5 ms·

Hmmm. I'm interested in the GitHub ToS, which (if I understand correctly) basically says that GitHub and it's affiliates (MS) can use anything you post on GitHu

Hmmm. I'm interested in the GitHub ToS, which (if I understand correctly) basically says that GitHub and it's affiliates (MS) can use anything you post on GitHub to improve their service. What if I build an AGPL licenced service, using GitHub to coordinate development. According to the ToS MS could offer a version my service because I posted the code on GitHub, and they are using it to improve their service to me. According to my AGPL licence, they would need to share their source. So which takes precedence. The licence or the ToS?

david_allison 4y ago
As a follow-on, what if you're mirroring code which is under an AGPL license? Are you allowed to post it on GitHub if you can't grant those rights under the ToS due to the license of the code?
NicoJuicy 4y ago
Their service is hosting code, not writing code. That's why it's GitHub, not CodeScribe ( or something)
- Xylakant 4y ago
  It’s definitely more than just hosting code - GitHub offers issue/PR management, light weight project management, an online IDE for collaborative editing and CI services at least. Arguing that GitHub provides services that aim to improve developer/development team productivity is not a stretch. And arguing that ML-assisted development support is part of that definition isn’t particularly far out either.
  - frumper 4y ago
    They're also allowed to add new services anytime they'd like.
amarant 4y ago
Probably the ToS. You've granted GitHub specifically license to use your code under the terms of the ToS, they effectively have 2 licenses. They can therefore choose under which licence they want to use your code, and will choose the most permissive one, or the one they have the best understanding of: in this case the ToS. Other parties are not granted license under the ToS, and so will have to abide by the AGPL.
- World177 4y ago
  License takes precedence when you don’t own the copyright. ToS takes precedence when legally allowed and you do own the copyright.
  - khalt 4y ago
    ToS regularly gets thrown out in Europe if considered unfair. Much of OSS is written in the rest of the world. (Of course the GitHub ToS do not allow any CoPilot activities in the first place.)
    - Xylakant 4y ago
      That statement is dangerous. ToS often gets thrown out in business to consumer transactions where the business has a significantly better negotiation position (legal counsel,…) It’s a consumer protection mechanism. In business to business interactions, the chance of getting a ToS thrown out is much lower since it’s assumed that the playing field is much more level.
    - frumper 4y ago
      The blog post articulates how GitHub TOS does allow CoPilot.
rlpb 4y ago
Consider that you can post somebody else's code to GitHub, and that may be licensed AGPL (or anything else). In that case, somebody else is the copyright holder so clearly the ToS doesn't magically give GitHub any additional rights and the licence applies. The most they could do is transfer any liability back to you for posting it in breach of some term in their ToS. But that would be absurd since posting someone else's code, licensed under a common (eg. OSI-approved) license, is an established and normal use case for GitHub. If their ToS really did ban the posting of some AGPL code, they really ought to have pointed it out, and of course it'd render GitHub useless for hosting AGPL code. This would only apply when posting someone else's code. But of course you could always arrange that.
- robinsonb5 4y ago
  The ToS do give GitHub an indemnity against the consequences of that scenario - so if the actual copyright holder complains about copilot spitting out their code without proper attribution and license, they could indeed transfer to the liability to the uploader. (That scenario could apply to GPL and MIT code, too, not just AGPL.)
  - hnbad 4y ago
    FWIW I find it highly unlikely that (at least in my country, Germany) a court would agree that Microsoft/GitHub could hold you liable for uploading a vendored AGPL dependency in your public GitHub repository because Copilot used your repository as part of its training corpus and someone won a lawsuit against Copilot for reproducing the AGPL code without a license. Just because it's in the Terms of Use doesn't mean it can be upheld in court (or more specifically: in every court). If you uploaded your repository to a service advertising itself as a version control service, the service using your uploaded code to feed a commercial code generation product would likely be ruled as "surprising", which at least in Germany has been used by courts to dismiss claims of Terms of Use violations (e.g. when WhatsApp banned users for using third party apps). Replace "AGPL" with Old Microsoft's "public source" (i.e. proprietary code published without an open source license) for a more likely scenario.
VBprogrammer 4y ago
An interesting though experiment is how keen Microsoft would be to allow Copilot to be trained on the Office or Windows source code. If the output is truly free of copyright from its training materials then if not, why not?
- jansommer 4y ago
  It's likely already trained on Windows source code unless they have specifically excluded the repositories of the leaked Win 2000 code. Perhaps someone who's never going to contribute to ReactOS and Wine can verify?
- insanitybit 4y ago
  Why would they do that, regardless of whether the output could be restricted via Copyright or not? Also, this case isn't about copyright, as the lawyer clearly explains.
  - VBprogrammer 4y ago
    I was more talking about the general morality issue than the specifics of the case. Why wouldn't they? They are both large important codebases which they can do whatever they like with. If they are confident that Copilot does is akin to learning or at least something transformative then it makes perfect sense.
- IshKebab 4y ago
  The output isn't guaranteed to be free of copyright from its training materials. It just usually is. There have been clear demonstrations of it regurgitating code from the training set verbatim, which would of course still be covered by the original license. Microsoft isn't going to train Copilot on Windows code for the same reason it didn't train it on private repos: the code is private and they don't want to risk leaking private code. I imagine there would be no problem training it on e.g. the Unreal Engine code which is not open source but is available to read. The big practical issue is that there's no warning when Copilot produces code that might violate copyright, so you're taking a bit of a risk if you use it to generate huge chunks of code as-is. I imagine they are working on a solution to that though. It's not difficult conceptually.
lindenksv1 4y ago
OP here. If you own the copyright to a work, you can license it in any way you like. You can offer it to some people under a commercial license and to other people under an open source license. Many entities practices dual (or tri or whatever) licensing. When you post things on GitHub, you are essentially dual licensing your work. You're providing it under a very broad license to GitHub and you are providing it under an OSS license (or whatever you like) to other GitHub users. Neither license takes precedence. One license applies to one group of people and the other license applies to the other group of people. This is very similar to what happens when you sign a contributor agreement before contributing code to an open source project. When you sign the contributor agreement, you're granting a very broad license to your work to the project maintainers. They can then license your work out under any license they want. But likewise, because you are not granting them an exclusive license, you're free to put your contribution license out into the world under any license of your choosing separate and apart from the project that you contributed it to. Technically, I think the scenario you're describing with AGPL code may well be possible and legal. But practically, I think people would stop using GitHub if they felt that doing so would lead to GitHub/Microsoft undercutting their projects, stealing their customers, or essentially stripping the project of any AGPL obligations. I think that from a business perspective, they're really gambling on the idea that developers will see Copilot as a big boon rather than a value suck. Time will tell whether their gamble has paid off.

david_allison 4y ago

As a follow-on, what if you're mirroring code which is under an AGPL license? Are you allowed to post it on GitHub if you can't grant those rights under the ToS due to the license of the code?

NicoJuicy 4y ago

Their service is hosting code, not writing code. That's why it's GitHub, not CodeScribe ( or something)

Xylakant 4y ago
It’s definitely more than just hosting code - GitHub offers issue/PR management, light weight project management, an online IDE for collaborative editing and CI services at least. Arguing that GitHub provides services that aim to improve developer/development team productivity is not a stretch. And arguing that ML-assisted development support is part of that definition isn’t particularly far out either.
- frumper 4y ago
  They're also allowed to add new services anytime they'd like.

amarant 4y ago

Probably the ToS. You've granted GitHub specifically license to use your code under the terms of the ToS, they effectively have 2 licenses. They can therefore choose under which licence they want to use your code, and will choose the most permissive one, or the one they have the best understanding of: in this case the ToS. Other parties are not granted license under the ToS, and so will have to abide by the AGPL.

World177 4y ago
License takes precedence when you don’t own the copyright. ToS takes precedence when legally allowed and you do own the copyright.
- khalt 4y ago
  ToS regularly gets thrown out in Europe if considered unfair. Much of OSS is written in the rest of the world. (Of course the GitHub ToS do not allow any CoPilot activities in the first place.)
  - Xylakant 4y ago
    That statement is dangerous. ToS often gets thrown out in business to consumer transactions where the business has a significantly better negotiation position (legal counsel,…) It’s a consumer protection mechanism. In business to business interactions, the chance of getting a ToS thrown out is much lower since it’s assumed that the playing field is much more level.
  - frumper 4y ago
    The blog post articulates how GitHub TOS does allow CoPilot.

rlpb 4y ago

Consider that you can post somebody else's code to GitHub, and that may be licensed AGPL (or anything else). In that case, somebody else is the copyright holder so clearly the ToS doesn't magically give GitHub any additional rights and the licence applies. The most they could do is transfer any liability back to you for posting it in breach of some term in their ToS. But that would be absurd since posting someone else's code, licensed under a common (eg. OSI-approved) license, is an established and normal use case for GitHub. If their ToS really did ban the posting of some AGPL code, they really ought to have pointed it out, and of course it'd render GitHub useless for hosting AGPL code. This would only apply when posting someone else's code. But of course you could always arrange that.

robinsonb5 4y ago
The ToS do give GitHub an indemnity against the consequences of that scenario - so if the actual copyright holder complains about copilot spitting out their code without proper attribution and license, they could indeed transfer to the liability to the uploader. (That scenario could apply to GPL and MIT code, too, not just AGPL.)
- hnbad 4y ago
  FWIW I find it highly unlikely that (at least in my country, Germany) a court would agree that Microsoft/GitHub could hold you liable for uploading a vendored AGPL dependency in your public GitHub repository because Copilot used your repository as part of its training corpus and someone won a lawsuit against Copilot for reproducing the AGPL code without a license. Just because it's in the Terms of Use doesn't mean it can be upheld in court (or more specifically: in every court). If you uploaded your repository to a service advertising itself as a version control service, the service using your uploaded code to feed a commercial code generation product would likely be ruled as "surprising", which at least in Germany has been used by courts to dismiss claims of Terms of Use violations (e.g. when WhatsApp banned users for using third party apps). Replace "AGPL" with Old Microsoft's "public source" (i.e. proprietary code published without an open source license) for a more likely scenario.

VBprogrammer 4y ago

An interesting though experiment is how keen Microsoft would be to allow Copilot to be trained on the Office or Windows source code. If the output is truly free of copyright from its training materials then if not, why not?

jansommer 4y ago
It's likely already trained on Windows source code unless they have specifically excluded the repositories of the leaked Win 2000 code. Perhaps someone who's never going to contribute to ReactOS and Wine can verify?
insanitybit 4y ago
Why would they do that, regardless of whether the output could be restricted via Copyright or not? Also, this case isn't about copyright, as the lawyer clearly explains.
- VBprogrammer 4y ago
  I was more talking about the general morality issue than the specifics of the case. Why wouldn't they? They are both large important codebases which they can do whatever they like with. If they are confident that Copilot does is akin to learning or at least something transformative then it makes perfect sense.
IshKebab 4y ago
The output isn't guaranteed to be free of copyright from its training materials. It just usually is. There have been clear demonstrations of it regurgitating code from the training set verbatim, which would of course still be covered by the original license. Microsoft isn't going to train Copilot on Windows code for the same reason it didn't train it on private repos: the code is private and they don't want to risk leaking private code. I imagine there would be no problem training it on e.g. the Unreal Engine code which is not open source but is available to read. The big practical issue is that there's no warning when Copilot produces code that might violate copyright, so you're taking a bit of a risk if you use it to generate huge chunks of code as-is. I imagine they are working on a solution to that though. It's not difficult conceptually.

lindenksv1 4y ago

OP here. If you own the copyright to a work, you can license it in any way you like. You can offer it to some people under a commercial license and to other people under an open source license. Many entities practices dual (or tri or whatever) licensing. When you post things on GitHub, you are essentially dual licensing your work. You're providing it under a very broad license to GitHub and you are providing it under an OSS license (or whatever you like) to other GitHub users. Neither license takes precedence. One license applies to one group of people and the other license applies to the other group of people. This is very similar to what happens when you sign a contributor agreement before contributing code to an open source project. When you sign the contributor agreement, you're granting a very broad license to your work to the project maintainers. They can then license your work out under any license they want. But likewise, because you are not granting them an exclusive license, you're free to put your contribution license out into the world under any license of your choosing separate and apart from the project that you contributed it to. Technically, I think the scenario you're describing with AGPL code may well be possible and legal. But practically, I think people would stop using GitHub if they felt that doing so would lead to GitHub/Microsoft undercutting their projects, stealing their customers, or essentially stripping the project of any AGPL obligations. I think that from a business perspective, they're really gambling on the idea that developers will see Copilot as a big boon rather than a value suck. Time will tell whether their gamble has paid off.