5 ms·

> Copyright is not something that can be signed over by a terms-of-use change of a hosting provider, I mean, it's obvious that uploading code requires you lice

by judge2020 4y ago

> Copyright is not something that can be signed over by a terms-of-use change of a hosting provider, I mean, it's obvious that uploading code requires you license the hosting provider a license to host it (which is not singing over copyright); although feel free to argue that the license doesn't or shouldn't extend to CoPilot usage.

jacquesm 4y ago
Copyright is pretty complex legal material but the one thing that stands out for me is that you receive it upon creation and it requires a positive act on your part to relinquish it.
Eleison23 4y ago
That's not obvious, because you don't necessarily own the code you're uploading. I can upload any sort of MIT-licensed, BSD-licensed, Apache-licensed, Creative-Commons-licensed, or GNU-copylefted works I want, anywhere within reason and compatible with those licenses, but if I didn't write them then I don't have the legal right to relicense, grant exclusive or restricted license to any specified parties. So in a way this would void parts of many TOS agreements where you do relicense your User-Generated Content. If we're uploading memes to Facebook, they're gonna have to work out license terms with the copyright holders, not the uploaders.
- judge2020 4y ago
  Uploading someone else's code without permissions is, in itself, copyright infringement. Just like you can't take someone else's code and license it to GitHub without the copyright holder's permission, you can't take images off of someone's website and sell/license them to Getty Images for profit.
  - pron 4y ago
    I'm not sure that's the case if the repo is private and the code is not shared/disseminated to others. If you buy a book, you are not allowed to distribute copies of it, but you can loan it or sell your copy, or store it wherever you like. Copilot does allegedly distribute copies of code that it doesn't have the copyright to.
  - ClumsyPilot 4y ago
    > Uploading someone else's code without permissions is, in itself, copyright infringement Suppose person A comitted a crime, that does not mean you are now allowed to profit from someone else's crime
    - judge2020 4y ago
      But imagine Getty Images sells the stolen photo 10,000 times. They had no idea it was illegally stolen and fraudulently passed off as the fraudster's own work. If they get sued for infringement, they can just sue the actual fraudster for damages. Same will be for GitHub: if people really didn't have the legal authority to bind someone else's code to GitHub's TOS, then GitHub can go after the $x million of users that have uploaded code they shouldn't have.
      - bryanrasmussen 4y ago
        >GitHub can go after the $x million of users that have uploaded code they shouldn't have. Ok, but can they go after them in an efficient manner that doesn't end up costing more than it's worth?
      - ClumsyPilot 4y ago
        > They had no idea it was illegally stolen and fraudulently passed off Thats doesnt mean. Getty can keep the money
belorn 4y ago
With creative common and GPL there is a fairly common practice that work include multiple authors and rights holders. When a single user uploads such work to a hosting provider, the permission given to the provider will be limited to the permission that the user had. They can't give out permissions that they themselves do not have. It is a similar case when a single user uploads a movie or game to a pirate torrent site. The site can have a terms-of-use that gives a license to the hosting provider, but naturally the users who upload the content might not have the permission to grant anything to the hosting provider. Depending on how much the hosting provider is or should be aware, hosting the content can still be illegal.
- judge2020 4y ago
  > They can't give out permissions that they themselves do not have. Then, chances are, it's technically illegal to upload those other contributors' code, although if that code is contributed via GitHub itself then the code in the pull request has already been licensed to GH. It boils down to copyright/DMCA not requiring that hosting providers ensure the code people say they have the rights to is valid at submission, so GitHub now has tons of examples where people themselves lied about the permission when they uploaded code that wasn't theirs, and this will probably be a valid legal defense, at least only for the argument of "does GitHub have the right to use the source in their ML model" (it might really boil down to "are GH's terms vague enough to where nobody thought they the license included the ability to train artificial intelligence").
  - tzs 4y ago
    "The person who uploaded the code lied about their permissions" won't be a valid defense in a copyright lawsuit by the actual copyright owner, at least in the case where there is no other copy of that code also on GitHub that was uploaded by the copyright holder. In the US what it will be is good evidence to support a claim by GitHub that they were an "innocent infringer"--someone who did not know they were infringing and had no reason to believe that they were. What that does is in the case where the plaintiff seeks statutory damages (which they almost certainly will¹) is lower the lower limit. Statutory damages are normally $750-30000 (amount determined by the court). If a defendant proves they are an innocent infringer that lower limit drops to $200. If the plaintiff can prove that the infringement was "willful" the upper limit goes up to $150000. Statutory damages are per work infringed, not per infringement, so we aren't talking $200 or so multiplied by the number of copies GitHub distributed. We are talking of a likely award of $200 or so total (plus maybe attorney fees). ¹It is usually way too hard to determine actual monetary damages in cases like this, and actual damages are likely to be quite low anyway, so plaintiffs almost certainly will go for statutory damages.
smoldesu 4y ago
You're right, but GitHub's TOS doesn't (or at least shouldn't) change the conditions of the original license. You're giving GitHub a copy of the source code, not the ability to dictate your license for you. There's certainly a lot of legal ambiguity in the copyright sense, but one thing seems clear: Microsoft trained Copilot on code they weren't certain they could use.
- judge2020 4y ago
  Technically the GitHub TOS is in itself a license; much like how you can dual-license code, uploading to GitHub is its own license grant separate from the license of the code you're granting to anyone who wants to use it for their own purposes. LICENSE.txt/md is not the only way to grant access to code you write.
  - yladiz 4y ago
    I’m skeptical of this interpretation since it seems to imply that you could upload copyrighted code and now GitHub has a license to do whatever they want with the code, which is obviously not true. An example would be someone uploading Microsoft Windows source code illegally, and GitHub can’t just use it because it was uploaded to their service. I would argue that this then extends to CoPilot, in that just because they have a license to host it, they don’t have a license to do whatever they want with it.
    - judge2020 4y ago
      The license is quite limited, but does include "improving the service over time" which might be their key to CoPilot being okayed by their legal team, at least originally: > 4. License Grant to Us We need the legal right to do things like host Your Content, publish it, and share it. You grant us and our legal successors the right to store, archive, parse, and display Your Content, and make incidental copies, as necessary to provide the Service, including improving the Service over time. This license includes the right to do things like copy it to our database and make backups; show it to you and other users; parse it into a search index or otherwise analyze it on our servers; share it with other users; and perform it, in case Your Content is something like music or video. https://docs.github.com/en/site-policy/github-terms/github-terms-of-service#3-ownership-of-content-right-to-post-and-license-grants https://docs.github.com/en/site-policy/github-terms/github-t...
Macha 4y ago
There's also code that github themselves uploaded which they were permitted to do under the open source licenses in the mirrors user. I know some of these repos have since been moved as the authors became active on github (e.g. mirrors/linux is now torvalds/linux, indicating Linus has control of it even if it's a read only mirror), but I'm sure there's a few of them remaining.
PeterisP 4y ago
The legal argument made in this court case is that there is a substantial difference as redistributing the source as-is (keeping all the attached copyright, attribution and license notifications) is explicitly permitted by every open source license; but in the CoPilot usage the attribution gets removed, which is something which even the repository owner (assuming they're not the only author/copyright holder) does not have the right to do themselves, much less grant permission to others.
anothernewdude 4y ago
It doesn't actually. You can upload anything to github. The website doesn't stop you at all, even if you don't have the ability to grant anything to Github at all.

jacquesm 4y ago

Copyright is pretty complex legal material but the one thing that stands out for me is that you receive it upon creation and it requires a positive act on your part to relinquish it.

Eleison23 4y ago

That's not obvious, because you don't necessarily own the code you're uploading. I can upload any sort of MIT-licensed, BSD-licensed, Apache-licensed, Creative-Commons-licensed, or GNU-copylefted works I want, anywhere within reason and compatible with those licenses, but if I didn't write them then I don't have the legal right to relicense, grant exclusive or restricted license to any specified parties. So in a way this would void parts of many TOS agreements where you do relicense your User-Generated Content. If we're uploading memes to Facebook, they're gonna have to work out license terms with the copyright holders, not the uploaders.

judge2020 4y ago
Uploading someone else's code without permissions is, in itself, copyright infringement. Just like you can't take someone else's code and license it to GitHub without the copyright holder's permission, you can't take images off of someone's website and sell/license them to Getty Images for profit.
- pron 4y ago
  I'm not sure that's the case if the repo is private and the code is not shared/disseminated to others. If you buy a book, you are not allowed to distribute copies of it, but you can loan it or sell your copy, or store it wherever you like. Copilot does allegedly distribute copies of code that it doesn't have the copyright to.
- ClumsyPilot 4y ago
  > Uploading someone else's code without permissions is, in itself, copyright infringement Suppose person A comitted a crime, that does not mean you are now allowed to profit from someone else's crime
  - judge2020 4y ago
    But imagine Getty Images sells the stolen photo 10,000 times. They had no idea it was illegally stolen and fraudulently passed off as the fraudster's own work. If they get sued for infringement, they can just sue the actual fraudster for damages. Same will be for GitHub: if people really didn't have the legal authority to bind someone else's code to GitHub's TOS, then GitHub can go after the $x million of users that have uploaded code they shouldn't have.
    - bryanrasmussen 4y ago
      >GitHub can go after the $x million of users that have uploaded code they shouldn't have. Ok, but can they go after them in an efficient manner that doesn't end up costing more than it's worth?
    - ClumsyPilot 4y ago
      > They had no idea it was illegally stolen and fraudulently passed off Thats doesnt mean. Getty can keep the money

belorn 4y ago

With creative common and GPL there is a fairly common practice that work include multiple authors and rights holders. When a single user uploads such work to a hosting provider, the permission given to the provider will be limited to the permission that the user had. They can't give out permissions that they themselves do not have. It is a similar case when a single user uploads a movie or game to a pirate torrent site. The site can have a terms-of-use that gives a license to the hosting provider, but naturally the users who upload the content might not have the permission to grant anything to the hosting provider. Depending on how much the hosting provider is or should be aware, hosting the content can still be illegal.

judge2020 4y ago
> They can't give out permissions that they themselves do not have. Then, chances are, it's technically illegal to upload those other contributors' code, although if that code is contributed via GitHub itself then the code in the pull request has already been licensed to GH. It boils down to copyright/DMCA not requiring that hosting providers ensure the code people say they have the rights to is valid at submission, so GitHub now has tons of examples where people themselves lied about the permission when they uploaded code that wasn't theirs, and this will probably be a valid legal defense, at least only for the argument of "does GitHub have the right to use the source in their ML model" (it might really boil down to "are GH's terms vague enough to where nobody thought they the license included the ability to train artificial intelligence").
- tzs 4y ago
  "The person who uploaded the code lied about their permissions" won't be a valid defense in a copyright lawsuit by the actual copyright owner, at least in the case where there is no other copy of that code also on GitHub that was uploaded by the copyright holder. In the US what it will be is good evidence to support a claim by GitHub that they were an "innocent infringer"--someone who did not know they were infringing and had no reason to believe that they were. What that does is in the case where the plaintiff seeks statutory damages (which they almost certainly will¹) is lower the lower limit. Statutory damages are normally $750-30000 (amount determined by the court). If a defendant proves they are an innocent infringer that lower limit drops to $200. If the plaintiff can prove that the infringement was "willful" the upper limit goes up to $150000. Statutory damages are per work infringed, not per infringement, so we aren't talking $200 or so multiplied by the number of copies GitHub distributed. We are talking of a likely award of $200 or so total (plus maybe attorney fees). ¹It is usually way too hard to determine actual monetary damages in cases like this, and actual damages are likely to be quite low anyway, so plaintiffs almost certainly will go for statutory damages.

smoldesu 4y ago

You're right, but GitHub's TOS doesn't (or at least shouldn't) change the conditions of the original license. You're giving GitHub a copy of the source code, not the ability to dictate your license for you. There's certainly a lot of legal ambiguity in the copyright sense, but one thing seems clear: Microsoft trained Copilot on code they weren't certain they could use.

judge2020 4y ago
Technically the GitHub TOS is in itself a license; much like how you can dual-license code, uploading to GitHub is its own license grant separate from the license of the code you're granting to anyone who wants to use it for their own purposes. LICENSE.txt/md is not the only way to grant access to code you write.
- yladiz 4y ago
  I’m skeptical of this interpretation since it seems to imply that you could upload copyrighted code and now GitHub has a license to do whatever they want with the code, which is obviously not true. An example would be someone uploading Microsoft Windows source code illegally, and GitHub can’t just use it because it was uploaded to their service. I would argue that this then extends to CoPilot, in that just because they have a license to host it, they don’t have a license to do whatever they want with it.
  - judge2020 4y ago
    The license is quite limited, but does include "improving the service over time" which might be their key to CoPilot being okayed by their legal team, at least originally: > 4. License Grant to Us We need the legal right to do things like host Your Content, publish it, and share it. You grant us and our legal successors the right to store, archive, parse, and display Your Content, and make incidental copies, as necessary to provide the Service, including improving the Service over time. This license includes the right to do things like copy it to our database and make backups; show it to you and other users; parse it into a search index or otherwise analyze it on our servers; share it with other users; and perform it, in case Your Content is something like music or video. https://docs.github.com/en/site-policy/github-terms/github-terms-of-service#3-ownership-of-content-right-to-post-and-license-grants https://docs.github.com/en/site-policy/github-terms/github-t...

Macha 4y ago

There's also code that github themselves uploaded which they were permitted to do under the open source licenses in the mirrors user. I know some of these repos have since been moved as the authors became active on github (e.g. mirrors/linux is now torvalds/linux, indicating Linus has control of it even if it's a read only mirror), but I'm sure there's a few of them remaining.

PeterisP 4y ago

The legal argument made in this court case is that there is a substantial difference as redistributing the source as-is (keeping all the attached copyright, attribution and license notifications) is explicitly permitted by every open source license; but in the CoPilot usage the attribution gets removed, which is something which even the repository owner (assuming they're not the only author/copyright holder) does not have the right to do themselves, much less grant permission to others.

anothernewdude 4y ago

It doesn't actually. You can upload anything to github. The website doesn't stop you at all, even if you don't have the ability to grant anything to Github at all.