. GitHub Copilot is a tool like a search engine. If I Google for some code snippet and copy it into my codebase, I can't blame Google, Github, and Stack Overflow. Instead I can only blame myself. In this way, making sure I'm not writing proprietary code is important. Fortunately it looks like Copilot only uses open repositories so that's good.
• snvzz 4y ago
  Still no way to opt out? Jesus.
• resonious 4y ago
  Well, here's a question. Is GitHub violating the LGPL by including the code in their copilot data? Or is it Copilot users who end up using the regurgitated code? I guess GitHub is violating it the instant their servers send verbatim snippets like this to developers without the copyright notice. And then the Copilot users are also violating it when (if) they release their code that contains verbatim snippets and no notice. This is a pretty good live experiment on how useful these open source licenses really are. This guy find his license is being violated, so what does he do? If complaining on Twitter seems like the best course of action then maybe we need to rethink the system.
  • ironmagma 4y ago
    If the license requires attribution and Github is not providing it (which it isn’t), then yes, Github is violating the license.
    • resonious 4y ago
      Right, so who's going to do something about it? People seem to be complaining about it on Twitter but I'm not sure what the expected result is.
      • ironmagma 4y ago
        Raising awareness is usually a step before a class-action lawsuit.
  • dragonwriter 4y ago
    > Is GitHub violating the LGPL by including the code in their copilot data? If Microsoft’s fair use analysis is correct, not actionably (at least under US law) because it is within the fair use exception to copyright. > Or is it Copilot users who end up using the regurgitated code? These aren't exclusive options; either, both, or neither could be true.
• ju 4y ago
  Not sure if it shows because he have this other code on his computer (only)
• _ryanjsalva 4y ago
  Howdy, folks. Ryan here from the GitHub Copilot product team. I don’t know how the original poster’s machine was set-up, but I’m gonna throw out a few theories about what could be happening. If similar code is open in your VS Code project, Copilot can draw context from those adjacent files. This can make it appear that the public model was trained on your private code, when in fact the context is drawn from local files. For example, this is how Copilot includes variable and method names relevant to your project in suggestions. It’s also possible that your code – or very similar code – appears many times over in public repositories. While Copilot doesn’t suggest code from specific repositories, it does repeat patterns. The OpenAI codex model (from which Copilot is derived) works a lot like a translation tool. When you use Google to translate from English to Spanish, it’s not like the service has ever seen that particular sentence before. Instead, the translation service understands language patterns (i.e. syntax, semantics, common phrases). In the same way, Copilot translates from English to Python, Rust, JavaScript, etc. The model learns language patterns based on vast amounts of public data. Especially when a code fragment appears hundreds or thousands of times, the model can interpret it as a pattern. We’ve found this happens in <1% of suggestions. To ensure every suggestion is unique, Copilot offers a filter to block suggestions >150 characters that match public data. If you’re not already using the filter, I recommend turning it on by visiting the Copilot tab in user settings. This is a new area of development, and we’re all learning. I’m personally spending a lot of time chatting with developers, copyright experts, and community stakeholders to understand the most responsible way to leverage LLMs. My biggest take-away: LLM maintainers (like GitHub) must transparently discuss the way models are built and implemented. There’s a lot of reverse-engineering happening in the community which leads to skepticism and the occasional misunderstanding. We’ll be working to improve on that front with more blog posts from our engineers and data scientists over the coming months.
  • binarymax 4y ago
    Later in the thread he stated the code was not on the machine he tested copilot with. Copilot training data should have been sanitized better. In addition: any code that is produced by copilot that uses a source that is licensed, MUST follow the practices of that license, including copyright headers.
• vkaku 4y ago
  Copyright Rules are not meant to favor a few. If that's the case then it makes a great case to break the DMCA and steal all the content out there. That sounds terrible in theory but it's one way to put some of these big money systems in check. What about all the leaked source code in early 2022. It would make perfect sense for the hackers to remove the copyright and put it in Github for karma. That way, the IP of all now belongs to all. I'm quite sure a few won't agree with this method, but that's exactly how bad it is when removing licenses from software for code predictions. Finally, Git was meant to allow people to host anywhere, so if the worry is about IP theft, one should stop hosting on Github and move it some place else, if they want it fully private.
• foota 4y ago
  My guess? This person's code has been included outside the original repo with license stripped.
  • cryptonector 4y ago
    That wouldn't save one from DMCA actions if it were music copyrights that they were infringing on. So it shouldn't save one for source code copyright infringement either. Either we get to have things like Copilot, or we loosen copyright protections a great deal. Is there a third way?
• williamcotton 4y ago
  Copyright only covers the expressive parts and not the utilitarian parts. Here is some reading material for those of you who disagree with reality: https://en.wikipedia.org/wiki/Abstraction-Filtration-Comparison_test https://en.wikipedia.org/wiki/Abstraction-Filtration-Compari... https://en.wikipedia.org/wiki/Idea–expression_distinction https://en.wikipedia.org/wiki/Idea–expression_distinction https://h2o.law.harvard.edu/cases/5004 https://h2o.law.harvard.edu/cases/5004 https://www.loeb.com/en/insights/publications/2020/04/johannsongs-publishing-ltd-v-rolf-lovland https://www.loeb.com/en/insights/publications/2020/04/johann...
• PAMANOCH 4y ago
  The "AI" that people keep talking about is no different than any other app like MS Word, which is just a piece of software that serve corporation interests. What we are experiencing today is very simple - big players are using people's work for profit without paying one cent or getting any consent, no need to talk about "How". This is a nightmare scenario under today's social and eco system, and even worse at a production level, because in the end it will form a new industry that has nothing to do with experienced people. Take creative work for example, at the current rate most artists will completely decouple from industry in several years while giving all their works for training for free, and those who control the H/W/R&D resources will find ways to profit from model one way or another, resulting in an "AI" companies controlled "creative industry" with few artists left to direct their work. Can't even think of any other examples close to this in modern history, that a small group of people can do whatever they want under the disguise of "Exciting Technology" which in reality is just stealing an entire industry. There's very little to discuss if you ignore the reality of social systems and just focusing on technical details. We don't live in some fairy tale where you can just let computer do your work and enjoy your life.
• jawadch93 4y ago
  [dead]
• anujdeshpande 4y ago
  Out of curiosity - has no one sued OpenAI/GitHub for this? I remember seeing threads like this since Copilot was launched. If there was enough legal pressure, I'd imagine OpenAI/Github training this using opt-in repos instead of using the model which they currently have.
  • stop50 4y ago
    I know of an case where they try to get sued by ms and get a precedent by using the same method.
• fireant 4y ago
  This exact code can be found 1000 times on github and many of those are MIT licensed https://github.com/search?q=%22cs+*cs_transpose+%28%22&type=code https://github.com/search?q=%22cs+*cs_transpose+%28%22&type=.... Copilot, or any other developer or person, has no way of knowing where the original implementation came from or it's original license. The cat is out of the bag, get used to it.
  • nightski 4y ago
    Or just don't use Github.
    • TAForObvReasons 4y ago
      Not using Github doesn't stop others from posting your code on Github with incorrect licenses. It becomes a massive game of whack-a-repo
      • CamperBob2 4y ago
        Or just don't give a hoot. Takes practice, but it's a skill that can be mastered like any other.
        • olliej 4y ago
          That’s why we should simply accept that companies don’t have to publish source when they include gpl code, right?
        • fsloth 4y ago
          This may be an acceptable approach if the code is not produced in a professional context and not of professional quality. One of the keystones of open source is professionals have had an ecosystem where they can deliver value to an open forum but still have at least a semblance of control how their contribution is used via various licenses they can select.
          • 4y ago
• amir734jj 4y ago
  tldr Don't use autopilot for anything work related.
• jefozabuss 4y ago
  Daily reminder to not use copilot with sensitive codebases. (Or at all but you might like automatic code completions so you do you)
• gorgoiler 4y ago
  Could there be a happy ending here, where GitHub leverage their code trawling to help @docsparse find the original pirate who stole the cstranspose IP? It would be a bold business decision by GitHub mind you. Plagiarism police is a way more negative product angle than copilot’s current pitch.
• siilats 4y ago
  I think this will be solved like YouTube music. I as copilot user don’t mind paying 0.1cents for a good matrix transform and the code owner doesn’t mind receiving 0.1cents from thousands of users and github gets 30%
  • quickthrower2 4y ago
    The small issue of provenance there! With music it is clearer who sung it, and nonfamous music is almost worthless financially anyway.
  • ben-schaaf 4y ago
    That's not compatible with the licenses used by software projects, especially GPL.
    • rodet 4y ago
      Snarky details ;)
    • Liquid_Fire 4y ago
      GPL doesn't prevent the copyright holder from also distributing the software under another license if they so choose. Of course, that would have to be a decision by the copyright holders, which is possibly difficult to provide on GitHub given how easy it makes it to upload other people's work, and you would need the agreement of every contributor unless you do copyright assignment. And you wouldn't be able to license a project using this service (i.e. with Copilot-generated code) under the GPL. But it's already unclear if you can legally do that today.
• ecmascript 4y ago
  I have used Co-pilot when it was in beta and I use Tabnine at this very moment. From my experience Githubs Co-pilot genereates a lot bigger chunks of code and it have always felt like they're just copied from somewhere. I would never pay for Co-pilot since its Microsoft who owns Github and now my fears about the product seems to have been proven.
• joxel 4y ago
  People are really missing the forest for the trees here, what I’m getting from all the whining here is that I’ve decided code licensing is stupid and shouldn’t be a thing.
• leathersoft 4y ago
  We joked about when this day would come… I hope we (tech community) figure it out because Copilot really is a game-changer.
• enriquto 4y ago
  Just a heads-up that the person who writes this is Tim Davis[0], author of the legendary CHOLMOD solver[1], which hundreds of thousands of people use daily when they solve sparse symmetric linear systems in common numerical environments. Even if CHOLMOD is easily the best sparse symmetric solver, it is notoriously not used by scipy.linalg.solve, though, because numpy/scipy developers are anti-copyleft fundamentalists and have chosen not to use this excellent code for merely ideological reasons... but this will not last: thanks to the copilot "filtering" described here, we can now recover a version of CHOLMOD unencumbered by the license that the author originaly distributed it under! O brave new world, that has such people in it! [0] https://people.engr.tamu.edu/davis/welcome.html https://people.engr.tamu.edu/davis/welcome.html [1] https://github.com/DrTimothyAldenDavis https://github.com/DrTimothyAldenDavis
  • jefftk 4y ago
    In case anyone interprets this literally: if copilot regurgitates literal code it was trained on that doesn't actually give you an unencumbered version.
    • vasco 4y ago
      So how long till new software licenses that prohibit any use of code for model training purposes? I'd be willing to bet there's a significant group of people that won't be happy either its literal or not, the fact that it was used in the training might be enough.
      • jefftk 4y ago
        The claim that most people training models make is that what they are doing is sufficiently transformative that it counts as fair use, and doesn't require a license. That means putting something in a software license that prohibits model training wouldn't do anything. In this case, what the model is doing is clearly (to me as an non-lawyer) not transformative enough to count as fair use, but it's possible that the co-pilot folks will be able to fix this kind of thing with better output filtering.
• dividedcomet 4y ago
  Yeah, I think I’m going to take my personal repos off of GitHub and probably recommend the same thing at our company. Seems to be a liability that our proprietary code could get included in these models and leaked (even if accidentally). I feel similar to this on how I do AI art, which is that I am being taken advantage of by some larger entity so they can make money, even if they’ve been explicitly told it’s illegal. On the argument of the machine is just leaning like any other human, that is absolute nonsense. Makes me feel ashamed to work in software, the way people can take advantage of other peoples hard work to make a buck with no even request or slightest bit of remorse.
  • JamesonNetworks 4y ago
    Gitea is very nice: https://gitea.io/en-us/ https://gitea.io/en-us/
• onethought 4y ago
  So before Copilot I could go on GitHub, search for the code, copy and paste it and ignore the license (I know that's bad). No one had a problem with GitHub facilitating this. But Copilot now does the search/copy/paste for me and suddenly uproar? I'm not sure I follow, the capability/possibility hasn't changed, just the convenience has.
• planede 4y ago
  Hey, including copyrighted code, especially from other repositories without a correct license, is an honest mistake. You should be able to file a DMCA request with a list of all the repos containing your code, and then they should just retrain copilot with those repos excluded. Clearly that's what is needed for them to stop distributing your code. /s Sarcasm aside I think there are several possible legal viewpoints here (IANAL): 1. copilot is distributing copies of code and it's not a safe harbor: Microsoft is directly liable to copyright infringement by copilot producing code without appropriate license/attribution. 2. copilot is distributing copies of code and it's a safe harbor: Microsoft is not directly liable, but it should comply with DMCA requests. Practically that would mean retraining with mentioned code snippets/repositories excluded in a timely manner, otherwise I don't see a way how they could disentangle the affected IP from the already trained models. 3. copilot produces novel work by itself not subject to copyright of the training data: I think this is really a stretch. IANAL, but I think producing novel creative work is a right exclusive to living human beings, so machines can't produce them almost by definition. (There is the monkey selfie copyright case, but at least the "living" there was ticked off). 4. the user of copilot is producing novel work by prompting copilot: it's like triggering a camera. The copyright of the resulting picture is fully owned by the operator, even though much of the heavy lifting is done by the camera itself. Even then, this very much depends on the subject. IMO option 3 doesn't have a legal standing. Microsoft and users of copilot would very much like if it was option 4 that applied always, but this particular case clearly falls under option 1 or option 2, in which case Microsoft should hold some legal liability, even if they can't always track the correct license ahead of time.
• eterevsky 4y ago
  I don't think it's fair to say this it emits the same code. The code on the right is definitely implementing the same algorithm and is generally similar to the code on the left, but it's not identical. IANAL, but I think copyright wouldn't apply in this case. Imagine a person who would want to implement the same function in their project. They could look at the open source implementation to learn how the algorithm is supposed to work, and would write their implementation. They could end up with the implementation on the right.
• dudeinjapan 4y ago
  Github Copilot is less Jeff Skiles and more Andy Warhol.
• freddealmeida 4y ago
  Interesting, but probably not what you think. Also stop copyrighting code.
• jollyllama 4y ago
  We're probably going to start seeing corporations put sentinel lines in their code, search for it, and C&D anywhere the sentinel lines turn up.
• noobermin 4y ago
  I just have to say, it's quite ironic now that it's happening to software code, people here are understanding and trying to earnestly find solutions vs. saying things like "guys like him are standing in the way of progress" and "someone is worried about losing their jobs!" and "horse and buggies are striking back" and the like. I know cognitive biases are strong, but amongst a community that is at least reputed to be somewhat intellectual, the lack of similar sympathy for artists who say their work is being stolen is a bit too much of an irony here to ignore.
• BenFrantzDale 4y ago
  The weird thing about CoPilot to me is that all the examples seem like bad examples: I don’t want my team writing new functions to count the bits in an int; I want them to call the function to count the bits. The real potential of CoPilot would be if GitHub uses it to design libraries for various languages that do the things people keep wanting done. Imagine if instead of autocompleting the body of `std::size_t count_bits(int)`, it would suggest “Try `#include <GitHubLib/BitTwiddling.h>` and call `GitHubLib::count_bits`.”
  • kyleee 4y ago
    that's a great feature suggestion, it can be a lot of work to discover and vet libraries to use
• paulis 4y ago
  Here is one repository on github with the code: The repo: https://github.com/Shreeyak/cleargrasp https://github.com/Shreeyak/cleargrasp https://github.com/Shreeyak/cleargrasp/blob/master/api/depth2depth/gaps/pkgs/CSparse/cs_transpose.c https://github.com/Shreeyak/cleargrasp/blob/master/api/depth... It looks like the license of the repo is Apache 2.0