13 ms·
About GitHub’s use of your data
- sheepscreek 3y agoYou’ve taken this out of context. This was specifically referring to “scanning” or vulnerability scanning. I doubt it will stand the test of law if someone uses them for their “private” data being used to train AI.
- isingle 3y agoConcerned about this privacy policy, every user should not upload their private data to GitHub, even though this repository is set to private. GitHub should only host public repository or unrelated data.
- roboben 3y ago[flagged]
- andrewstuart 3y ago[flagged]
- kkoncevicius 3y ago> Please don't comment about the voting on comments. It never does any good, and it makes boring reading. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- politelemon 3y agoAlso > Eschew flamebait. Avoid generic tangents. Omit internet tropes. OP is also in poor taste
- rany_ 3y ago> Private repository data is scanned by machine and never read by GitHub staff. Human eyes will never see the contents of your private repositories, except as described in our Terms of Service. > > Your individual personal or repository data will not be shared with third parties. We may share aggregate data learned from our analysis with our partners. That's very concerning wording... I guess even private repositories are being fed into AI, at least that's what that policy explicitly allows.
- Shrezzing 3y agoEverything referenced in this webpage refers only to public data, or private data where a user has enabled the dependency graph >data from public repositories, and also... data from private repositories when a repository's owner has chosen to share the data with GitHub by enabling the dependency graph So if you don't enable the Dep Graph feature, your private code is treated according to the standard terms of service.
- rany_ 3y agoSo give them an inch (Dep Graph feature) and they'll take a mile (loss of confidentiality); that's not any better...
- hobofan 3y ago> So give them an inch You are not giving them an inch, you are receiving an inch (and a whole lot more). And if you don't want that, you can turn the feature off. What would you want instead? Them not offering the feature at all?
- rany_ 3y agoI'd like them to limit the scope of the data use to dependency graph ONLY and for it to not be stored. I swear this goes without saying.. but these blanket self granted permissions on the part of GitHub are a serious breach of trust. They don't need this to provide the dependency graph service.
- pachico 3y agoWhen then product is free...
- bloqs 3y agoThis is the only answer
- virtue3 3y agoexcept you can't get free private repos anymore... oh wait... Yeah they give you a lot more on the free account now, don't they? :/
- wongarsu 3y agoSo naturally repositories in Github Enterprise accounts are excluded?
- tap-snap-or-nap 3y agoit depends on the terms of agreement.
- Zambyte 3y agoWhen the software is propriety...
- mrits 3y agoGithub is a great service. However, it is a bit like being in a happy marriage but knowing your spouse is going to murder you in a few years.
- sph 3y agoAnd is currently cheating on you with "third-party analysis and tracking partners."
- falcor84 3y agoThat's hyperbole. I think it's closer to knowing that your spouse may leave you and expose your nudes to the world. It's still not a comforting thought, but there's no risk to your (or your project's) existence.
- aloisdg 3y agoWell if the USA arbitrary decide that your country suck for them, there is a risk to your project existence.
- jjgreen 3y agoMore like a happy marriage where your partner drugs your bedtime cocoa and then grates you feet with a cheese-grater for some reason that you really don't want to know.
- rizky05 3y ago[dead]
- tap-snap-or-nap 3y agoyou know that in the future your baby is going to be taken away
- andsoitis 3y ago“…except as described in our Terms of Service.” according to that paragraph
- rany_ 3y agoYes, but that is the standard Terms of Service which applies to public repositories as well. The terms appear the same as the public repositories; there doesn't appear to be a carve out.
- madsbuch 3y agoaggregate data is getting a whole new meaning these days. traditionally I would have juxtaposed aggregate and privacy preserving, though I think in the lights of LLMs, that is not reasonable anymore. soon a zip file is also "aggregate" data.
- az226 3y agoNo chance GitHub is anywhere near using private repo source code to train the public GitHub Copilot. On the other hand, getting a personalized Copilot within your org is something entirely different and probably will be out in the not too distant future.
- JonChesterfield 3y agoHow do you arrive at that conclusion? They could feed private repos into copilot. It might make copilot better. It's certainly useful to automate extraction of IP with plausible deniability. If someone notices, they can claim "oh that must be in a public dataset as well".
- jtode 3y agoHave we all settled on what's gonna be the self-hosted version yet?
- Zambyte 3y agoGit
- jtode 3y agoGit has a web server?
- Zambyte 3y agoYes: https://git-scm.com/book/en/v2/Git-on-the-Server-GitWeb https://git-scm.com/book/en/v2/Git-on-the-Server-GitWeb
- jtode 3y agoI seriously had no idea lol. What a thing that is.
- Zambyte 3y agoI was kind of making a joke that Git is much more important than any individual forge software though, because Git is a decentralized protocol. Any forge software you feel like running will work. I personally don't use gitweb, but I do use cgit. It has all the features I care about (making my git repos available to view on the web). If you find that you want different features, you should use a forge that provides those features.
- jtode 3y agoThat plus reasonable security (my code isn't worth money) is all I really want...
- ostenning 3y agoWhy is this setting hidden behind the “Dependency Graph” feature? GitHub should be making this blatantly clear and transparent for users, rather than using Facebook-esk cloak-and-dagger language.
- nottorp 3y agoJust buggy machine eyes?
- andrewstuart 3y agoI've worked at companies that store all their source code in private github repos. And I think - is github impossible to hack? Will the day come when github is wide open and all that secret source gets drained out?
- bob1029 3y agoI posted about this a week or so ago. Someone could come steal all of our "secret source" and still have absolutely no advantage over us. If the value of your business is entirely in the source code, you need to seriously re-investigate what exactly it is that you are doing. AAA gaming and Windows codebases have been leaked. In some cases partially, in others comprehensively. At no point do I recall Valve or Microsoft seeing adverse competition or other meaningful impact from this event. Legal teams were certainly up in arms, but in terms that investors would care about nothing really happens. Turns out, you need more than source code to run a business. You need customers, markets & relationships. You need trust. You need a sales team. That's the real thing you should be worried about being stolen. Your goddamn sales team. Obviously the developers would be worried about the code base (and they should be) but at scale it's not the end of the world if some code gets out. Losing your best sales person & all their prospects would be much more catastrophic for your business.
- hungryforcodes 3y agoThese are well established business with deeply developed ecosystems (monopolies?) and market traction behind them. Smaller players, especially threats to OpenAI and whoever else could easily get squashed in such a scenario.
- not_alexb 3y agoYeah, it totally makes sense to compare gigantic companies to all other ones. Let's also extrapolate what should happen to a subcompact in a collision by looking at what happens to a tank in those same circumstances.
- denton-scratch 3y ago> If the value of your business is entirely in the source code, you need to seriously re-investigate what exactly it is that you are doing. Most software companies' "value" (liquidatable assets) depend almost exclusively on their IP, as embodied in their patent portfolio and their source-code. Their people may be more valuable, but people can't be traded or used as collateral.
- hardware2win 3y agoYou guys realize that GitHub provides secret scannings and supply chain (libs) issues warnings? How do you think they do that? Crystal ball? Not everything is about AI
- dijit 3y agoI think this is probably true, despite critical software being leaked, that seems related to manually inputting data to chatGPT: https://mashable.com/article/samsung-chatgpt-leak-details https://mashable.com/article/samsung-chatgpt-leak-details there is no current reason to believe that copilot or ChatGPT are trained on private repositories; however this agreement does permit them to do so. The concern is, why not? you have an enormous corpus of professional grade software just sitting there, one bit flip away from access; and you are even permitted (to the letter of the law) to flip that bit- why wouldn't you, eventually?
- torginus 3y agoIn the intelligence business, they talk about capabilities, not intents.
- deleted 3y ago[deleted]
- bionade24 3y ago> The concern is, why not? They need to reliably filter secrets or they are in trouble once Copilot suggests them.
- dijit 3y agoThey already scan for secrets so that they can warn you that you checked them in.
- simonw 3y ago"why wouldn't you, eventually?" Because if people found out you were doing that you would lose vast numbers of paying customers, which would cost you a lot of money.
- slimebot80 3y agoOK correct me if I am wrong, but Git is designed to not need a Hub, right? We've maybe been lazy with how we centralise repos in this way. But whatever GitHub is doing, Vervel/AWS/CF can also do when you deploy, and they maybe already do to detect bad actors?
- nocontextpls 3y ago[dead]
- can16358p 3y agoGit doesn't need a hub. But a hub is convenient enough to use compared to self-hosting. Just like many of us here know how to freely download pirated torrent mp3s safely, though pay for Spotify/Apple Music as its more convenient (also legal, but doubt many care about that especially here).
- Havoc 3y agoGitHub monoculture is becoming a major issue for the health of the entire software industry
- politelemon 3y agoThe monoculture will always exist, humans tend to flock together. See also twitter, Reddit.
- dontupvoteme 3y agoOne wonders if there's a shadow field dedicated to coaxing these datasets which "will never show up, don't worry" out of LLMs. I accidentally got a few hundred fake(?) names out of the codex models because I asked it to LARP as a professor (I was hoping for better code). Probably almost all hallucinations, but I wouldn't be surprised if some had some truth to them.
- 23B1 3y ago1. Avoid VC and investors, and, 2. Build small- to mid-size businesses, that can prioritize healthy growth – like focusing on users, being kind to employees, building brand equity over time. The pump-and-dump grift cycle of enshittification has got to stop.
- tap-snap-or-nap 3y agoAs soon as finance capital gets involved, the core objective of business shifts to primarily providing higher returns for the investors. Small to medium businesses can have diversity but once they "go public" they all are almost alike.
- ticviking 3y agoThen don’t go public. Accept that you cannot grow at the same speed and focus on deep roots and fanatical customers
- Joker_vD 3y agoDoes that ever work? After all, an enterprise that cannot grow at the same speed is effectively shrinking, isn't it?
- adambyrtek 3y ago37signals (and others) proved that a different approach is possible.
- lawn 3y agoWhy does it have to grow? It can also be stagnant, which is totally acceptable as well.
- waboremo 3y agoYou can't really be stagnant due to competition. Not unless you're deep into some niche that's difficult to get started in or stick around.
- potatototoo99 3y ago"Computer eyes" only look to pick what and how to show "human eyes", otherwise there'd be no incentive to look at private repositories.
- myaccountonhn 3y agoI’m switching and creating all my new projects at sourcehut. Nothing good ever comes out of Microsoft having dominance.
- fullspectrumdev 3y agoJust be aware that sourcehut is Opinionated and some projects are unwelcome there (eg: even vaguely cryptocurrency related code)
- aloisdg 3y agoNice feature!
- fullspectrumdev 3y agoI dunno, I consider it an anti feature personally. They don’t allow crypto related code to be hosted there purely because the guy who runs the show dislikes crypto. What else does he dislike in the future? AI/ML projects are just as divisive as crypto coin projects…
- kzrdude 3y agoGiven his opinions on package managers like npm, I guess anything vaguely adjacent doesn't feel welcome.
- bayindirh 3y agoSourceHut planned to ban Go Module mirror due to bandwidth they consume, then they have talked with Russ Cox, and Go team agreed to implement caching into Go (-reuse flag, IOW) [0]. I think this is a major win, because assuming everyone have their unlimited 10gpbs symmetric dark fibers at their home, office, car and mobile phone is wrong on so many levels. [0]: https://sourcehut.org/blog/2023-01-09-gomodulemirror/ https://sourcehut.org/blog/2023-01-09-gomodulemirror/
- 3y ago
- Traubenfuchs 3y ago...but they will see some kind of mash-up, remixed, synthesized version of it that might be 99.9% similar so practically this means absolutely nothing.
- geniium 3y agoI don’t know if that’s reassuring or worrying…
- ideamotor 3y agoThis reads like someone’s boss drunkenly told the author to “just tell them no human eyes will read it, har har.” The author then just phoned it in.
- revskill 3y agoIf you use a free service, you're the product.
- slimbods 3y agoThis applies to 'pro & team' paid services too.
- jstanley 3y agoHow exactly is GitHub supposed to work if their computers are not allowed to look at your code? Git doesn't work by magic.
- pavlov 3y agoI guess it hinges on the definition of “looking”. Receiving files, copying them within a file system, and transmitting the contents? Clearly not looking. Computing a hash for each file? Doesn’t seem like looking either. Parsing the contents, or tokenizing them for a ML model? That’s looking IMO. I think the defining factor is the size and nature of the derived state update on the server. Copying and transmitting retains only metadata about the file. Computing a hash produces only a handful of bytes of state about the file, and there’s nothing that can be inferred about the file’s contents from the hash. But if you start storing something like word frequencies, that’s not neutral anymore, it’s a “look” into the contents.
- paxys 3y agoGo to github.com, open your repository and open a file. It shows up on the screen. Is that not "looking"?
- pavlov 3y agoNo, because the server doesn’t update any state based on the transmitted file contents except some metadata like “last viewed”. The state update based on the file contents happens in my brain, and that’s the “look” action.
- eknkc 3y agoThey do code highlighting, search indexing and symbol resolution. I don't know if those can be disabled but they need them to look at the code, update state (indexes and such, maybe caching on highlighting).
- 3y ago
- jamesgreenleaf 3y ago"Rest assured that your code will only ever be viewed by a vast and unfathomable superintelligence whose motives are as yet unclear. Please be cognizant of any code or comments which may inadvertently invoke the shoggoth's displeasure." /s
- JonChesterfield 3y agoThis really shouldn't be the step it takes for you to think "maybe I shouldn't give Microsoft all the source code that I think is important enough to keep private".
- ionwake 3y agoConfident statement coming from them - What about like when it was hacked 6 years ago and some kid had access to all the private repos ?
- ekianjo 3y agoSounds like Gmail not having a human reading your emails like 20 years ago
- deleted 3y ago[deleted]
- OliverJones 3y agoRight. And all the GPL, MIT, and CC Sharealike-with-attribution material I've been stashing on Github is going into the vast code anonymizer called Copilot. The good news for me the open-source developer: it looks like the closed-source code people write with the help of Copilot and all the open-source code in its learning set will also feed into that learning set. I guess code just wants to be free -- free as in speech, expensive as in yachts and fine wine for VCs and private equity pirates. Plus ça change, plus ça reste la même chose. Sigh.
- miki123211 3y agoThis is the kind of privacy that I (along with a large majority of unsophisticated tech users) care about most. I don't care if machines access my data and serve me better ads, I do care whether customer data can easily be viewed by a HR person / angry ex / private investigator / controlling ultra-religious parents / crooked cop of a third-world-country with a bullshit "this person wants to commit suicide" excuse. I have actually talked with non-tech-savvy people about this, most of them have heard of tech companies tracking their users, and most of them genuinely believe that there are tech company employees out there going through their private lives. This is why I really dislike the use of the word "tracking" in a tech privacy context.
- croes 3y agoWhere is the difference? A machine will read your data and will set a flag in your HR file. No human read your data but you still face consequences
- flagrant_taco 3y agoI've heard plenty of non-technical users complain about ads that they think we're shown based on tracking, most often the complaint is concerns of the use of an idle phone's mic. I've also talked with non-tech people about how the tracking and data mining world actually works, I've never had someone say "so what?". It may simply be that non-tech people aren't as aware of what the tracking does based on ignorance of the problem, not a genuine acceptance of the practice itself.
- tpxl 3y ago> most of them genuinely believe that there are tech company employees out there going through their private lives. Are you implying this is an incorrect belief? There are reports of employees stalking their former partners at data collection companies.
- croes 3y agoDidn't Amazon say the same about the Alexa data? Nothing is stored at Amazon. Ok, stored but no human has access. Ok, humans have access but only special employees Ok, some third party contractor get the data too.
- flagrant_taco 3y agoIt really sucks when you want to keep a secret but keep getting asked the right questions. It would have been much easier for Amazon if people just took the first statement at face value.
- _aleph2c_ 3y agoIf there is proof that they are training their commercial AI from private professional source code it could feed a COLOSSAL class action lawsuit. I understand that 1-3 percent of the American GDP goes to lawyers who work on contingency for these kinds of class actions. These guys eat what they kill, and they feed on corporations. That doesn't mean that Microsoft won't try it.
- moritzwarhier 3y agoNot related to private repositories; but GitHub also keeps logs about commits in the "Activity Graph" if these commits do not exist anymore. For example, clearing the full reflog of a repository and then either force pushing over or deleting the remote repository (then pushing it again under a different name) will keep the activity attribution, in the second case it might even attribute the commits to the new remote (404ing when clicking the "Created x commits in y repositories"). Good for team workflows and pull requests, but annoying for public repositories with intentionally rewritten history.
- semiquaver 3y agoReflog is data local to a git node, not part of the repository. In particular reflogs are never transmitted between remotes. so “clearing the reflog” (presumably of your local machine) has nothing to do with removing any data at GitHub. You need to contact support for that which the docs advise you to do if you’ve force pushed over something you want to be fully deleted.
- moritzwarhier 3y agoThank you, today I learned
- semiquaver 3y agoNo problem. One easy way to gain confidence that data has actually been wiped instead of just obscured is to use one of the gitrevisions [1] specifiers that sources data from the reflog. For example, master@{yesterday} resolves to whatever the reflog thinks the master branch was pointing to 24 hours ago. There are a bunch of places in the GitHub API and UI that look like they only accept a branch or commit OID but actually accept a revision specifier. So e.g https://github.com/torvalds/linux/tree/master@{yesterday} lets you peek into the reflog for the master branch on torvalds/linux. [1] man 7 gitrevisions
- moritzwarhier 3y ago
- yulaow 3y agoWe really need to have an open source sw license that specifically forbid any use of the code by AIs
- flagrant_taco 3y agoWe'd still need a way to know when someone violates it. When you see a copy of your licensed software being used you can at least try to enforce that, but how do you know it was fed through an AI for training? At best that would be like a Don't Track Me flag. Some will follow it, though ironically it is also useful for fingerprinting and can signal you may be doing something worth tracking.
- henriquez 3y ago"Open source" doesn't really help much without the "Free and" prefix, and unfortunately there's no way to reconcile software freedom and banning specific use cases. Dunno if you remember the "can we remove Nazis from ToR" controversy awhile back but it's the same kind of thing. It's either free or it isn't.
- sim7c00 3y agodoes anyone have specific and unique enough code in their pvt repos to see if co pilot and such things will actually recommend their specific private code or methods (i guess this is the thing ppl worry about?)?
- einpoklum 3y agoGitHub: We are owned by Microsoft. And Microsoft is known to secretly forward much or all of the user data and communications to the NSA (National Security Agency), as part of the PRISM program (https://www.lawfareblog.com/snowden-revelations https://www.lawfareblog.com/snowden-revelations) ... but we'll never share your data with anyone!
- plandis 3y agoHow else did people think Github was able to do things like link to function definitions or scanning for secrets stored in private repos to alert you?
- paxys 3y agoDo people want Github to display files in your private repos on github.com? Do you want syntax highlighting and intellisense? Do you want them tokenized for search? Should they be available for cloning when you need it? Should they run security scans and identify vulnerabilities? Should you be able to see git blame, diffs, commits, other metadata? Set up build pipelines? Modify contents via an API? Tell me – how can Github do all of this without programmatically accessing the contents of your private repos from their servers?
- wg0 3y agoOr - how any provider even self hosted, other than GitHub can provide any of that without automated processing of the contents of private repositories?
- marcinzm 3y agoAs I see it people are basically taking a single line of an agreement that explicitly references other agreements out of context: "If you enable data use for a private repository, we will continue to treat your private data, source code, or trade secrets as confidential and private consistent with our Terms of Service."
- lopkeny12ko 3y agoNo, I don't want these features. I want reliable remote git storage, which lets me clone a copy of my source code anywhere so I can do these things locally, on my own machine. People forget that this was the original design and intent of Git as a decentralized protocol. As an industry I think we have become too reliant on Github as some kind of way-far-beyond-git magic tool. This might be fine until it isn't--like when Microsoft decides it's time to start training Copilot on your private code.
- lucasfdacunha 3y agoUse another place to store your git projects then, it's not like Github is the only one. Github is a PRODUCT built around git, not just a place to store your git repositories. I'm pretty sure you will be able to find other services which only exist to host git projects and do nothing else.
- activiation 3y agoHaving a computer read your data can be even worst then a human... After all a human programmed it to find whatever it wants at scale.
- deleted 3y ago[deleted]
- fileeditview 3y agoI am thinking about self-hosting my private repositories for some time now. I also want a simple web interface for convenience. I don't need a "Github clone" like Gogs, Gitea.. What simpler alternatives are there? I found https://github.com/jonashaag/klaus https://github.com/jonashaag/klaus . Is there something else?
- paxys 3y agoYou don't need any extra software. Git already has a built-in web interface (https://git-scm.com/book/en/v2/Git-on-the-Server-GitWeb https://git-scm.com/book/en/v2/Git-on-the-Server-GitWeb).
- fileeditview 3y agoOh wow I didn't know that.. thanks I will have a look at this!
- WhereIsTheTruth 3y ago> By default, all public repositories are included in the GitHub Archive Program, a partnership between GitHub and organizations such as Software Heritage Foundation and Internet Archive to ensure the long-term preservation of the world's open source software You no longer own your projects, they have the final word.. scary times Glad I moved away from Microsoft products many years ago, sad for my country
- charles_f 3y agoThat explains their move to make private repos free a few years ago. What frustrates me is that it feels like they didn't announce their intentions of what they'd do with your code. They use the same kind of verbiage ib t&c as they would to tell they collect some usage telemetry and might occasionally share it with partners. And that is definitely not the same.
- kimbernator 3y agoI feel like git services like github would be well-suited to join the fediverse. It's clear to a lot of us that our code is becoming too centralized, but it's also hard to deny the usefulness of being able to search across so much code in a single place. I'd also expect that users of github would have an easier time than the average person figuring that change out.
- alwaysbeconsing 3y agoIt's an interesting thought but GitHub specifically has absolutely no reason to want this; doubly so after the Microsoft acquisition. Sourcehut, Gitea.io, and Codeberg would be the places to start.
- Cloudef 3y agoIt's starting to look like github is slowly arriving to its own funeral. Lots of pointless site changes that hide or change location of important functionality. New twitter like feed that tries to recommend you all sort of crap you don't care about and now this. It's shame as github actions is not half bad.
- sn0n 3y agoI don't know what you guys expect from a Microsoft company.... Seems obvious.
- pxc 3y agoHow usable is Pijul and its Best forge these days? Maybe something low-stakes but (for me) highly used like my dotfiles would be a good fit for learning my way around over there. I'm getting a 500 Internal Server Error on their pricing page, which I assume may have something to do with this post on HN. Anyone know what it costs to have private repos there?
- pmeunier 3y agoAs the author, I do. Pijul is usable, we use it for itself, no problem. The best forge is still a bit experimental, since we've recently rewritten it using tech that isn't as ready as it promises (looking at you, Cloudflare Workers). A private repo is 5€/month, plus 0.01€/Gb.day for storage above 100Mb. And we don't do the kind of stuff discussed here, we're just offering storage and collaboration tools, and intend to keep it this way (as well as open sourcing everything).
- dathinab 3y agoah yes it's only memorized by an AI but don't worry we will do some changes to it so that it no one will recognize it
- nathants 3y agoyou want to minimize trust. you have to trust linux and kind of trust aws, you don’t have to trust github at all. not your keys, not your coins. it’s really such a good catchphrase. for anything non-public, git data goes here: https://github.com/nathants/git-remote-aws https://github.com/nathants/git-remote-aws