8 ms·

I just tested it myself on a random c file I created in the middle of a rust project I'm working on, it reproduced his full code verbatim from just the function

I just tested it myself on a random c file I created in the middle of a rust project I'm working on, it reproduced his full code verbatim from just the function header so clearly it does regurgitate proprietary code unlike some people have said, I do not have his source so co-pilot isn't just using existing context. I've been finding co-pilot really useful but I'll be pausing it for now, and I'm glad I have only been using it on personal projects and not anything for work. This crosses the line in my head from legal ambiguity to legal "yeah that's gonna have to stop".

naikrovek 4y ago
what proprietary code? the guy on Twitter is seeing his own GPL code bring reproduced. nothing proprietary there. do you have the "don't reproduce code verbatim" preference set?
- webstrand 4y ago
  He owns the copyright to the code, and the code is not in the public domain, therefore it is proprietary code.
  - yjftsjthsd-h 4y ago
    That's not how anybody uses the word proprietary when dealing with software licensing. It's a term of art that stands in contrast to open source licenses.
    - ianbutler 4y ago
      For the record, I don't typically think in terms of the open source community. I grant that if most people are using it one way here I was likely wrong for the way it is typically used by the normal open source community, I followed up with a reply saying it would likely be more correct for me to have said "improperly licensed" to be included in the training set. Still it being private means it probably shouldn't be in the training set anyway regardless of license, because in the future, truly proprietary code could be included, or code without any license which reserves all right to the creator.
  - naikrovek 4y ago
    that is not what proprietary means and you know it.
    - deleted 4y ago
      [deleted]
- ianbutler 4y ago
  Sorry it would likely be more correct to say "improperly licensed" code and not proprietary. Still for someone like me, the possibility of having LGPL, or any GPL licensed code generated in their project is a solid no thanks. I know others may think differently but those are toxic licenses to me. Not to mention this code wasn't public so it's kind of moot, having someone's private code be generated into my project is very bad. As to the option, I do not, I wasn't even aware of the option, but it's pretty silly to me that's not on by default, or even really an option. That should probably be enabled with no way to toggle it without editing the extension.
  - naikrovek 4y ago
    - ianbutler 4y ago
      You said, "don't reproduce code verbatim" as the option. Maybe you should use the actual name of the option if you want people to know what you're talking about. The "with public code blocked" option I am aware of, and is distinctly different from what you said. Don't be a dick, and if you want to be a dick, be right the first time or piss off.
      - naikrovek 4y ago
        well unlike you I am human. I say things differently at different times.
- IncRnd 4y ago
  The code is not GPL but is copyrighted in his name.
  - naikrovek 4y ago
    some of it is lgpl and some of it is gpl. code contributed by others is licensed differently.
    - IncRnd 4y ago
      The license for other code, even when in the same repo, doesn't apply to the license on the code that is under discussion here.
  - aeyes 4y ago
    It is also allowed to be used under LGPL terms: https://github.com/DrTimothyAldenDavis/SuiteSparse/blob/master/CSparse/Doc/License.txt https://github.com/DrTimothyAldenDavis/SuiteSparse/blob/mast... But that doesn't make it any better.
    - IncRnd 4y ago
      Yes, but I was pointing that out to my parent poster, who erronesouly said the code was GPL licensed.
  - naikrovek 4y ago
    GPL'd code has a copyright owner. those two things exist at the same time. try reading a licence now and again!
    - IncRnd 4y ago
      Slow down there with the snarky comments. I never said GPL'd code doesn't have a copyright owner.
      - twaw 4y ago
shadowgovt 4y ago
Searching for the function names in his libraries, I'm seeing some 32,000 hits. I suspect he has a different problem which (thanks to Microsoft) is now a problem he has to care about: his code probably shows up in one or more repos copy-pasted with improper LGPL attribution. There'd be no way for Copilot to know that had happened, and it would have mixed in the code. (As a side note: understanding why an ML engine outputs a particular result is still an open area of research AFAIK.)
- ianbutler 4y ago
  Yeah that's a mess, but that's way too much legal baggage for me, an otherwise innocent end user, to want to take on. Especially when I personally tend to try and monetize a lot of my work. I understand there's no way for the model to know, but it's really on Microsoft then to ensure no private, or poorly licensed or proprietary code is included in the training set. That sounds like a very tall order, but I think they're going to have to otherwise they're eventually going to run into legal problems with someone who has enough money to make it hurt for them.
  - shadowgovt 4y ago
    Agreed. Silver lining: MS is now heavily incentivized to invest in solutions for an open research problem.
  - twaw 4y ago
    Open source code is open source when it license is obeyed only. When license is not obeyed, e.g. copyright notice is no reproduced, it should be treated as private code, except for dual-licensed code.
  - kwhitefoot 4y ago
    Of course the model can know if the code is repeated in multiple repositories with different licences. The people who maintain copilot simply don't care to make it do so.
- enragedcacti 4y ago
  Expanding on that, even if Microsoft sees the error of their ways and retrains copilot against permissively licensed source or with explicit opt-in, it may get trained on proprietary code the old version of copilot inserted into a permissively licensed project. You would have to just hope that you can take down every instance of your code and keep it down, all while copilot keeps making more instances for the next version to train on and plagiarize.
bamboozled 4y ago
So I’m working on a side project and it’s hosted on GitHub, does this mean the code (which I consider precious and my own) can just be stolen and injected into my competitors codebase who is using co-pilot? If this is the case, I can imagine people migrating of GitHub very quickly. I can also imagine some pretty nice lawsuits opening up.
- concordDance 4y ago
  A good rule of thumb is if you're worried about code being copied you really shouldn't put it on github. Even if most large companies respect copyright, that small studio in Russia certainly won't.
  - bamboozled 4y ago
    How would the small studio access my private repo ?
    - frankacter 4y ago
      They wouldn't. If you have it in a private repository and you are the only one with access to it, you'll likely not run into this issue. From other comments, this developers "private" code was found in 30k+ public repositories with public attribution which is what created this issue. Presumably your private code is not also present or leaked to any public repositories.
      - bamboozled 4y ago
        The, this brings up a very, very interesting question, people have stolen code or leaked it into public repositories, and Microsoft are building a product that references that code.

naikrovek 4y ago

what proprietary code? the guy on Twitter is seeing his own GPL code bring reproduced. nothing proprietary there. do you have the "don't reproduce code verbatim" preference set?

webstrand 4y ago
He owns the copyright to the code, and the code is not in the public domain, therefore it is proprietary code.
- yjftsjthsd-h 4y ago
  That's not how anybody uses the word proprietary when dealing with software licensing. It's a term of art that stands in contrast to open source licenses.
  - ianbutler 4y ago
    For the record, I don't typically think in terms of the open source community. I grant that if most people are using it one way here I was likely wrong for the way it is typically used by the normal open source community, I followed up with a reply saying it would likely be more correct for me to have said "improperly licensed" to be included in the training set. Still it being private means it probably shouldn't be in the training set anyway regardless of license, because in the future, truly proprietary code could be included, or code without any license which reserves all right to the creator.
- naikrovek 4y ago
  that is not what proprietary means and you know it.
  - deleted 4y ago
    [deleted]
ianbutler 4y ago
Sorry it would likely be more correct to say "improperly licensed" code and not proprietary. Still for someone like me, the possibility of having LGPL, or any GPL licensed code generated in their project is a solid no thanks. I know others may think differently but those are toxic licenses to me. Not to mention this code wasn't public so it's kind of moot, having someone's private code be generated into my project is very bad. As to the option, I do not, I wasn't even aware of the option, but it's pretty silly to me that's not on by default, or even really an option. That should probably be enabled with no way to toggle it without editing the extension.
- naikrovek 4y ago
  - ianbutler 4y ago
    You said, "don't reproduce code verbatim" as the option. Maybe you should use the actual name of the option if you want people to know what you're talking about. The "with public code blocked" option I am aware of, and is distinctly different from what you said. Don't be a dick, and if you want to be a dick, be right the first time or piss off.
    - naikrovek 4y ago
      well unlike you I am human. I say things differently at different times.
IncRnd 4y ago
The code is not GPL but is copyrighted in his name.
- naikrovek 4y ago
  some of it is lgpl and some of it is gpl. code contributed by others is licensed differently.
  - IncRnd 4y ago
    The license for other code, even when in the same repo, doesn't apply to the license on the code that is under discussion here.
- aeyes 4y ago
  It is also allowed to be used under LGPL terms: https://github.com/DrTimothyAldenDavis/SuiteSparse/blob/master/CSparse/Doc/License.txt https://github.com/DrTimothyAldenDavis/SuiteSparse/blob/mast... But that doesn't make it any better.
  - IncRnd 4y ago
    Yes, but I was pointing that out to my parent poster, who erronesouly said the code was GPL licensed.
- naikrovek 4y ago
  GPL'd code has a copyright owner. those two things exist at the same time. try reading a licence now and again!
  - IncRnd 4y ago
    Slow down there with the snarky comments. I never said GPL'd code doesn't have a copyright owner.
    - twaw 4y ago

shadowgovt 4y ago

Searching for the function names in his libraries, I'm seeing some 32,000 hits. I suspect he has a different problem which (thanks to Microsoft) is now a problem he has to care about: his code probably shows up in one or more repos copy-pasted with improper LGPL attribution. There'd be no way for Copilot to know that had happened, and it would have mixed in the code. (As a side note: understanding why an ML engine outputs a particular result is still an open area of research AFAIK.)

ianbutler 4y ago
Yeah that's a mess, but that's way too much legal baggage for me, an otherwise innocent end user, to want to take on. Especially when I personally tend to try and monetize a lot of my work. I understand there's no way for the model to know, but it's really on Microsoft then to ensure no private, or poorly licensed or proprietary code is included in the training set. That sounds like a very tall order, but I think they're going to have to otherwise they're eventually going to run into legal problems with someone who has enough money to make it hurt for them.
- shadowgovt 4y ago
  Agreed. Silver lining: MS is now heavily incentivized to invest in solutions for an open research problem.
- twaw 4y ago
  Open source code is open source when it license is obeyed only. When license is not obeyed, e.g. copyright notice is no reproduced, it should be treated as private code, except for dual-licensed code.
- kwhitefoot 4y ago
  Of course the model can know if the code is repeated in multiple repositories with different licences. The people who maintain copilot simply don't care to make it do so.
enragedcacti 4y ago
Expanding on that, even if Microsoft sees the error of their ways and retrains copilot against permissively licensed source or with explicit opt-in, it may get trained on proprietary code the old version of copilot inserted into a permissively licensed project. You would have to just hope that you can take down every instance of your code and keep it down, all while copilot keeps making more instances for the next version to train on and plagiarize.

bamboozled 4y ago

So I’m working on a side project and it’s hosted on GitHub, does this mean the code (which I consider precious and my own) can just be stolen and injected into my competitors codebase who is using co-pilot? If this is the case, I can imagine people migrating of GitHub very quickly. I can also imagine some pretty nice lawsuits opening up.

concordDance 4y ago
A good rule of thumb is if you're worried about code being copied you really shouldn't put it on github. Even if most large companies respect copyright, that small studio in Russia certainly won't.
- bamboozled 4y ago
  How would the small studio access my private repo ?
  - frankacter 4y ago
    They wouldn't. If you have it in a private repository and you are the only one with access to it, you'll likely not run into this issue. From other comments, this developers "private" code was found in 30k+ public repositories with public attribution which is what created this issue. Presumably your private code is not also present or leaked to any public repositories.
    - bamboozled 4y ago
      The, this brings up a very, very interesting question, people have stolen code or leaked it into public repositories, and Microsoft are building a product that references that code.