7 ms·

Searching for the function names in his libraries, I'm seeing some 32,000 hits. I suspect he has a different problem which (thanks to Microsoft) is now a probl

Searching for the function names in his libraries, I'm seeing some 32,000 hits. I suspect he has a different problem which (thanks to Microsoft) is now a problem he has to care about: his code probably shows up in one or more repos copy-pasted with improper LGPL attribution. There'd be no way for Copilot to know that had happened, and it would have mixed in the code. (As a side note: understanding why an ML engine outputs a particular result is still an open area of research AFAIK.)

ianbutler 4y ago
Yeah that's a mess, but that's way too much legal baggage for me, an otherwise innocent end user, to want to take on. Especially when I personally tend to try and monetize a lot of my work. I understand there's no way for the model to know, but it's really on Microsoft then to ensure no private, or poorly licensed or proprietary code is included in the training set. That sounds like a very tall order, but I think they're going to have to otherwise they're eventually going to run into legal problems with someone who has enough money to make it hurt for them.
- shadowgovt 4y ago
  Agreed. Silver lining: MS is now heavily incentivized to invest in solutions for an open research problem.
- twaw 4y ago
  Open source code is open source when it license is obeyed only. When license is not obeyed, e.g. copyright notice is no reproduced, it should be treated as private code, except for dual-licensed code.
- kwhitefoot 4y ago
  Of course the model can know if the code is repeated in multiple repositories with different licences. The people who maintain copilot simply don't care to make it do so.
enragedcacti 4y ago
Expanding on that, even if Microsoft sees the error of their ways and retrains copilot against permissively licensed source or with explicit opt-in, it may get trained on proprietary code the old version of copilot inserted into a permissively licensed project. You would have to just hope that you can take down every instance of your code and keep it down, all while copilot keeps making more instances for the next version to train on and plagiarize.
- scrame 4y ago
  > Microsoft > sees the error of their ways You must be new here.
deleted 4y ago
[deleted]
chiefalchemist 4y ago
I thought the same thing. But then shouldn't CP look at things it's not supposed to use and see if that's happened? How is that any different than you committing your API to Platform X and shortly thereafter Platform X reaches out to you...because GH let them know?
deleted 4y ago
[deleted]
deleted 4y ago
[deleted]
armchairhacker 4y ago
This is exactly what I was thinking. It's still a legal headache for Microsoft but it's not like they're just blatantly ignoring the license
andreareina 4y ago
"It's too hard" isn't a valid reason for me to not follow laws and/or social norms. This is a predictable result and was predicted by many people; "oops we didn't know" is neither credible nor acceptable.
- Spivak 4y ago
  It’s not “oops we didn’t know” it’s, “someone published a project under a permissive license which included this code.” If your standard is “Github should have an oracle to the US court system and predict what the outcome of a lawsuit alleging copyright infringement for a given snippet of code would be” then it is literally impossible for anyone to use any open source code ever because it might contain infringing code. There is no chain of custody for this kind of thing which is what it would require.
  - polymatter 4y ago
    Exactly, the chain of custody is absolutely required for this to be legal because no oracle can exist. It must be able to attribute exactly who contributed the suspect code. It must be able to handle the edge case where some humans might publish code without permission. Either that or we effectively get rid of software copyright as copilot can be used (or even claim to be used) to launder code of license restrictions. Eg No I didn't copy your code, I used copilot and it copied your code so I did nothing wrong.
    - roer 4y ago
      Right, so we need a system for when a dev goes and grabs code-snippets from blogs and open-source freely licensed projects on e.g. github in which they can say that the code is from so-and-so source? So like a way to distribute and inherit git blame?
    - concordDance 4y ago
      This takes place with or without copilot. The problem would be people copying code and releasing it under a different license.
mattigames 4y ago
It doesn't matter that there is not way for copilot to know what happened, doing something illegal because hundreads of people did it before it's never a valid excuse under the rule of law; nor it is "I didn't know it was illegal". Regardless if it's copying code without permission or jaywalking.
vintermann 4y ago
Well yes, there'd be no way for the copilot model, as currently specified and trained, to know. But it IS possible to train a model for that. In fact, I believe ML models can be fantastic "code archaeologists", giving us insights into not just direct copying, but inspiration and idioms as well. They don't just have the code, they have commit histories with timestamps. A causal fact which these models could incorporate, is that we know data from the past wasn't influenced by data from the future. I believe that is a lever to pry open a lot of wondrous discoveries, and I can't wait until a model with this causal assumption is let loose on Spotify's catalog, and we get a computer's perspective on who influenced who. But in the meantime, discovering where copy-pasted code originated should be a lot easier.
- pca006132 4y ago
  Ah, a plagiarism checker that can understand simple code transformation and find the original source? Sounds like a good idea for patent trolls and I have no idea about how/if copyright laws can be apply in this case. Does copying the idea but not copying the code verbatim constitutes copyright violation?
  - vintermann 4y ago
    The patent troll version of the algorithm needs the victim's bank balance as input too. In fact that's probably all it needs. It would be much more valuable for people who care about the truth.
kitsune_ 4y ago
There'd be no way for Copilot to know that had happened? What? YT uses Content ID. GH could set up a similar program for OSS.
- kbelder 4y ago
  >GH could set up a similar program for OSS. What a nightmare. I'd say that constant code copying is massively pervasive, with no regard to licensing, always has been, and that's not really a bad thing, and attempts to stop it are going to be far more harmful than helpful.
cerved 4y ago
> There'd be no way for Copilot to know that had happened All lines are associated to a commit, which has author/commit date. A reasonable guess as to which snippet was made first can be done
manholio 4y ago
> his code probably shows up in one or more repos copy-pasted with improper LGPL attribution. Can Copilot prove that and link to the source LGPL code whenever it reproduces more than half a line of code from such a source? Because without that clear attribution trail, nobody in their right mind would contaminate their codebase with possibly stolen code. Hell, some bad actor might purposefully publish a proprietary base full of stolen LGPL code, and run scanners on other products until they get a Copilot "bite". When that happens and you get sued, good luck finding the original open source code both you and your aggressor derive from.
neop1x 4y ago
>> his code probably shows up in one or more repos copy-pasted with improper LGPL attribution That is why Copilot should have always been opt-in (explicitly ask original authors to provide their code to copilot training). Instead, they are simply stealing the code of others.

ianbutler 4y ago

Yeah that's a mess, but that's way too much legal baggage for me, an otherwise innocent end user, to want to take on. Especially when I personally tend to try and monetize a lot of my work. I understand there's no way for the model to know, but it's really on Microsoft then to ensure no private, or poorly licensed or proprietary code is included in the training set. That sounds like a very tall order, but I think they're going to have to otherwise they're eventually going to run into legal problems with someone who has enough money to make it hurt for them.

shadowgovt 4y ago
Agreed. Silver lining: MS is now heavily incentivized to invest in solutions for an open research problem.
twaw 4y ago
Open source code is open source when it license is obeyed only. When license is not obeyed, e.g. copyright notice is no reproduced, it should be treated as private code, except for dual-licensed code.
kwhitefoot 4y ago
Of course the model can know if the code is repeated in multiple repositories with different licences. The people who maintain copilot simply don't care to make it do so.

enragedcacti 4y ago

Expanding on that, even if Microsoft sees the error of their ways and retrains copilot against permissively licensed source or with explicit opt-in, it may get trained on proprietary code the old version of copilot inserted into a permissively licensed project. You would have to just hope that you can take down every instance of your code and keep it down, all while copilot keeps making more instances for the next version to train on and plagiarize.

scrame 4y ago
> Microsoft > sees the error of their ways You must be new here.

deleted 4y ago

[deleted]

chiefalchemist 4y ago

I thought the same thing. But then shouldn't CP look at things it's not supposed to use and see if that's happened? How is that any different than you committing your API to Platform X and shortly thereafter Platform X reaches out to you...because GH let them know?

deleted 4y ago

[deleted]

deleted 4y ago

[deleted]

armchairhacker 4y ago

This is exactly what I was thinking. It's still a legal headache for Microsoft but it's not like they're just blatantly ignoring the license

andreareina 4y ago

"It's too hard" isn't a valid reason for me to not follow laws and/or social norms. This is a predictable result and was predicted by many people; "oops we didn't know" is neither credible nor acceptable.

Spivak 4y ago
It’s not “oops we didn’t know” it’s, “someone published a project under a permissive license which included this code.” If your standard is “Github should have an oracle to the US court system and predict what the outcome of a lawsuit alleging copyright infringement for a given snippet of code would be” then it is literally impossible for anyone to use any open source code ever because it might contain infringing code. There is no chain of custody for this kind of thing which is what it would require.
- polymatter 4y ago
  Exactly, the chain of custody is absolutely required for this to be legal because no oracle can exist. It must be able to attribute exactly who contributed the suspect code. It must be able to handle the edge case where some humans might publish code without permission. Either that or we effectively get rid of software copyright as copilot can be used (or even claim to be used) to launder code of license restrictions. Eg No I didn't copy your code, I used copilot and it copied your code so I did nothing wrong.
  - roer 4y ago
    Right, so we need a system for when a dev goes and grabs code-snippets from blogs and open-source freely licensed projects on e.g. github in which they can say that the code is from so-and-so source? So like a way to distribute and inherit git blame?
  - concordDance 4y ago
    This takes place with or without copilot. The problem would be people copying code and releasing it under a different license.

mattigames 4y ago

It doesn't matter that there is not way for copilot to know what happened, doing something illegal because hundreads of people did it before it's never a valid excuse under the rule of law; nor it is "I didn't know it was illegal". Regardless if it's copying code without permission or jaywalking.

vintermann 4y ago

Well yes, there'd be no way for the copilot model, as currently specified and trained, to know. But it IS possible to train a model for that. In fact, I believe ML models can be fantastic "code archaeologists", giving us insights into not just direct copying, but inspiration and idioms as well. They don't just have the code, they have commit histories with timestamps. A causal fact which these models could incorporate, is that we know data from the past wasn't influenced by data from the future. I believe that is a lever to pry open a lot of wondrous discoveries, and I can't wait until a model with this causal assumption is let loose on Spotify's catalog, and we get a computer's perspective on who influenced who. But in the meantime, discovering where copy-pasted code originated should be a lot easier.

pca006132 4y ago
Ah, a plagiarism checker that can understand simple code transformation and find the original source? Sounds like a good idea for patent trolls and I have no idea about how/if copyright laws can be apply in this case. Does copying the idea but not copying the code verbatim constitutes copyright violation?
- vintermann 4y ago
  The patent troll version of the algorithm needs the victim's bank balance as input too. In fact that's probably all it needs. It would be much more valuable for people who care about the truth.

kitsune_ 4y ago

There'd be no way for Copilot to know that had happened? What? YT uses Content ID. GH could set up a similar program for OSS.

kbelder 4y ago
>GH could set up a similar program for OSS. What a nightmare. I'd say that constant code copying is massively pervasive, with no regard to licensing, always has been, and that's not really a bad thing, and attempts to stop it are going to be far more harmful than helpful.

cerved 4y ago

> There'd be no way for Copilot to know that had happened All lines are associated to a commit, which has author/commit date. A reasonable guess as to which snippet was made first can be done

manholio 4y ago

> his code probably shows up in one or more repos copy-pasted with improper LGPL attribution. Can Copilot prove that and link to the source LGPL code whenever it reproduces more than half a line of code from such a source? Because without that clear attribution trail, nobody in their right mind would contaminate their codebase with possibly stolen code. Hell, some bad actor might purposefully publish a proprietary base full of stolen LGPL code, and run scanners on other products until they get a Copilot "bite". When that happens and you get sued, good luck finding the original open source code both you and your aggressor derive from.

neop1x 4y ago

>> his code probably shows up in one or more repos copy-pasted with improper LGPL attribution That is why Copilot should have always been opt-in (explicitly ask original authors to provide their code to copilot training). Instead, they are simply stealing the code of others.