9 ms·

Seems this article completely misses the benefits of copilot. Its a massive step forward in productivity. For me, its about suggesting proper syntax across the

• lelandfe 4y ago
  > I don't buy the argument that the risk... is greater than the productivity gain of using copilot. How does your company's general counsel feel? This article is written at CTOs, not engineers.
  • jzelinskie 4y ago
    I suspect prohibiting Copilot will just become another checkbox on compliance security questionnaires. The fact that Kolide can detect it and that Kolide can feed compliance suites like Vanta or SecureFrame means the infrastructure is already there. It's not only your lawyers that want these guarantees, it's often your customers.
  • tevon 4y ago
    We don't have GC (too small), so caveat my take with the fact that I'm writing from a smaller companies perspective. May be different for a larger, value-preserving company who would face more scrutiny. That being said, I still find it extremely unlikely that there would be legal ramifications from using a product being pushed by one of the largest software companies in the world. Why go for a user and not Microsoft themselves?
    • fuckstick 4y ago
    • jen20 4y ago
      > Why go for a user and not Microsoft themselves? 1) the user likely doesn’t have the legal resources of Microsoft. 2) the user is the one committing the infringement. If Microsoft stood behind this they could offer to indemnify users against lawsuits relating to CoPilot usage, but they don’t.
    • tsimionescu 4y ago
      > That being said, I still find it extremely unlikely that there would be legal ramifications from using a product being pushed by one of the largest software companies in the world. Microsoft is explicitly saying it's your responsibility to check if the Copilot's output that you add to your codebase is not infringing on anyone's license. Also, it's actually a complex legal question if Copilot itself is infringing anyone's copyright. But, there is no doubt whatsoever that you don't have the right to distribute someone else's copyrighted code (without a license) just because it was produced by Copilot and not manually copied by you. And it is also very clear that Copilot can occasionally generate larger pieces of someone else's code. Edit: fixed typos
      • ninkendo 4y ago
        > Microsoft is explicitly saying it's your responsibility to check if the Copilot's output that you ads to your codebase is infringing on anyone's license. (Never used copilot) Wow, this is kinda shocking IMO. It kind of negates the entire value proposition of the tool. How am I supposed to find out whether a snippet is infringing? Should I paste it into google or something? Shouldn’t Copilot be the one to tell me if a snippet too-closely matches some existing code it learned from? If MS is indeed saying this, I feel like it’s something they put in the agreement to cover their own asses. There’s no way they’d really expect everyone to do this sort of thing. Moreover I don’t feel that’s a very strong defense MS could use in court if somebody decides to go after MS for making the tool that makes infringement so easy. It sounds like one of those “wink wink” types of clauses that they know full well nobody will follow.
• yamtaddle 4y ago
  Does Microsoft let their developers use it? Say, when working on Windows? If not, I'd say the very vendor of the software considers it radioactive, so I'll keep treating it that way, too.
  • aliqot 4y ago
    Is 'what would a microsft dev do' really the bar we want to live by, though?
    • patmorgan23 4y ago
      No but it's not a bad litmus test in this situation.
    • yamtaddle 4y ago
      In this case, yes, of course—I don't really get your objection. If their own legal counsel is advising them not to let their developers use their own product over legal concerns (and what else could be the reason?) that would be a pretty good argument against anyone else using it. Nb. I don't know whether they do or do not, in fact, let their developers use it.
    • patmcc 4y ago
      Say what you want about microsoft - they've got some of the best lawyers in the world on this kind of stuff. If they're not doing it they either don't trust the tech or don't trust the law.
• ed_balls 4y ago
  > It really does cut time by 10s of percent. I used it for about a month. It gave me a few false positive that really burned me - it's not worth the risk. Maybe future versions would be better.
  • tevon 4y ago
    What're the examples of false positives? Agreed it gets things wrong very frequently. But I've found it much easier to use its suggestion as another "input" to writing code.
  • lolinder 4y ago
    I've gotten plenty of false positives, but the mistakes turn up in testing and are pretty easy to spot when reviewing the code. Anything more subtle is likely to have been missed when written by hand anyway. What happened to burn you so badly?
• khalilravanna 4y ago
  This. If copilot suggests anything more than basic syntax or boilerplate I don’t use it. If it writes code I don’t understand or wouldn’t be able to write myself I won’t use it. Why? Because at the end of the day it’s my code. In what world is a good engineer submitting a PR for coworkers to look over that isn’t their code? If this is a real issue the solution is not banning yet another tool. It’s education. Teaching engineers how to properly understand code attribution and licenses.
  • echelon 4y ago
    Do you think we'll be writing software 200 years from now? 50? 25? I'll bet the people spinning cotton thought that would endure forever. (Sorry if my tone comes across as fervent. I'm excited to be displaced by this, because what follows is the stuff of dreams.)
    • Waterluvian 4y ago
      Whenever I watch Geordi and Data doing something in engineering, they’re often talking to the computer about constructing models and sims and such. To me this is the most ultimate form of declarative programming. Not that we will all be talking it out, but that we will explain in natural language what we’re after. It maximizes how much time we spend in the “problem understanding/solving” phase and minimizes the tedium of actually setting up the apparatus.
    • yonaguska 4y ago
      The invention of the cotton gin simply moved people from spinning cotton to picking cotton. And increased demand for slaves. I'm not excited to be displaced personally, but I'm also not really worried about being displaced. If displacement is inevitable, I don't see how the average programmer is going to leverage this for the "stuff of dreams". Usually, tech advancements result in a greater consolidation of wealth into the hands of those that already own capital. Recent tech is no exception. Yes, there has been a lot of wealth created for regular people, but we're still working 40+ hour weeks, and earnings have not matched the increase in productivity. What I am concerned about is that our field is becoming increasingly arcane magic for the younger generations, especially the masses that are being completely and utterly failed by the education system.
• LeifCarrotson 4y ago
  In Intellij or Visual Studio, syntax suggestion/tab completion are already great. Those technologies - which involve none of the legal risks of Copilot- are a massive step forward in productivity. Copilot does help extend these benefits to other languages that I occasionally dabble in, like Lua and embedded C, though it's clearly better in languages which are better represented in its dataset. I don't find the natural language comment to buggy algorithm part of Copilot to be particularly useful. I know some people asked to be able to write a "DoWhatIMean(), method, but programmers really only wanted that to auto-expand to "protected virtual void DoWhatIMean() {}" without having to wait 30 seconds to check for a compile error and see if it was protected void virtual or protected virtual void...
  • lolinder 4y ago
    > In Intellij or Visual Studio, syntax suggestion/tab completion are already great. Those technologies - which involve none of the legal risks of Copilot- are a massive step forward in productivity. Copilot does help extend these benefits to other languages that I occasionally dabble in, like Lua and embedded C, though it's clearly better in languages which are better represented in its dataset. Copilot is so much beyond regular autocomplete that it's playing a completely different game. I've been using it today while writing a recursive descent parser for a new toy language. I built out the AST in a separate module, and implemented a few productions and tests. For all subsequent tests, I'm able to name the test and ask Copilot to write it. It will write out a snippet in my custom language, the code to parse that snippet, and construct the AST that my parser should be producing, then assert that my output actually does match. It does this with about 80% accuracy. The result is that writing the tests to verify my parser takes easily 25% of the time that it has when I've done this by hand. In general, this is where I have found Copilot really shines: tests are important but boring and repetitive and so often don't get written. Copilot has a good enough understanding of your code to accurately produce tests based on the method name. So rather than slogging through copy paste for all the edge cases, you can just give it one example and let it extrapolate from there. It can even fill in gaps in your test coverage: give it a @Test/#[test] as input and it will frequently invent a test case that covers something that no test above it does.
• falcolas 4y ago
  > instead we review the code snippet to ensure its secure Doesn't matter. A developer's speed and test completeness and code quality matter not one whit when it comes to licensing. That 10x developer could mire the company in fines and code re-writes if they include copyrighted code, especially if it's not OSS.
• patrickthebold 4y ago
  I don't understand how it improves productivity _that_ much. Most of my time isn't actually spent on syntax but rather reading Hacker news and making irrelevant comments.
• terracatta 4y ago
  Using it in practice, the sheer quantity of suggestions (often one for every line) is fatiguing especially when 99% of the time they seem fine. I posit it becomes increasingly likely over large periods of time over many engineers that severe bug or security issue will be introduced via an AI provided suggestion. This risk to me is inherently different than the risk accepted that engineers will use bad code from Stack Overflow. Even Stack Overflow has social signals (upvotes, comments) that allow even an inexperienced engineer to quickly estimate quality. The amount of code used by engineers from Stack Overflow or blogs etc, is much smaller. Github Copilot is constantly recommending things and does not gives you any social signals lower experienced engineers can use to discern quality or correctness. Even worse, these are suggestions that are written by an AI that does not have any self-preserving motivations.
  • lolinder 4y ago
    Copilot's default behavior is stupid. You can turn off auto-suggest so that it only recommends something when you prompt it to, and that should really be the default behavior. This would encourage more thoughtful use of the tool, and solve the fatigue problem completely. In IntelliJ, disabling auto complete just requires clicking on the Copilot icon in the bottom and disabling it. Alt+\ will then trigger a prompt. I know there's a way to do this in VSCode as well, but I don't know how.
    • joenot443 4y ago
      > I know there's a way to do this in VSCode as well, but I don't know how. I dug into this a bit, since I want the same functionality, I found I needed an extension called settings-cycler (https://marketplace.visualstudio.com/items?itemName=hoovercj.vscode-settings-cycler https://marketplace.visualstudio.com/items?itemName=hoovercj...) which lets one flip the 'github.copilot.inlineSuggest.enable' setting on and off with a keybind. Not sure who's in charge of the Copilot extension for VS Code, but if you're out there reading this, the people definitely want this :) Otherwise of course, your tool rocks!
    • nprateem 4y ago
      I switched it off and never remember to bother using it. It's obvious why it's enabled by default.
• woah 4y ago
  I always get the impression that CoPilot critics have never actually used it to get any work done and are basing their criticism solely on a tweet they saw about the Quake square root copy pasta function
  • lelandfe 4y ago
    The article itself lists three other recent examples, two of which are clearly copyright infringement https://twitter.com/DocSparse/status/1581461734665367554 https://twitter.com/DocSparse/status/1581461734665367554 It is not a theoretical concern
    • falcolas 4y ago
      Oof. LGPL. That "time saver" will infect your entire codebase and open your company to sizable liability. Even if they're never sued, companies will do internal OSS scans to limit their risks which would catch this. The result would be (at minimum) a talking to for the dev who committed it, and developer time spent doing a clean room re-write.
      • charcircuit 4y ago
        >will infect your entire codebase No, it won't. It will only infect the resulting binary.
        • ColonelPhantom 4y ago
          And then I will download a trial of the resulting binary, and send a GPL compliance letter to the company. Unless they took care to use dynamic linking in the LGPL case, they are legally obliged to send me the source code under the license, so I can release it all as FOSS under that license.
          • charcircuit 4y ago
            Yes, they are legally obliged, but they can just tell you to pound sand and you can't do anything because you aren't the copyright holder.
• whateveracct 4y ago
  Physically coding is not at all where I spend the majority of my time at work or on personal projects. I exclusively use Haskell though, so maybe that has more to do with it. But why optimize a non-critical path?
• insanitybit 4y ago
  Indeed. I had to write a graph traversal iterator in Rust and Copilot wrote the entire thing for me. I could have written it myself, it would have looked similar, but it just... did it. It was trivially to test and verify correctness. That's minutes of work, maybe even 10 minutes, turned into seconds. That is huge. The risk here is extremely low. Who is going to sue consumers of Copilot? It makes no sense. They'll sue Microsoft and, in a decade, we'll see if the win or lose (IMO Microsoft will win, but it's not important).
  • boxed 4y ago
    Did it "write it for you"? Or did it "illegally copy it for you"? That's a very big difference. I'm not claiming that you can't get big productivity boosts by ripping off code like a crazy person. I bet you can! But should you?
    • cauefcr 4y ago
      Yes, software copyright and patents are a mistake.
      • thesuperbigfrog 4y ago
        >> Yes, software copyright and patents are a mistake. Richard Stallman would agree, but there are many of us who make a living writing software. Is software valuable enough that people will pay money for it? If you write original software that solves a problem, shouldn't you be able to license it how you want and profit from it? You are welcome to license the software you create how you want. Let me license the software I create how I want. If I dual license my software as GPL and commercial and GitHub Copilot reproduces my GPLed code without attribution and without the license, how it that not copyright violation?
        • rattlesnakedave 4y ago
          Do you find meaningful distinction between an individual reading your code and copying patterns vs an AI model doing the same?
• caseydm 4y ago
  I was a naysayer but find copilot makes me more productive. Especially at writing tests. It's very good at recognizing patterns in your own work, and completing an entire test based on the function name.
  • nsxwolf 4y ago
    I tried to do this and I couldn't figure it out. I never got the sense that it knew anything about the code I had written, just that it was dreaming stuff up from its training set.
• cromka 4y ago
  > Same thing with copilot, of course its going to write buggy/insecure code, but instead of going to stackoverflow for a snippet its suggested in my IDE and with my current context. copilot actually can have the benefit here of being able to retroactively mark some snippet as insecure, if it gets flagged as such by the moderators. Any user who used it could get automatic notification.