5 ms·

I have files open in VSCode that aren't committed to Git, and that I wouldn't be allowed to commit there even in private repos (customer data covered by GDPR).

I have files open in VSCode that aren't committed to Git, and that I wouldn't be allowed to commit there even in private repos (customer data covered by GDPR). In this context I think it's important to note the distinction between "Copilot for Individuals" and "Copilot for Business", because for twice the money you potentially get a lot more privacy: > What data does Copilot for Individuals collect? > [...] Depending on your preferred telemetry settings, GitHub Copilot may also collect and retain the following, collectively referred to as “code snippets”: source code that you are editing, related files and other files open in the same IDE or editor, URLs of repositories and files path. > What data does Copilot for Business collect? > [...] GitHub Copilot transmits snippets of your code from your IDE to GitHub to provide Suggestions to you. Code snippets data is only transmitted in real-time to return Suggestions, and is discarded once a Suggestion is returned. Copilot for Business does not retain any Code Snippets Data. https://github.com/features/copilot https://github.com/features/copilot

blibble 4y ago
unless that's directly in the contract, I'd not trust Microsoft to discard anything that might be of value in a training dataset at some point in the future say, if training is determined to be fair use
- SquareWheel 4y ago
  At the very least, it has its own privacy policy. https://docs.github.com/en/site-policy/privacy-policies/github-copilot-for-business-privacy-statement https://docs.github.com/en/site-policy/privacy-policies/gith...
joshspankit 4y ago
I’m now curious if the CoPilot feedback loop is going to end up with someone getting a suggestion for an existing API key.
- jachee 4y ago
  I would hope they’re training it to recognize and not suggest API keys. I would emphasize that as an explicitly important part of its initial definition-of-self/prompt.
noduerme 4y ago
This is frightening. I tested copilot when it first came out in beta, while I had client-owned docs, possibly containing API keys, open in the same IDE.
- CodexArcana 4y ago
  I wonder how long it will be until people's baseline assumption is that their shit is being used in this way... I genuinely don't understand how it isn't already.
  - noduerme 4y ago
    My baseline assumption would be that an IDE running on my own box wouldn't be uploading my code somewhere unless it was to my own repositories. Understanding that for Copilot to work, it needs to write prompts to GPT, I'd assume it wasn't uploading anything other than the tab it was working in. Not just, like, scanning my whole drive and uploading everything. That's insane. Maybe I rely too much on the community to red flag these things. I don't install questionable extensions. I wouldn't have tested copilot at all if it hadn't received such enthusiastic support (here, among other places). The fact that it isn't sandboxed to the document you're working on should make it an absolute malware pariah, and this is the first I'm hearing of it.

blibble 4y ago

unless that's directly in the contract, I'd not trust Microsoft to discard anything that might be of value in a training dataset at some point in the future say, if training is determined to be fair use

SquareWheel 4y ago
At the very least, it has its own privacy policy. https://docs.github.com/en/site-policy/privacy-policies/github-copilot-for-business-privacy-statement https://docs.github.com/en/site-policy/privacy-policies/gith...

joshspankit 4y ago

I’m now curious if the CoPilot feedback loop is going to end up with someone getting a suggestion for an existing API key.

jachee 4y ago
I would hope they’re training it to recognize and not suggest API keys. I would emphasize that as an explicitly important part of its initial definition-of-self/prompt.

noduerme 4y ago

This is frightening. I tested copilot when it first came out in beta, while I had client-owned docs, possibly containing API keys, open in the same IDE.

CodexArcana 4y ago
I wonder how long it will be until people's baseline assumption is that their shit is being used in this way... I genuinely don't understand how it isn't already.
- noduerme 4y ago
  My baseline assumption would be that an IDE running on my own box wouldn't be uploading my code somewhere unless it was to my own repositories. Understanding that for Copilot to work, it needs to write prompts to GPT, I'd assume it wasn't uploading anything other than the tab it was working in. Not just, like, scanning my whole drive and uploading everything. That's insane. Maybe I rely too much on the community to red flag these things. I don't install questionable extensions. I wouldn't have tested copilot at all if it hadn't received such enthusiastic support (here, among other places). The fact that it isn't sandboxed to the document you're working on should make it an absolute malware pariah, and this is the first I'm hearing of it.