4 ms·

You guys realize that GitHub provides secret scannings and supply chain (libs) issues warnings? How do you think they do that? Crystal ball? Not everything is

You guys realize that GitHub provides secret scannings and supply chain (libs) issues warnings? How do you think they do that? Crystal ball? Not everything is about AI

dijit 3y ago
I think this is probably true, despite critical software being leaked, that seems related to manually inputting data to chatGPT: https://mashable.com/article/samsung-chatgpt-leak-details https://mashable.com/article/samsung-chatgpt-leak-details there is no current reason to believe that copilot or ChatGPT are trained on private repositories; however this agreement does permit them to do so. The concern is, why not? you have an enormous corpus of professional grade software just sitting there, one bit flip away from access; and you are even permitted (to the letter of the law) to flip that bit- why wouldn't you, eventually?
- torginus 3y ago
  In the intelligence business, they talk about capabilities, not intents.
  - deleted 3y ago
    [deleted]
- bionade24 3y ago
  > The concern is, why not? They need to reliably filter secrets or they are in trouble once Copilot suggests them.
  - dijit 3y ago
    They already scan for secrets so that they can warn you that you checked them in.
- simonw 3y ago
  "why wouldn't you, eventually?" Because if people found out you were doing that you would lose vast numbers of paying customers, which would cost you a lot of money.
  - JeremyNT 3y ago
    You're talking about a company that puts ads in the start menu and opts users in to all kinds of telemetry. If people haven't gotten tired of Microsoft's antics yet, they never will.
    - waboremo 3y ago
      It's a little different, Microsoft doesn't care about consumers as they stopped being relevant to Microsoft's financials in the Ballmer era. Even consumer Office spending makes less than LinkedIn for companies to put into perspective how little they care. However, enterprise/commercial? The same group you're trying to sandwich between a 365 subscription and azure/github? These are the people in which when they do have evidence that they are being negatively affected, will cause a massive dent in Microsoft's bottom line.
- marcinzm 3y ago
  >however this agreement does permit them to do so. How so? Assuming you read the whole agreement and not just take a single line out of context? "If you enable data use for a private repository, we will continue to treat your private data, source code, or trade secrets as confidential and private consistent with our Terms of Service."
  - dijit 3y ago
    Reading the terms of service is the most important thing; almost everything else is immaterial. I am working from information derived from the terms of service: https://docs.github.com/en/site-policy/github-terms/github-terms-of-service https://docs.github.com/en/site-policy/github-terms/github-t... For a small example of what I mean: > GitHub considers the contents of private repositories to be confidential to you. GitHub will protect the contents of private repositories from unauthorized use, access, or disclosure in the same manner that we would use to protect our own confidential information of a similar nature and in no event with less than a reasonable degree of care. When talking about confidentiality, GitHub is specific to mention unauthorised access, implication is here that GitHub has the authority to authorise themselves. The next section talks about how they will grant access to third-parties, but it's clear that as a first party they exclude themselves from the moniker of "unauthorised".
    - marcinzm 3y ago
      I agree however taking random pieces of a long agreement in isolation is not how you read terms of services. The section you highlight is NOT, for example, the one that talks about what legal rights you give Github regarding your code. Construing it as such and the extrapolating from that is taking a piece of text way out of context.
      - dijit 3y ago
        The section cited is the most prominent section in the terms of service regarding private repositories[0] Everything else in that section relates to personnel (which is not the concern of the commenters here), what happens if you upload copyrighted material and codes of conduct. Also, taking segments of the TOS is exactly what will happen in a court of law, unless there is another section that invalidates this section, this fragment will be argued as consent. Additionally; the context of that section is very clear otherwise. Sorry. The way ToS will be argued is: there are many references to processing information and nothing that explicitly prohibits or cannot be reasonably inferred to inhibit automatic processing, in fact there are many places where they make reference to "automatic processing for services"; You can take that to mean that it's just their SAST scanners, they can take it to mean training of an AI model, there's no distinction legally here. [0]: https://docs.github.com/en/site-policy/github-terms/github-terms-of-service#e-private-repositories https://docs.github.com/en/site-policy/github-terms/github-t...
- deleted 3y ago
  [deleted]
AndroTux 3y ago
[flagged]
- didntcheck 3y ago
  In that case they needn't put this in their ToS. It's strange how people will distrust a company with one hand, then claim their word as reliable evidence (and think they can be stopped by unticking a checkbox) with the other hand. If they wish to deceive you they would do it without telling on themselves
  - alwaysbeconsing 3y ago
    Any sane business decisionmaker would want legal cover for something like this in case it draws a lawsuit. Regardless of whether they themselves think it's okay, doing it entirely on the sly makes it more likely an opposing lawyer can convince a judge/jury that it's not okay. If they have an agreement that the client "accepted" that strengthens their position quite a lot.
croes 3y ago
Of course it's about AI. They have a legitimate cause to read and while they are at it they use the data for everything else they want. No way for you to know.
bunga-bunga 3y ago
Temporarily reading into RAM and applying a regex isn’t the same as feeding your repos to a LLM, which may store parts of it permanently. Obviously GitHub can read my repos in order to display them on GitHub.com, but access must be fleeting.

You guys realize that GitHub provides secret scannings and supply chain (libs) issues warnings? How do you think they do that? Crystal ball? Not everything is about AI

dijit 3y ago

I think this is probably true, despite critical software being leaked, that seems related to manually inputting data to chatGPT: https://mashable.com/article/samsung-chatgpt-leak-details https://mashable.com/article/samsung-chatgpt-leak-details there is no current reason to believe that copilot or ChatGPT are trained on private repositories; however this agreement does permit them to do so. The concern is, why not? you have an enormous corpus of professional grade software just sitting there, one bit flip away from access; and you are even permitted (to the letter of the law) to flip that bit- why wouldn't you, eventually?

torginus 3y ago
In the intelligence business, they talk about capabilities, not intents.
- deleted 3y ago
  [deleted]
bionade24 3y ago
> The concern is, why not? They need to reliably filter secrets or they are in trouble once Copilot suggests them.
- dijit 3y ago
  They already scan for secrets so that they can warn you that you checked them in.
simonw 3y ago
"why wouldn't you, eventually?" Because if people found out you were doing that you would lose vast numbers of paying customers, which would cost you a lot of money.
- JeremyNT 3y ago
  You're talking about a company that puts ads in the start menu and opts users in to all kinds of telemetry. If people haven't gotten tired of Microsoft's antics yet, they never will.
  - waboremo 3y ago
    It's a little different, Microsoft doesn't care about consumers as they stopped being relevant to Microsoft's financials in the Ballmer era. Even consumer Office spending makes less than LinkedIn for companies to put into perspective how little they care. However, enterprise/commercial? The same group you're trying to sandwich between a 365 subscription and azure/github? These are the people in which when they do have evidence that they are being negatively affected, will cause a massive dent in Microsoft's bottom line.
marcinzm 3y ago
>however this agreement does permit them to do so. How so? Assuming you read the whole agreement and not just take a single line out of context? "If you enable data use for a private repository, we will continue to treat your private data, source code, or trade secrets as confidential and private consistent with our Terms of Service."
- dijit 3y ago
  Reading the terms of service is the most important thing; almost everything else is immaterial. I am working from information derived from the terms of service: https://docs.github.com/en/site-policy/github-terms/github-terms-of-service https://docs.github.com/en/site-policy/github-terms/github-t... For a small example of what I mean: > GitHub considers the contents of private repositories to be confidential to you. GitHub will protect the contents of private repositories from unauthorized use, access, or disclosure in the same manner that we would use to protect our own confidential information of a similar nature and in no event with less than a reasonable degree of care. When talking about confidentiality, GitHub is specific to mention unauthorised access, implication is here that GitHub has the authority to authorise themselves. The next section talks about how they will grant access to third-parties, but it's clear that as a first party they exclude themselves from the moniker of "unauthorised".
  - marcinzm 3y ago
    I agree however taking random pieces of a long agreement in isolation is not how you read terms of services. The section you highlight is NOT, for example, the one that talks about what legal rights you give Github regarding your code. Construing it as such and the extrapolating from that is taking a piece of text way out of context.
    - dijit 3y ago
      The section cited is the most prominent section in the terms of service regarding private repositories[0] Everything else in that section relates to personnel (which is not the concern of the commenters here), what happens if you upload copyrighted material and codes of conduct. Also, taking segments of the TOS is exactly what will happen in a court of law, unless there is another section that invalidates this section, this fragment will be argued as consent. Additionally; the context of that section is very clear otherwise. Sorry. The way ToS will be argued is: there are many references to processing information and nothing that explicitly prohibits or cannot be reasonably inferred to inhibit automatic processing, in fact there are many places where they make reference to "automatic processing for services"; You can take that to mean that it's just their SAST scanners, they can take it to mean training of an AI model, there's no distinction legally here. [0]: https://docs.github.com/en/site-policy/github-terms/github-terms-of-service#e-private-repositories https://docs.github.com/en/site-policy/github-terms/github-t...
deleted 3y ago
[deleted]

AndroTux 3y ago

[flagged]

didntcheck 3y ago
In that case they needn't put this in their ToS. It's strange how people will distrust a company with one hand, then claim their word as reliable evidence (and think they can be stopped by unticking a checkbox) with the other hand. If they wish to deceive you they would do it without telling on themselves
- alwaysbeconsing 3y ago
  Any sane business decisionmaker would want legal cover for something like this in case it draws a lawsuit. Regardless of whether they themselves think it's okay, doing it entirely on the sly makes it more likely an opposing lawyer can convince a judge/jury that it's not okay. If they have an agreement that the client "accepted" that strengthens their position quite a lot.

croes 3y ago

Of course it's about AI. They have a legitimate cause to read and while they are at it they use the data for everything else they want. No way for you to know.

bunga-bunga 3y ago

Temporarily reading into RAM and applying a regex isn’t the same as feeding your repos to a LLM, which may store parts of it permanently. Obviously GitHub can read my repos in order to display them on GitHub.com, but access must be fleeting.