6 ms·

While I'm not forgetting the spirit of what Git is, I'm also remembering how GitHub used "all open repositories" to train their first Copilot without telling an

While I'm not forgetting the spirit of what Git is, I'm also remembering how GitHub used "all open repositories" to train their first Copilot without telling anyone. So, no thanks. I'll not be committing any personal code there anymore. And no, I don't care for the social aspects either. Discoverability, stars, and AI bot powered issue bombardment. I'm fine like this. Also, remember, "Open Source is not about You".

dandellion 6mo ago
Don't forget a achievement badges.
PaulKeeble 6mo ago
It did so in direct violation of the licenses of the code held there as well and then sold code snippets they had no rights to and still do.
- rpdillon 6mo ago
  How did you draw those conclusions? They don't seem to be in line with court rulings (i.e. Anthropic), which hold that training is fair use. Code is being treated the same as any other copyrighted content that is used for training, from blog posts to PR announcements from companies and everything in between. Of course the blog posts are PR announcements have their copyright held by their authors, with no license provided at all, so if OSS code being used in training is a violation, then so would everything being trained on (to a first approximation...public domain works excepted). But no court has every taken that position to my knowledge. There's just so much confusion around this. In this thread alone: * Distillation is legal under copyright; the violations would come as ToS violations, which is contract law, not copyright law. * Training is legal as well, so long as the original material was obtained legally. * Moving code off of GitHub doesn't change any of this: AI companies are free to download your git repo no matter where it is hosted, just like they can any other content on a publicly accessible website. * Liability comes into the picture when the models are used to infringe copyright in their output. We'll have to see the outcome of the NYT case here, but that is proceeding at a glacial pace. I am not a lawyer; I'm an interested amateur that's been following the saga for years. I wish the discussion here on HN were more nuanced. If anyone has legal updates that render any of the above incorrect, I'd love a pointer to the decisions. One area I'm particularly weak is the legal status in countries that are not the US: I don't follow those laws nearly as carefully, nor the court cases brought.
  - bayindirh 6mo ago
    I have written about this numerous times, so I won't repeat myself with the long form writing. Maybe I need to keep a list of comments somewhere, so I can reference them. I digress... In short: - GPL code requires attribution and sharing of code. Models strip license, so GPL is effectively violated. - Source available licenses are "for your eyes" only, so training on source available code is also violates said code's licenses. - MIT requires attribution, but forgetting it has no consequences, so it's a more gray area. About moving from GitHub: - Some public repositories provide visible and invisible anti-scraping protections. So it's not always that easy. - GPL says I need to share code to the people who downloads the application itself, so I can move to cathedral model. Moreover: - US Government has a stance of "If we need to take permission for everything, AI industry will die". Hence, as an outsider, the court rulings have no weight in my eyes. They are taking stance to enable and not hinder the industry. If one reads Fair Use doctrine, it's very possible to rule otherwise. OpenAI's whole non-profit research arm was an instrument to circumvent Fair Use doctrine's "earn money from copyrighted works" clause and support "we only do research pinky promise" requirement of the said doctrine. When courts said "go ahead, we're not looking", people started to torrent e-books (ahem Meta ahem) to train models or buy/cut/scan/ocr books to train their models (Anthropic). So the situation is left murky to allow Silicon Valley to thrive. Not to protect people's blood, sweat and tears. These works are provided by peasants anyway, so why bother. Addenda: Courts said models' outputs can't be copyrighted. So, copyrighted code gets in, non-copyrightable code gets out. It's effectively license-washing.
    - rpdillon 6mo ago
      I don't think your understanding of Fair Use matches mine, but it is important, since it invalidates the concern about licensing. I wrote a nearby comment giving some resources on the current state of Fair Use for training, but in short: it depends. https://news.ycombinator.com/item?id=48125071 https://news.ycombinator.com/item?id=48125071 > Hence, as an outsider, the court rulings have no weight in my eyes. My only focus in on legality, so this doesn't track for me. If we're not talking about what courts are ruling, then there's nothing to talk about legally, since the copyright office is waiting on courts to rule here.
    - 6mo ago
- NeutralCrane 6mo ago
  IP law is a farce, and the open source licenses are built upon that farce. If a single good thing comes out of LLMs, it will be forcing society to recognize “intellectual property” for the dystopic stupidity that it is. I doubt it though.
  - account42 5mo ago
    That is a pipe dream. The current direction is the opposite of that - knowledge becomes even more centralized and only rented out to individuals.
    - NeutralCrane 5mo ago
      Knowledge being rented out to individuals is the status quo. Already there are court rulings dictating that “training” on data is legal, but model weights also are non-copyrightable, which seems like a step in the direction of sanity.
saurik 6mo ago
I mean, I never put my code on GitHub, but other people put it there, as they use GitHub: you can't not use GitHub. (Hell: even closed source projects, even ones that were never distributed even as a binary, if the code leaks, end up mirrored on GitHub.)
chrischen 6mo ago
What exactly did they train? Copilot is powered by claude, gemini, or ChatGPT these days. Did they train autocomplete? I mean the code is open source so anyone can scrape it and train it too. I'm kind of glad they did train it because otherwise we'd still be stuck with Apple level AI models right now. The whole reason we have so many models, including open weight models, that are all competitive with each other is because the data is free and anyone can be training off it. If the goal was to monetize the source code I guess the authors shouldn't make it open source.
- skinfaxi 6mo ago
  > "GitHub Copilot is powered by generative AI models developed by GitHub, OpenAI, and Microsoft. It has been trained on natural language text and source code from publicly available sources, including code in public repositories on GitHub." https://azure.microsoft.com/en-us/products/github/copilot#faq https://azure.microsoft.com/en-us/products/github/copilot#fa...
- chris_money202 6mo ago
  Yeah have to agree here, Github Copilot itself doesn't have any first party models they use the frontiers. So, they didn't "train" using public repos but they probably allowed (or didn't prevent) the frontiers from pulling the repos along with the rest of the internet when creating their models.
  - ramblurr 6mo ago
    Is y'alls collective memory so short? Copilot just a few years ago was auto complete on steroids that was entirely first party and trained by GH on users' code.
    - bayindirh 6mo ago
      It was even returning some code verbatim with the correct prompts.
    - Leynos 6mo ago
thisislife2 6mo ago
I completely share your sentiment about feeling irked about open source code being used to train commercial AI models. However, I think the battle is already lost - the nature of copyright and open source code philosophy (currently) means that there isn't any real way of preventing your code being used to train AI. Look at the legal precedents being set in courts where many of the BigTechs have actually pirated copyrighted media to train their AI, and the court has said "that's acceptable". (Ofcourse, the actual act of piracy - like Facebook did by downloading copyrighted material through torrents - may not be legal, but the courts may be lenient here too as there seems to be an undercurrent of government approval to do anything to win the "AI Race"). And, even if you move your repository somewhere else, can you really prevent anyone from uploading it to Github? To do so, you may have to create your open source license.
- lelanthran 6mo ago
  > However, I think the battle is already lost - the nature of copyright and open source code philosophy (currently) means that there isn't any real way of preventing your code being used to train AI. Laws should make it a double-edged sword, make distillation explicitly legal. Not much else they can do.
  - overfeed 6mo ago
    > Laws should make it a double-edged sword, make distillation explicitly legal. Knowledge-distillation is already legal. Current case law says none of outputs of any model are protected by copyright, so one could use model outputs for whatever they want - including distillation. That is why AI companies resort to ToS clauses to block distillation and/or training competing models.
    - pojzon 6mo ago
      Its completely 100% legal, to ask LLM to write detailed spec of any closed source project based on the code. Then ask another LLM to implement it to make it public domain. Its already proven based on previous specification laws. Hilarious as it sounds its true. We can make “any” code a public domain woth LLMs.
locknitpicker 6mo ago
> (...) I'm also remembering how GitHub used "all open repositories" to train their first Copilot without telling anyone. This is a silly opinion to hold, isn't it? I mean, you release projects under a license with the express purpose of freely distributing your code among anyone in the world that may have any interest whatsoever, and even allow they themselves to share it with anyone they feel fit. But you are somehow outraged if people actually use said code? Please make it make sense.
- dylan604 6mo ago
  Because there's no way the code is distributed properly according to any of the OSS licenses. In fact, it claims authorship with nonsense bylines saying the LLM wrote it.
  - locknitpicker 6mo ago
    > Because there's no way the code is distributed properly according to any of the OSS licenses. What are you talking about? There is no distribution, only read access.
    - CyberDildonics 6mo ago
      What is the difference?
    - evanelias 6mo ago
      Reading means downloading. Downloading is equivalent to making a copy. To make a copy of a copyrighted work, you need a license, unless your activity is fair use. Licenses have terms and conditions that must be followed, such as retaining attribution in all derivative works. That said, FOSS licenses are non-exclusive. Regarding the original upthread topic of GitHub's copilot training, iirc GitHub's terms and conditions involve granting them a license in order to host your code. Depending what else is in those terms, they may have had the ability to use all hosted code for LLM training through that license, instead of the FOSS licensing on any given Open Source repo. But that would only apply to GitHub/Microsoft, not third party scrapers.
mannanj 6mo ago
The training on "all open repositories" is the only training we heard about. I wouldn't be surprised if it wasn't beneath these greedy companies to train on other data, and respond "oops! we didn't that would happen" (by which they mean get found out). Leaving is still the right move. But this applies to all centralized large services: Our use of Google and Google Drive, any Microsoft products, Adobe products, etc.
onesandofgrain 6mo ago
Agreed
HiPhish 6mo ago
> While I'm not forgetting the spirit of what Git is, I'm also remembering how GitHub used "all open repositories" to train their first Copilot without telling anyone. As long as your code is out in the open anywhere the slop factories can train their models at it, regardless of whether it's on GitHub or your private server. So you might as well keep using GitHub at least as a gratis mirror. My reasoning is that if I'm going to be milked anyway I might as well freeload off GitHub.
- account42 5mo ago
  Just because they technically can grab it doesn't mean you have to make it easy.

dandellion 6mo ago

Don't forget a achievement badges.

PaulKeeble 6mo ago

It did so in direct violation of the licenses of the code held there as well and then sold code snippets they had no rights to and still do.

rpdillon 6mo ago
How did you draw those conclusions? They don't seem to be in line with court rulings (i.e. Anthropic), which hold that training is fair use. Code is being treated the same as any other copyrighted content that is used for training, from blog posts to PR announcements from companies and everything in between. Of course the blog posts are PR announcements have their copyright held by their authors, with no license provided at all, so if OSS code being used in training is a violation, then so would everything being trained on (to a first approximation...public domain works excepted). But no court has every taken that position to my knowledge. There's just so much confusion around this. In this thread alone: * Distillation is legal under copyright; the violations would come as ToS violations, which is contract law, not copyright law. * Training is legal as well, so long as the original material was obtained legally. * Moving code off of GitHub doesn't change any of this: AI companies are free to download your git repo no matter where it is hosted, just like they can any other content on a publicly accessible website. * Liability comes into the picture when the models are used to infringe copyright in their output. We'll have to see the outcome of the NYT case here, but that is proceeding at a glacial pace. I am not a lawyer; I'm an interested amateur that's been following the saga for years. I wish the discussion here on HN were more nuanced. If anyone has legal updates that render any of the above incorrect, I'd love a pointer to the decisions. One area I'm particularly weak is the legal status in countries that are not the US: I don't follow those laws nearly as carefully, nor the court cases brought.
- bayindirh 6mo ago
  I have written about this numerous times, so I won't repeat myself with the long form writing. Maybe I need to keep a list of comments somewhere, so I can reference them. I digress... In short: - GPL code requires attribution and sharing of code. Models strip license, so GPL is effectively violated. - Source available licenses are "for your eyes" only, so training on source available code is also violates said code's licenses. - MIT requires attribution, but forgetting it has no consequences, so it's a more gray area. About moving from GitHub: - Some public repositories provide visible and invisible anti-scraping protections. So it's not always that easy. - GPL says I need to share code to the people who downloads the application itself, so I can move to cathedral model. Moreover: - US Government has a stance of "If we need to take permission for everything, AI industry will die". Hence, as an outsider, the court rulings have no weight in my eyes. They are taking stance to enable and not hinder the industry. If one reads Fair Use doctrine, it's very possible to rule otherwise. OpenAI's whole non-profit research arm was an instrument to circumvent Fair Use doctrine's "earn money from copyrighted works" clause and support "we only do research pinky promise" requirement of the said doctrine. When courts said "go ahead, we're not looking", people started to torrent e-books (ahem Meta ahem) to train models or buy/cut/scan/ocr books to train their models (Anthropic). So the situation is left murky to allow Silicon Valley to thrive. Not to protect people's blood, sweat and tears. These works are provided by peasants anyway, so why bother. Addenda: Courts said models' outputs can't be copyrighted. So, copyrighted code gets in, non-copyrightable code gets out. It's effectively license-washing.
  - rpdillon 6mo ago
    I don't think your understanding of Fair Use matches mine, but it is important, since it invalidates the concern about licensing. I wrote a nearby comment giving some resources on the current state of Fair Use for training, but in short: it depends. https://news.ycombinator.com/item?id=48125071 https://news.ycombinator.com/item?id=48125071 > Hence, as an outsider, the court rulings have no weight in my eyes. My only focus in on legality, so this doesn't track for me. If we're not talking about what courts are ruling, then there's nothing to talk about legally, since the copyright office is waiting on courts to rule here.
  - 6mo ago
NeutralCrane 6mo ago
IP law is a farce, and the open source licenses are built upon that farce. If a single good thing comes out of LLMs, it will be forcing society to recognize “intellectual property” for the dystopic stupidity that it is. I doubt it though.
- account42 5mo ago
  That is a pipe dream. The current direction is the opposite of that - knowledge becomes even more centralized and only rented out to individuals.
  - NeutralCrane 5mo ago
    Knowledge being rented out to individuals is the status quo. Already there are court rulings dictating that “training” on data is legal, but model weights also are non-copyrightable, which seems like a step in the direction of sanity.

saurik 6mo ago

I mean, I never put my code on GitHub, but other people put it there, as they use GitHub: you can't not use GitHub. (Hell: even closed source projects, even ones that were never distributed even as a binary, if the code leaks, end up mirrored on GitHub.)

chrischen 6mo ago

What exactly did they train? Copilot is powered by claude, gemini, or ChatGPT these days. Did they train autocomplete? I mean the code is open source so anyone can scrape it and train it too. I'm kind of glad they did train it because otherwise we'd still be stuck with Apple level AI models right now. The whole reason we have so many models, including open weight models, that are all competitive with each other is because the data is free and anyone can be training off it. If the goal was to monetize the source code I guess the authors shouldn't make it open source.

skinfaxi 6mo ago
> "GitHub Copilot is powered by generative AI models developed by GitHub, OpenAI, and Microsoft. It has been trained on natural language text and source code from publicly available sources, including code in public repositories on GitHub." https://azure.microsoft.com/en-us/products/github/copilot#faq https://azure.microsoft.com/en-us/products/github/copilot#fa...
chris_money202 6mo ago
Yeah have to agree here, Github Copilot itself doesn't have any first party models they use the frontiers. So, they didn't "train" using public repos but they probably allowed (or didn't prevent) the frontiers from pulling the repos along with the rest of the internet when creating their models.
- ramblurr 6mo ago
  Is y'alls collective memory so short? Copilot just a few years ago was auto complete on steroids that was entirely first party and trained by GH on users' code.
  - bayindirh 6mo ago
    It was even returning some code verbatim with the correct prompts.
  - Leynos 6mo ago

thisislife2 6mo ago

I completely share your sentiment about feeling irked about open source code being used to train commercial AI models. However, I think the battle is already lost - the nature of copyright and open source code philosophy (currently) means that there isn't any real way of preventing your code being used to train AI. Look at the legal precedents being set in courts where many of the BigTechs have actually pirated copyrighted media to train their AI, and the court has said "that's acceptable". (Ofcourse, the actual act of piracy - like Facebook did by downloading copyrighted material through torrents - may not be legal, but the courts may be lenient here too as there seems to be an undercurrent of government approval to do anything to win the "AI Race"). And, even if you move your repository somewhere else, can you really prevent anyone from uploading it to Github? To do so, you may have to create your open source license.

lelanthran 6mo ago
> However, I think the battle is already lost - the nature of copyright and open source code philosophy (currently) means that there isn't any real way of preventing your code being used to train AI. Laws should make it a double-edged sword, make distillation explicitly legal. Not much else they can do.
- overfeed 6mo ago
  > Laws should make it a double-edged sword, make distillation explicitly legal. Knowledge-distillation is already legal. Current case law says none of outputs of any model are protected by copyright, so one could use model outputs for whatever they want - including distillation. That is why AI companies resort to ToS clauses to block distillation and/or training competing models.
  - pojzon 6mo ago
    Its completely 100% legal, to ask LLM to write detailed spec of any closed source project based on the code. Then ask another LLM to implement it to make it public domain. Its already proven based on previous specification laws. Hilarious as it sounds its true. We can make “any” code a public domain woth LLMs.

locknitpicker 6mo ago

> (...) I'm also remembering how GitHub used "all open repositories" to train their first Copilot without telling anyone. This is a silly opinion to hold, isn't it? I mean, you release projects under a license with the express purpose of freely distributing your code among anyone in the world that may have any interest whatsoever, and even allow they themselves to share it with anyone they feel fit. But you are somehow outraged if people actually use said code? Please make it make sense.

dylan604 6mo ago
Because there's no way the code is distributed properly according to any of the OSS licenses. In fact, it claims authorship with nonsense bylines saying the LLM wrote it.
- locknitpicker 6mo ago
  > Because there's no way the code is distributed properly according to any of the OSS licenses. What are you talking about? There is no distribution, only read access.
  - CyberDildonics 6mo ago
    What is the difference?
  - evanelias 6mo ago
    Reading means downloading. Downloading is equivalent to making a copy. To make a copy of a copyrighted work, you need a license, unless your activity is fair use. Licenses have terms and conditions that must be followed, such as retaining attribution in all derivative works. That said, FOSS licenses are non-exclusive. Regarding the original upthread topic of GitHub's copilot training, iirc GitHub's terms and conditions involve granting them a license in order to host your code. Depending what else is in those terms, they may have had the ability to use all hosted code for LLM training through that license, instead of the FOSS licensing on any given Open Source repo. But that would only apply to GitHub/Microsoft, not third party scrapers.

mannanj 6mo ago

The training on "all open repositories" is the only training we heard about. I wouldn't be surprised if it wasn't beneath these greedy companies to train on other data, and respond "oops! we didn't that would happen" (by which they mean get found out). Leaving is still the right move. But this applies to all centralized large services: Our use of Google and Google Drive, any Microsoft products, Adobe products, etc.

onesandofgrain 6mo ago

Agreed

HiPhish 6mo ago

> While I'm not forgetting the spirit of what Git is, I'm also remembering how GitHub used "all open repositories" to train their first Copilot without telling anyone. As long as your code is out in the open anywhere the slop factories can train their models at it, regardless of whether it's on GitHub or your private server. So you might as well keep using GitHub at least as a gratis mirror. My reasoning is that if I'm going to be milked anyway I might as well freeload off GitHub.

account42 5mo ago
Just because they technically can grab it doesn't mean you have to make it easy.