5 ms·

Later in the thread he stated the code was not on the machine he tested copilot with. Copilot training data should have been sanitized better. In addition: an

Later in the thread he stated the code was not on the machine he tested copilot with. Copilot training data should have been sanitized better. In addition: any code that is produced by copilot that uses a source that is licensed, MUST follow the practices of that license, including copyright headers.

danielheath 4y ago
Right - but if someone pushes the same code to github and changes the licence file to say "public domain", what's the legally correct way to proceed? What's the morally correct way to proceed?
- Marazan 4y ago
  If you want a massive corpus of training data theb you can create it by hand like grandpappy used to do rather than just thieving it whilst telling yourself it is fine.
- lmm 4y ago
  Legally, if you're publishing a derived work without legitimate permission then you're civilly liable for statutory + actual damages, the only thing you're avoiding is the treble damages for wilful infringement. Morally I'd say you should make a reasonable good faith effort to verify that you have a real license for everything you're using. When you're importing something on the scale of "all of Github" that means a bit more effort than just blindly trusting the file in the repository. When I worked with an F500 we would have a human explicitly review the license of each dependency; the review was pretty cursory, but it would've been enough to catch someone blatantly ripping off a popular repo.
  - d1sxeyes 4y ago
    How do you know GH didn't? Maybe they only included repos with LICENSE.MD files which followed a known permissive licence? What if a particular piece of code is licensed restrictively, and then (assuming without malice) accidentally included in a piece of software with a permissive license? What if a particular piece of code is licensed permissively (in a way that allows relicensing, for example), but then included in a software package with a more restrictive licence. How could you tell if the original code is licensed permissively or not? At what point do Github have to become absolute arbiters of the original authorship of the code in order to determine who is authorised to issue licenses for the code? How would they do so? How could you prove ownership to Github? What consequences could there be if you were unable to prove ownership? That's before we even get to more nuanced ethical questions like a human learning to code will inevitably learn from reading code, even if the code they read is not permissively licensed. Why then, would an AI learning to code not be allowed to do the same?
    - IneffablePigeon 4y ago
      The “it’s really hard” argument isn’t a very good argument in my opinion? If we hold reproductions of a single repository to a certain standard, the same standard should probably apply to mass reproductions. For a single repository, it’s your responsibility to make sure it’s used according to the license. Are there slightly gray edge cases? Of course, but they’re not -that- grey. If I reproduced part of a book from a source that claimed incorrectly it was released under a permissive license, I would still be liable for that misuse. Especially if I was later made aware of the mistake and didn’t correct it. If something is prohibitively difficult maybe we should sometimes consider that more work is required to enable the circumstances for it to be a good idea, rather than starting from the position that we should do it and moulding what we consider reasonable around that starting assumption.
      - d1sxeyes 4y ago
        If someone uploads something and says 'hey, this is some code, this is the appropriate licence for it', it is their mistake, it is in violation of Github's terms of service, and may even be fraudulent. [0]. I'm also not sure that Copilot is just reproducing code, but that's a separate discussion. > If I reproduced part of a book from a source that claimed incorrectly it was released under a permissive license, I would still be liable for that misuse. Especially if I was later made aware of the mistake and didn’t correct it. I don't believe that's correct in the first instance (at least from a criminal perspective). If someone misrepresents to you that they have the right to authorise you to publish something, and it turns out they don't have that right, you did not willingly infringe and are not liable for the infringement from a criminal perspective[1]. From a civil perspective, likely the copyright owner could still claim damages from you if you were unable to reach a settlement. A court would probably determine the damages to award based on real damages (including loss of earnings for the content creator), rather than anything punitive if it's found that Further, most jurisdictions have exceptions for short extracts of a larger copyrighted work (e.g. quotes from a book), which may apply to Copilot. This is my own code, I wrote it myself just now. Can I copyright it? ``` function isOdd (num) { if (num % 2 === 0) { return true; } else { return false; } } ``` What about the following: ``` function isOddAndNotSunday (num) { const date = new Date(); if (num % 2 === 0 && date.getDay() > 0) { return true; } else { return false; } } ``` Where do we draw the line? [0]: https://docs.github.com/en/site-policy/github-terms/github-terms-of-service#3-ownership-of-content-right-to-post-and-license-grants https://docs.github.com/en/site-policy/github-terms/github-t... [1]: https://www.law.cornell.edu/uscode/text/17/506 https://www.law.cornell.edu/uscode/text/17/506
- avereveard 4y ago
  You keep track of where each external dependency, file and code snippet come from, link to the source, link to the source license. If someone has lied about the license of something down the chain of links, he's the one on the hook for it. If you have licensed code in your software and no license to show for it or cannot produce the link to it then you're on the hook. And here's the issue at hand copilot must have seen that code under permissive license somewhere, but now cannot produce a link to it.
  - danielheath 4y ago
    > If someone has lied about the license of something down the chain of links, he's the one on the hook for it. In this case, all you have on them is an email address. Pretty sure you're still on the hook.
- cycomanic 4y ago
  It is responsibility of the entity (Microsoft in this case) publishing the code to make sure that they have the right to publish. The Linux kernel generally requires non anonymous contributions for that reason. As a guarantee that the person has the right to contribute.
  - concordDance 4y ago
    > It is responsibility of the entity (Microsoft in this case) publishing the code to make sure that they have the right to publish. This would basically kill github as an idea. I like the ability to be able to push some personal project to github and don't really give a fuck about technical copyright violations and I think the same is true for 90% of developers.

danielheath 4y ago

Right - but if someone pushes the same code to github and changes the licence file to say "public domain", what's the legally correct way to proceed? What's the morally correct way to proceed?

Marazan 4y ago
If you want a massive corpus of training data theb you can create it by hand like grandpappy used to do rather than just thieving it whilst telling yourself it is fine.
lmm 4y ago
Legally, if you're publishing a derived work without legitimate permission then you're civilly liable for statutory + actual damages, the only thing you're avoiding is the treble damages for wilful infringement. Morally I'd say you should make a reasonable good faith effort to verify that you have a real license for everything you're using. When you're importing something on the scale of "all of Github" that means a bit more effort than just blindly trusting the file in the repository. When I worked with an F500 we would have a human explicitly review the license of each dependency; the review was pretty cursory, but it would've been enough to catch someone blatantly ripping off a popular repo.
- d1sxeyes 4y ago
  How do you know GH didn't? Maybe they only included repos with LICENSE.MD files which followed a known permissive licence? What if a particular piece of code is licensed restrictively, and then (assuming without malice) accidentally included in a piece of software with a permissive license? What if a particular piece of code is licensed permissively (in a way that allows relicensing, for example), but then included in a software package with a more restrictive licence. How could you tell if the original code is licensed permissively or not? At what point do Github have to become absolute arbiters of the original authorship of the code in order to determine who is authorised to issue licenses for the code? How would they do so? How could you prove ownership to Github? What consequences could there be if you were unable to prove ownership? That's before we even get to more nuanced ethical questions like a human learning to code will inevitably learn from reading code, even if the code they read is not permissively licensed. Why then, would an AI learning to code not be allowed to do the same?
  - IneffablePigeon 4y ago
    The “it’s really hard” argument isn’t a very good argument in my opinion? If we hold reproductions of a single repository to a certain standard, the same standard should probably apply to mass reproductions. For a single repository, it’s your responsibility to make sure it’s used according to the license. Are there slightly gray edge cases? Of course, but they’re not -that- grey. If I reproduced part of a book from a source that claimed incorrectly it was released under a permissive license, I would still be liable for that misuse. Especially if I was later made aware of the mistake and didn’t correct it. If something is prohibitively difficult maybe we should sometimes consider that more work is required to enable the circumstances for it to be a good idea, rather than starting from the position that we should do it and moulding what we consider reasonable around that starting assumption.
    - d1sxeyes 4y ago
      If someone uploads something and says 'hey, this is some code, this is the appropriate licence for it', it is their mistake, it is in violation of Github's terms of service, and may even be fraudulent. [0]. I'm also not sure that Copilot is just reproducing code, but that's a separate discussion. > If I reproduced part of a book from a source that claimed incorrectly it was released under a permissive license, I would still be liable for that misuse. Especially if I was later made aware of the mistake and didn’t correct it. I don't believe that's correct in the first instance (at least from a criminal perspective). If someone misrepresents to you that they have the right to authorise you to publish something, and it turns out they don't have that right, you did not willingly infringe and are not liable for the infringement from a criminal perspective[1]. From a civil perspective, likely the copyright owner could still claim damages from you if you were unable to reach a settlement. A court would probably determine the damages to award based on real damages (including loss of earnings for the content creator), rather than anything punitive if it's found that Further, most jurisdictions have exceptions for short extracts of a larger copyrighted work (e.g. quotes from a book), which may apply to Copilot. This is my own code, I wrote it myself just now. Can I copyright it? ``` function isOdd (num) { if (num % 2 === 0) { return true; } else { return false; } } ``` What about the following: ``` function isOddAndNotSunday (num) { const date = new Date(); if (num % 2 === 0 && date.getDay() > 0) { return true; } else { return false; } } ``` Where do we draw the line? [0]: https://docs.github.com/en/site-policy/github-terms/github-terms-of-service#3-ownership-of-content-right-to-post-and-license-grants https://docs.github.com/en/site-policy/github-terms/github-t... [1]: https://www.law.cornell.edu/uscode/text/17/506 https://www.law.cornell.edu/uscode/text/17/506
avereveard 4y ago
You keep track of where each external dependency, file and code snippet come from, link to the source, link to the source license. If someone has lied about the license of something down the chain of links, he's the one on the hook for it. If you have licensed code in your software and no license to show for it or cannot produce the link to it then you're on the hook. And here's the issue at hand copilot must have seen that code under permissive license somewhere, but now cannot produce a link to it.
- danielheath 4y ago
  > If someone has lied about the license of something down the chain of links, he's the one on the hook for it. In this case, all you have on them is an email address. Pretty sure you're still on the hook.
cycomanic 4y ago
It is responsibility of the entity (Microsoft in this case) publishing the code to make sure that they have the right to publish. The Linux kernel generally requires non anonymous contributions for that reason. As a guarantee that the person has the right to contribute.
- concordDance 4y ago
  > It is responsibility of the entity (Microsoft in this case) publishing the code to make sure that they have the right to publish. This would basically kill github as an idea. I like the ability to be able to push some personal project to github and don't really give a fuck about technical copyright violations and I think the same is true for 90% of developers.