All public GitHub code was used in training Copilot

To me, the particular use case and whether it is fair use or not, is of minor interest. A far more pressing matter is at hand: AI centralization and monopolization.

Take Google as an example, running Google Photos for free for several years. And now that this has sucked in a trillion photos, the AI job is done, and they likely have the best image recognition AI in existence.

Which is of course still peanuts compared to training a super AI on the entire web.

My point here is that only companies the size of Google and Microsoft have the resources to do this type of planetary scale AI. They can afford the super expensive AI engineers, have the computing power and own the data or will forcefully get access to it. We will even freely give it to them.

Any "lesser" AI produced from smaller companies trying to compete are obsolete, and the better one accelerates away. There is no second-best in AI, only winners.

If we predict that ultimately AI will change virtually every aspect of society, these companies will become omnipresent, "everything companies". God companies.

As per usual, it will be packaged as an extra convenience for you. And you will embrace it and actively help realize this scenario.

If the training set contains verbatim (A)GPL code does this mean that Copilot also should be distributed by Microsoft under GPL? Because without it Copilot (as it is distributed by Microsoft) couldn't be built, wouldn't it make it a derivative work of GPL'd code (and obviously every other license)?

I see a lot of people comparing human learning to machine learning in the comments, but there is a huge difference - we don't distribute copies of humans

I am really confused by HN's response to copilot. It seems like before the twitter thread on it went viral, the only people who cared about programmers copying (verbatim!) short snippets of code like this would be lawyers and executives. Suddenly everyone is coming out of the woodworks as copyright maximalists?

I know HN loves a good "well actually" and Microsoft is always suspect, but let's leave the idea of code laundering to the Oracle lawyers. Let hackers continue to play and solve interesting problems.

Copilot should be inspiring people to figure out how to do better than it, not making hackers get up in arms trying to slap it down.

Ok, my curiosity has been fired here...

I have conjured up two scenarios here:

Let's say I use copilot to generate a bunch of code for an app, something substantial, and it regurgitates a load of bits and pieces from many sources it got from GitHub, I'd assume there won't be any attribution in it... it will be as if Copilot made the code itself (I know it sort of does but lets not split hairs!). I'm guessing the prevailing theory (from GiitHub anyway) is that I'm legitimately allowed to do this.

Now, let's say I generated all that code by manually copying and pasting chunks of code from a whole bunch of repos, whether they are open source, unlicensed, whatever. Would I not be ripe for legal issues? I could potentially find all the code that copilot generated and just copy and paste it from each of the sources and not mention that in my license. What if I told everyone "yeah, I just copied and pasted this from loads of Github repos and didn't put any attribution in my code". I'd assume that (morality aside) I'd be asking for trouble!

Am I missing something? Am I misunderstanding the situation, or the capabilities of copilot?

Calling it “public” code feels like doublespeak. It’s most definitely NOT public domain code — it only happens to be hosted on GitHub and browsable (but not copyable) by people. “Source available for viewing” is very different from “public property” as the phrase is commonly understood: https://en.m.wikipedia.org/wiki/Public_property

I think it’s pretty easy to defeat MS in court.

We just need to bring the music industry into this!

For example: Let’s train a network on Beatles music to generate new Beatles songs. I’m pretty sure music lawyers will find a way to prove that the trained network is violating the label’s copyright, as they always manage to do that.

And then we just need to use the precedent and argue that music is the same thing as code.

Out of curiosity, how do we define license violation in that case? I, as a human being, have trained by reading code, much of which is covered by licenses that are somehow not compatible with code I'm writing. Am I violating licenses?

Asking seriously. It's really unclear to me where law and/or ethics put the boundaries. Also, I'd guess it's probably country dependent.

This means that also all illegally leaked codes from Apple, CDPR, Intel, NSA and Microsoft leaks are used in the models? iBoot, Witcher 3? Gwent? NSA backdoors?

Does the copilot still learn from new repos? Can I post github enterprise code publicly to let it learn from it?

Serious answers only please

GitHub's Copilot looks like a "code laundering" machine to me.

Guys please read the Terms of Use of Github section D.4.

We need the legal right to do things like host Your Content, publish it, and share it. You grant us and our legal successors the right to store, archive, parse, and display Your Content, and make incidental copies, as necessary to provide the Service, including improving the Service over time. This license includes the right to do things like copy it to our database and make backups; show it to you and other users; parse it into a search index or otherwise analyze it on our servers; share it with other users; and perform it, in case Your Content is something like music or video.

This license does not grant GitHub the right to sell Your Content. It also does not grant GitHub the right to otherwise distribute or use Your Content outside of our provision of the Service, except that as part of the right to archive Your Content, GitHub may permit our partners to store and archive Your Content in public repositories in connection with the GitHub Arctic Code Vault and GitHub Archive Program.

Like it or not, it seems like:

* most people here are unhappy

* most laywers will say it's fine (it very probably passed MS ones)

I can understand that. Copyright was not created with AI/ML in mind, even as a random stray thought. Those were not even words at the time.

So the question is: If we change the law and require trained algorithms to only work on licenses that permit this, and to output the "minimum common license" somehow, what are the repercussion on other application of copyright?

Because the consensus here seems to be that this looks a lot like a de-licensor with extra steps

I see a lot of people trying to compare its "machine learning" to human learning.

Let's use this thought experiment: Imagine that Github's Copilot was just a massive array of all the lines of code from every github project, with some (magical automated whatever) tagging and indexing on each function, and a search engine on top of that.

Now imagine that copilot simply finds the closest search result, and then when you press a button, it inserts the line from the array, and press it again and you get the next line, etc.

Now hopefully nobody here thinks such a system would fulfil either the spirit or the law of any half-restrictive license. Yet that is a perfectly valid implementation of Copilot's aim - and it sounds like it's not that far from what actually happens, maybe with a bit of variable name munging.

So my question is this: If you could build a line between the system I describe above and the system of human learning, where a human learns the patterns and can genuinely produce novel structures and patterns and even programming languages that it has never seen before.

At what point along that line would you say that Copilot is close enough to human to not be violating licenses that require attribution?

I'm a programmer and also studied law for some time. These stories make me - once more - realize the old adage: "Possession is nine tenths of the law." Don't host that code in the cloud (or a better term, someone else's dirty bucket). What happened to developers hosting stuff on their own website!?

ML novice question: is this atypical when training models? Wasn't GPT-3 trained on a lot of copyrighted data? My gut instinct, which is based on very low-information, is that it would be pretty hard to train models if you could only use open-licensed material.

I am not surprised given who the owner of GitHub is. Now, let's assume for a while that a private repo is left marked as public by mistake and Copilot regurgitates it... Lawyers are going to have fun with that one.

Who cares? Seriously? Copilot has ripped off the absurd charade around licensing and code.

It isn't any kind of copyright infringement. The AI is not copying and pasting code that is has found, it is rewriting the code from scratch on its own.

We keep trying to take old ways and meld them to the internet, and its just not appropriate and it doesn't work.

So playing devil's advocate. What if the courts just don't care, and rule that copying code verbatim is not a crime because you didn't copy it, and copilot is not a human so it can't commit crimes. What's the net effect of a system that draws upon all public code repos? It sounds... net beneficial to society?

On the plus side, a large body of work effectively becomes public domain. On the negative side, copyleft licenses lose their teeth. You probably see more power shift to those with big budgets. You probably see fewer things made source available, because you either have the public license or the private license now. This feels like a bad path but I'm not convinced the end result isn't better still.

OP’s rhetoric, and most discussion I see, asserts that training a model on copyrighted data is a copyright violation. Personally I don’t find this to be so obviously the case. Think back to when we were listening to AI generated pop music, for instance. I don’t recall any concern in HN comments about the copyright holders’ music being used for learning.

Curious what the consensus is on how GH should have approached this to avoid such blowback.

Best case scenario, they explained in advance on the GH blog they're going to be doing some work on ML and coding, and they'd like people to opt into their profile being read via a flag setting/or put a file in the repo that gives permission like robots.txt? Second best case scenario, same as first but opt out vs opt in, and least ideal would be something like not doing the first two, however, when they announced it, explained in detail how the model was trained and what was used, why, and when- kinda thing?

Is that generally about right, or..?

Wouldn't it be the people publishing code written with Copilot that (potentially) violate any licenses? It doesn't seem to be that the tool violates anything, though it may put the _user_ at risk of violating something.

Like, don't use it if you're worried about violating licenses, but I don't see how Microsoft could get in trouble for the tool. It doesn't write and publish code by itself.

To the people arguing it's "fair use" to use this for training an ML network. Where do you draw the line? What if you train an "ML network" with one or two inputs... so that they almost always "generate" exact copies of the inputs? Five inputs..? Ten? A thousand? A million?

So...

Putting the (imho) big licensing problems aside, what about the software patents?

Apache and GPL have patent protection clauses.

Does this mean that anyone using copilot might somehow get code that implements something patented, but protected by license, except they did not get proper permission through the Apache/GPL license?

...I kind of hate myself for saying this, but... Patent trolls to the rescue?

To be fair, this could just be a mistaken interpretation from the support staffer that answered the question - they didn't sound sure ("apparently"). It certainly needs an official response from GitHub senior management but I wouldn't call the foul yet (not that it's even clear that it is a foul).

At least to some first approximation irrelevant because reading code is not subject to any license. What if a human reads some restrictively licensed code and years later uses some idea he noticed in that code, maybe even no longer being aware from where this idea comes?

But what if the system memorizes entire functions? What if a human does so? What if you change all the variable names? What if you rearrange the control flow a bit? What if you just change the spacing? What if two humans write the exact same code independently? Is every for loop with i from 0 to n a license violation?

I am not picking any side, but the problem is certainly much more nuanced then either side of the argument wants to paint it.

Open source developers need a new kind of license with a ML model training clause, so there is no more ambiguity if they don't want their code to be used in this way.

Suppose you had some kind of AI Deepfake program operating off a large database of copyrighted photos and you asked it to "make a picture of a handsome man on a horse" and the man's head was an exact duplicate of George Clooney's head from a specific magazine cover, would that be infringement? Would selling the services of an AI that took copyrighted photos of celebrities and edited them into porn movies be infringement? I don't know the answers to those questions but I find it very weird that people think large blocks of typed text are less worthy of copyright protection than other forms of media.

A direct confirmation from GitHub itself. This is problematic because Copilot sometimes outputs code that was present in its training set.

https://fossbytes.com/github-copilot-generating-functional-a...

So why did GitHub chose to exclude private repositories? Why not include everything, including the code for windows?

The outrage-bait approach in this thread detracts from it. Yes, they trained it on everything. No, it's not clear if that's legal or not (probably is) or if that is much of a problem.

The somewhat frustrating solution is to simply realize that “copyright” is one of the worst abominations humanity has ever conceived…

It’s literally being used to stifle research as we speak, but for some completely insane reason we are protecting a handful of publishers as a cartel…

It really is so simple: “don’t be a bigoted fascist”, but just have a glance at the fascists decrying my stance as a degenerate liberal, in the answering comments

Public facing open-source code & media is going to be learned by language models because they're exposed to them. That's the simple truth. Nothing can stop that, not unless all public repos are made private. Everyone has access to the ability to create their own GPT, thanks to open-source. OpenAI is not actually very far ahead of open source anymore.

The US seems well enough informed. As mentioned in the following report "AI tools are diffusing broadly and rapidly" and "AI is the quintessential “dual use” technology—it can be used for civilian and military purposes.".

https://www.nscai.gov/wp-content/uploads/2021/03/Full-Report...

I'm fully expecting that if I begin a story and put it on my blog or on github, and if I go away for a couple years, I'll see it completed for me when I return. I can use foresight to my advantage or I can pretend like it's still the 1990s as if placing some text at the top of the code I exposed publicly is going to prevent people from training on it.

One thing for sure though, I don't think a large company such as Microsoft should be profiting from training their language model on open-source code.

The best way to release Copilot in my opinion would be to make the entire thing open source and have separate models, even a private paid-for model so long it's trained on their own code.

An open source model trained on code for specific licenses sounds fine, but then the model should also follow that same license as the code it was trained on.

There's just something deeply unsettling about having a computer complete your thoughts for you without being able to question how or why.

If a company built a tool like Copilot to help students write essays, is that considered plagiarism? Probably yes, and the reason is that regurgitating blobs of text without actually thinking like a human and writing them anew doesn't feel like actual work, just direct re-use.

Same thinking probably applies to GitHub Copilot and copyright

I mean, if it's considered "fair use" legally (which is surely their position), then why wouldn't they?

Why would they distinguish between licenses if there's no legal need to?

Licenses are only restrictions on top of fair use. Licenses can't restrict fair use.

It would be interesting if someone takes them to court and a judge definitively rules on fair use in this particular case. Or I don't know if there's enough precedent here that the case would never even make it to trial. But with a team of top-paid Microsoft lawyers that gave this the green light, I'm pretty sure they're quite confident of the legality of it.

My guess is that is is fair use but...

The model is said to spit out code verbatim 0.1% of the time, a low number, but if copilot is used a lot, it means you are going to find a lot of copied code in people's projects, and these project owners may be breaching copyright. I don't think "but, copilot..." will be an excuse.

Here is a (probably unrealistic) scenario illustrating it. I am playing a copyright troll here:

- Release plenty of generic code and put it on GitHub under a restrictive license

- Have the copilot bot scan it

- wait some time

- scan public codebases and do an exact match for my code

- sue project owner that contain my code

I see the use of copilot more of a minefield for me than as a liability for Microsoft.

The solution here seems simple. If you don't want your code used for AI/ML like co pilot, then place a license in your code that explicitly forbids it. Looking at the MIT License as-is, which is used by many maintainers on github, there is nothing that forbids co-pilot. It's easy to add a few sentences to that which explicitly forbid the code being used by AI, ML, code generation or other code automation and calling it something else like the Free For Human Use License.

The sticky part may be: does GitHub T/C overrule these licenses?

I can't wait for machine learning models that given the right input nearly perfectly reproduce feature length movies or music. Its not copyright infringement, it was generated by a computer!

So would a way to do this be to train multiple models on each different code license (perhaps allowing compatible licenses to cohabit) and then have Copilot identify the license of the target project and use the appropriate model?

It might have an interesting feedback effect that some licenses which are more popular would presumably have better Copilot recommendations, which would produce better and thus more popular code for those licenses. Although maybe this happens already.

This is why I relicensed my code [1] yesterday to a license I wrote [2], which is designed to poison the well for machine learning.

[1]: https://gavinhoward.com/2021/07/poisoning-github-copilot-and...

[2]: https://yzena.com/yzena-network-license/

My question is what GitHub is going to do when people start sending them DMCA takedown notices over their code being distributed through this system.

Currently, if you claim to be a copyright owner GitHub can respond to a DMCA takedown by removing the repository. This might require them to retrain the entire model.

One option for GitHub might be to maintain a blocklist of various code snippets, and if there is a substring match, just don't make the suggestion.

It's been admitted again. This contraption by GitHub is really causing chaos in the open source world and has been trained upon all public GitHub code; essentially those who have their code hosted there publicly, gave them permission to train copilot on their code. Now they are complaining about it after all these problems [0].

I warned against hosting source code on GitHub and going all in on GitHub Actions, mainly for them being unreliable for the past year. [1] (They go down every month). Now Copilot has gone and trained on every single public repo on GitHub as admitted right in this post, regardless of the copyright.

Maybe for organisations with serious projects, perhaps now's the time to leave GitHub and self-host your own somewhere else?

[0] https://news.ycombinator.com/item?id=27726088

[1] https://news.ycombinator.com/item?id=27366397