5 ms·

> Copyright is not something that can be signed over by a terms-of-use change of a hosting provider Agreeing to GitHub's terms doesn't try to assign copyright

> Copyright is not something that can be signed over by a terms-of-use change of a hosting provider Agreeing to GitHub's terms doesn't try to assign copyright over your code, it grabs licence to use your code however they see fit which is¹ legally quite different. Of course the real fun comes if someone agrees to their terms then uploads some of my code which they have to right to assign the licence to GitHub for. What come-back do I get in that case if I don't want my stuff used that way? It seems odd to me that MS² who for many years strongly spoke against touching anything with the remotest whiff of GPL because of what it could legally do to your release requirements, are now more than happy to hoover up all the GPL covered code in GitHub and potentially mix it into their users' work output via copilot. ---- [1] in my not-at-all-legally-trained understanding [2] current owners of GitHub, for those not paying attention

judge2020 4y ago
It seems a lot of this stems from how the DMCA does not require that these hosting providers actually check for code ownership at submission, or maybe just how they don't have an explicit checkbox for "I affirm that I can license this code to GitHub" every time someone is uploading code. If it is shown that the license in the TOS is valid, the legal question might boil down to "is the TOS License broad enough to where nobody thought that it allowed their code to be used in for-profit ML models?"
- dspillett 4y ago
  A checkbox would make no difference in the case where the uploaded has not been granted the right to agree to such terms with respect to the code in question, leaving the matter in the same situation.
  - deleted 4y ago
    [deleted]
  - TAForObvReasons 4y ago
    I'd like to propose a "golden rule" test. If Copilot was truly not at risk of regurgitating large blocks of code verbatim, why didn't Microsoft train it on proprietary Microsoft code as well? Why was it limited to user-submitted code on GitHub? If there is any argument pointing to licensing or copyright or patents, it stands to reason those concerns would apply to any corpus of user-submitted code since users could easily misrepresent the licensing.
    - jacquesm 4y ago
      Precisely. I made this exact point a while ago, how come Microsoft didn't submit the source code to Windows as part of the training data, that is at least code that they can plausibly claim they have the rights to.
      - Dylan16807 4y ago
        There's a good point made over here: https://news.ycombinator.com/item?id=34282407 https://news.ycombinator.com/item?id=34282407 that it might accidentally spit out some kind of secret that is much smaller than a copyrightable piece of code. That's not a risk for code in public repositories.
    - bombolo 4y ago
      Perhaps you want to check the comment section here: https://lwn.net/Articles/914150/ https://lwn.net/Articles/914150/ user bluca works at microsoft, but i think their opinions are their own.
- toast0 4y ago
  > how the DMCA does not require that these hosting providers actually check for code ownership at submission How does one check who owns a work if the work does not include the authorship information? (or if the work has been altered to have incorrect authorship information)
  - judge2020 4y ago
    That's the tough part, and the technological infeasibility is probably why the DMCA has no such provision. Even for Video, only YouTube has come up with a system that is "mostly right" for "most content" they have to deal with, that being Content ID, and it takes a lot of horsepower and a lot of money to run (and it requires that every rights holder must upload their content to the service for scanning; quite a feat).
mch82 4y ago
How did you type the superscript footnotes? Edit: Wow, this is game changing. Markdown parsers need to implement superscript ascii character support! Lowercase ⁽ᵃ⁾ Uppercase ⁽ᴬ⁾ Numbers ⁽⁹⁹⁾
- jfk13 4y ago
  There are Unicode characters for superscripted digits; you can probably find them in some kind of character-map application, depending on the platform you're using.
- dspillett 4y ago
  They are available in most fonts with reasonable-or-better Unicode coverage (https://en.wikipedia.org/wiki/Unicode_subscripts_and_superscripts#Superscripts_and_subscripts_block https://en.wikipedia.org/wiki/Unicode_subscripts_and_supersc...). 1, 2 and 3 are available in ISO-8859-1 so can sometimes be used in 8-bit-only text, but I'd use them with care in that context. To type them easily you'll usually need composition (sometimes called chording) support. Some Linux (and other Unix) distributions still have this built in by default, though last time I used Linux for much desktop use it seemed to be fading from common availability, otherwise you'll have to hunt for another method. On Windows I use http://wincompose.info/ http://wincompose.info/ (here [atlgr][^][1] produces “¹”, for instance, in the default settings) which is useful for a number of other things (I first started using it for accented characters like á on a UK keyboard). If you have a keyboard with programmable function keys then you could use its customisation tool to map some of them to produce the super-script (or sub-script, or other) characters you commonly want. For less convenient typing, use your OS's Character Map or similar tool. On Android, unless you have a different keyboard in use which doesn't support this of course, long press on the number on the touch keyboard gives superscripts as an option.
  - sillysaurusx 4y ago
    > On Android, unless you have a different keyboard in use which doesn't support this of course, long press on the number on the touch keyboard gives superscripts as an option chucks iPad out the window We only get the standard shift character as an option. E.g. 1 shows !, 2 shows @, etc. I’d use superscripts all the time if it was on the keyboard. Anyone know if MacOS can do it? Other than pressing the weird globe key and searching.
jacquesm 4y ago
You would need to agree for every copyrighted work that you intend to allow them to use it for different purposes. Since GitHub can be completely invisible from the point of a contributor I highly doubt that clears the bar for such an invasive and irrevocable act.
mhitza 4y ago
> Agreeing to GitHub's terms doesn't try to assign copyright over your code, it grabs licence to use your code however they see fit which is¹ legally quite different. I disagree, IANAL, and I'm happy they are getting sued. The fact that they are are foremost a code hosting/collaboration company and the terms of service we all agreed to when creating our accounts was to have them host our code, and use it however they need in order to provide the service. The fact that they changed, post agreement, the service provided (from mere hosting/collaboration to feeding it into Copilot) should be an opt-in. I hope it's tested in court what the service is, because if you have a feature that (let's say) 1% of your users use, that's not the service, is it?
- bastardoperator 4y ago
  The service is displaying code... also I'm unaware of any TOS/EULA that cannot be amended or changed post agreement.
  - mhitza 4y ago
    Not really about disallowing amendments, but at least sending out a notice of the changing terms. Like you get with your privacy policy. I'm pretty sure I didn't receive one about them using my public (although unpopular) open source code into their NN mixer. Edit: Anyway a bit outside the point. It being, when your ever expanding set of services incorporate your ownership in ways unforseen when the agreement was made, opt-in would have been the agreeable aproach in my opinion. Even ignoring over the licensing woes, as that's something to be tested in courts with this lawsuit, and interesting to follow.
    - bastardoperator 4y ago
      They didn't change the terms, you can't expect privacy when you're out in public. I'm also curious how you're certain your project was used?
      - dspillett 4y ago
tremon 4y ago
it grabs licence to use your code however they see fit Not your code. Anyone's code that's uploaded to github by any third party. Under open source licenses, that's expressly permitted. However, it seems you're arguing that Github is not bound by the license under which they (and their users) acquired the code because of their TOS. How many projects on github are put there by the original copyright holders? Perhaps it's more than 50%, but it certainly is less than 100%. So where is github's legal paperwork that shows that they're only processing the code that's copyrighted by the user who uploaded it, or that they received permission from third-party rights holders that did not agree to their TOS?
- marcus_holmes 4y ago
  This is a good point. If I vendor my dependencies and upload to Github, does that give them a licence to use that code however they wish? It's interesting, because Github certainly have the right to set whatever terms they like on their website. The dependency authors certainly have the right to set the licence terms on their code, and that gives me the right to vendor their work and include it in my upload to Github. But I, obviously, don't have the right to agree to Github's terms on behalf of the dependency authors. I think the problem here is that Github assumes that everything I upload is my property, and that I have the ability to assign a licence to what I upload. This is not true for any project that vendors its dependencies.
- dspillett 4y ago
  > So where is github's legal paperwork that shows that they're only processing the code that's copyrighted by the user who uploaded it Under other circumstances they don't need it. But if CoPilot is creating a derivative work including parts of that code without including the licence terms or attribution (as required by many licences) things are far more grey, or possible full black. Some argue that the AI is unaware of the terms so can't be held responsible. Two possible counters for that: 1. it is the licence that gives you the right to use the copyrighted code, if you are unaware of the licence then why assume you have the righ tto use the code? 2. if I found some useful code that happened unbeknownst to me to be from MS, and used it in a way that I wasn't licensed to, and MS noticed, it is a pretty safe bet that they'd state ignorance of the copyright terms doesn't mean you can't be held to them. Or another angle: the tool is allowing, even encouraging, people to use code or other materials in a way that infringes copyright (again: you don't have the right to use the code under most licences unless you give correct attribution and such) – the very conditions often stated as reasons for trying to ban other tools. Plus of course the general argument: if this is entirely a non-issue, why is no Windows, Office, or SQL Server code in the training set? Surely they are great examples of how to do things to train the AI with?
deleted 4y ago
[deleted]

judge2020 4y ago

It seems a lot of this stems from how the DMCA does not require that these hosting providers actually check for code ownership at submission, or maybe just how they don't have an explicit checkbox for "I affirm that I can license this code to GitHub" every time someone is uploading code. If it is shown that the license in the TOS is valid, the legal question might boil down to "is the TOS License broad enough to where nobody thought that it allowed their code to be used in for-profit ML models?"

dspillett 4y ago
A checkbox would make no difference in the case where the uploaded has not been granted the right to agree to such terms with respect to the code in question, leaving the matter in the same situation.
- deleted 4y ago
  [deleted]
- TAForObvReasons 4y ago
  I'd like to propose a "golden rule" test. If Copilot was truly not at risk of regurgitating large blocks of code verbatim, why didn't Microsoft train it on proprietary Microsoft code as well? Why was it limited to user-submitted code on GitHub? If there is any argument pointing to licensing or copyright or patents, it stands to reason those concerns would apply to any corpus of user-submitted code since users could easily misrepresent the licensing.
  - jacquesm 4y ago
    Precisely. I made this exact point a while ago, how come Microsoft didn't submit the source code to Windows as part of the training data, that is at least code that they can plausibly claim they have the rights to.
    - Dylan16807 4y ago
      There's a good point made over here: https://news.ycombinator.com/item?id=34282407 https://news.ycombinator.com/item?id=34282407 that it might accidentally spit out some kind of secret that is much smaller than a copyrightable piece of code. That's not a risk for code in public repositories.
  - bombolo 4y ago
    Perhaps you want to check the comment section here: https://lwn.net/Articles/914150/ https://lwn.net/Articles/914150/ user bluca works at microsoft, but i think their opinions are their own.
toast0 4y ago
> how the DMCA does not require that these hosting providers actually check for code ownership at submission How does one check who owns a work if the work does not include the authorship information? (or if the work has been altered to have incorrect authorship information)
- judge2020 4y ago
  That's the tough part, and the technological infeasibility is probably why the DMCA has no such provision. Even for Video, only YouTube has come up with a system that is "mostly right" for "most content" they have to deal with, that being Content ID, and it takes a lot of horsepower and a lot of money to run (and it requires that every rights holder must upload their content to the service for scanning; quite a feat).

mch82 4y ago

How did you type the superscript footnotes? Edit: Wow, this is game changing. Markdown parsers need to implement superscript ascii character support! Lowercase ⁽ᵃ⁾ Uppercase ⁽ᴬ⁾ Numbers ⁽⁹⁹⁾

jfk13 4y ago
There are Unicode characters for superscripted digits; you can probably find them in some kind of character-map application, depending on the platform you're using.
dspillett 4y ago
They are available in most fonts with reasonable-or-better Unicode coverage (https://en.wikipedia.org/wiki/Unicode_subscripts_and_superscripts#Superscripts_and_subscripts_block https://en.wikipedia.org/wiki/Unicode_subscripts_and_supersc...). 1, 2 and 3 are available in ISO-8859-1 so can sometimes be used in 8-bit-only text, but I'd use them with care in that context. To type them easily you'll usually need composition (sometimes called chording) support. Some Linux (and other Unix) distributions still have this built in by default, though last time I used Linux for much desktop use it seemed to be fading from common availability, otherwise you'll have to hunt for another method. On Windows I use http://wincompose.info/ http://wincompose.info/ (here [atlgr][^][1] produces “¹”, for instance, in the default settings) which is useful for a number of other things (I first started using it for accented characters like á on a UK keyboard). If you have a keyboard with programmable function keys then you could use its customisation tool to map some of them to produce the super-script (or sub-script, or other) characters you commonly want. For less convenient typing, use your OS's Character Map or similar tool. On Android, unless you have a different keyboard in use which doesn't support this of course, long press on the number on the touch keyboard gives superscripts as an option.
- sillysaurusx 4y ago
  > On Android, unless you have a different keyboard in use which doesn't support this of course, long press on the number on the touch keyboard gives superscripts as an option chucks iPad out the window We only get the standard shift character as an option. E.g. 1 shows !, 2 shows @, etc. I’d use superscripts all the time if it was on the keyboard. Anyone know if MacOS can do it? Other than pressing the weird globe key and searching.

jacquesm 4y ago

You would need to agree for every copyrighted work that you intend to allow them to use it for different purposes. Since GitHub can be completely invisible from the point of a contributor I highly doubt that clears the bar for such an invasive and irrevocable act.

mhitza 4y ago

> Agreeing to GitHub's terms doesn't try to assign copyright over your code, it grabs licence to use your code however they see fit which is¹ legally quite different. I disagree, IANAL, and I'm happy they are getting sued. The fact that they are are foremost a code hosting/collaboration company and the terms of service we all agreed to when creating our accounts was to have them host our code, and use it however they need in order to provide the service. The fact that they changed, post agreement, the service provided (from mere hosting/collaboration to feeding it into Copilot) should be an opt-in. I hope it's tested in court what the service is, because if you have a feature that (let's say) 1% of your users use, that's not the service, is it?

bastardoperator 4y ago
The service is displaying code... also I'm unaware of any TOS/EULA that cannot be amended or changed post agreement.
- mhitza 4y ago
  Not really about disallowing amendments, but at least sending out a notice of the changing terms. Like you get with your privacy policy. I'm pretty sure I didn't receive one about them using my public (although unpopular) open source code into their NN mixer. Edit: Anyway a bit outside the point. It being, when your ever expanding set of services incorporate your ownership in ways unforseen when the agreement was made, opt-in would have been the agreeable aproach in my opinion. Even ignoring over the licensing woes, as that's something to be tested in courts with this lawsuit, and interesting to follow.
  - bastardoperator 4y ago
    They didn't change the terms, you can't expect privacy when you're out in public. I'm also curious how you're certain your project was used?
    - dspillett 4y ago

tremon 4y ago

it grabs licence to use your code however they see fit Not your code. Anyone's code that's uploaded to github by any third party. Under open source licenses, that's expressly permitted. However, it seems you're arguing that Github is not bound by the license under which they (and their users) acquired the code because of their TOS. How many projects on github are put there by the original copyright holders? Perhaps it's more than 50%, but it certainly is less than 100%. So where is github's legal paperwork that shows that they're only processing the code that's copyrighted by the user who uploaded it, or that they received permission from third-party rights holders that did not agree to their TOS?

marcus_holmes 4y ago
This is a good point. If I vendor my dependencies and upload to Github, does that give them a licence to use that code however they wish? It's interesting, because Github certainly have the right to set whatever terms they like on their website. The dependency authors certainly have the right to set the licence terms on their code, and that gives me the right to vendor their work and include it in my upload to Github. But I, obviously, don't have the right to agree to Github's terms on behalf of the dependency authors. I think the problem here is that Github assumes that everything I upload is my property, and that I have the ability to assign a licence to what I upload. This is not true for any project that vendors its dependencies.
dspillett 4y ago
> So where is github's legal paperwork that shows that they're only processing the code that's copyrighted by the user who uploaded it Under other circumstances they don't need it. But if CoPilot is creating a derivative work including parts of that code without including the licence terms or attribution (as required by many licences) things are far more grey, or possible full black. Some argue that the AI is unaware of the terms so can't be held responsible. Two possible counters for that: 1. it is the licence that gives you the right to use the copyrighted code, if you are unaware of the licence then why assume you have the righ tto use the code? 2. if I found some useful code that happened unbeknownst to me to be from MS, and used it in a way that I wasn't licensed to, and MS noticed, it is a pretty safe bet that they'd state ignorance of the copyright terms doesn't mean you can't be held to them. Or another angle: the tool is allowing, even encouraging, people to use code or other materials in a way that infringes copyright (again: you don't have the right to use the code under most licences unless you give correct attribution and such) – the very conditions often stated as reasons for trying to ban other tools. Plus of course the general argument: if this is entirely a non-issue, why is no Windows, Office, or SQL Server code in the training set? Surely they are great examples of how to do things to train the AI with?

deleted 4y ago

[deleted]