Simply moving away from Github is not enough to protect your code if you see this as a problem. Moving your code away from Github to some open alternative doesn't stop Github consuming it to use in Copilot unless you specifically forbid that in your license. If you code is freely available to use for any purpose, as many open source licenses permit, then that includes using it as training data for a for-profit product.
You need to use a license that restricts its use, and restricts the use of derivatives otherwise someone uploading a fork to Github will just put you back where you started. I think GPL3 would give you such protections, but you should check with a lawyer if this is particularly important to you.
People keep getting this wrong. Your license is irrelevant. Copilot depends entirely on being exempt from copyright restrictions (under fair use doctrine), and you cannot restrict this with any license, because they're not using that license.
The only way you can stop them using your code so is to not share it with anyone. If they find your code (even via a leak!), they can legally use it, if their fair use claim is correct.
> Nitpick: Fair use isn't an exemption from copyright, it's a defense for violating copyright)
Nitpick: Fair use is both a Constitutional and statutory (the latter codifying the former) limitation on the exclusive rights granted as part of copyright, so it's definitely an exception.
Procedurally, it operates as a defense, but that's not inconsistent with it being an exception.
True, the contrast here would be e.g. copyright law as usually found in EU states, where the are actual, enumerated lists of exceptions to copyright. Fair dealing as used by some former UK colonies seems more similar to the EU approach than US fair use doctrine.
"Training of ML models with data not licensed to you and then selling the output of the model" isn't on those lists, and consequently is a flagrant copyright violation in - broadly - the entire EU.
If you are a developer in the EU using Copilot, it is really pretty obvious that using Copilot is a commercialized copyright violation, which is e.g. in Germany (but I'm guessing many other states) a criminal offense, not a civil offense. Now, people might say, they're paying Microsoft for this service, and that's not in the EU, so something something can't prosecute. Of course, that doesn't actually work in the real world, and this corner of prosecuting copyright violations has been extremely well explored during the many, many trials of people committing IP violations of music and films over the past few decades.
In addition to that, I'm pretty sure routine copyright violations by an employed developer would be one of the more clear-cut reasons for a termination without notice and compensation for having to replace the affected code.
> True, the contrast here would be e.g. copyright law as usually found in EU states, where the are actual, enumerated lists of exceptions to copyright.
How is that a contrast? The US has an actual, enumerated list of exceptions (the US term is “limitations on exclusive rights”, of which fair use is, in the US Code order, the first.)
Fair use itself is open-ended, and not enumerated. US law has fair use and other limitations. In contrast, EU law does not have open-ended limitations, but only the fixed, enumerated limitations. So I don't get your point here - US law leaves significant room for interpreting limitations on copyright via fair use. EU law doesn't.
They're not accurate. Or at least not accurate to most jurisdictions that've I've read up on (some countries might be set up that way but I wouldn't know which).
Take UK law, "fair dealing" (I believe it's written as) is specifically stated as "not infringing copyright". Which means it's an allowance or exception, depending on how you want to phrase it. It's not something that is technically in breach and then used as a defence in (for example) court. In fact I don't even know how that kind of law would work in practice.
However since fair use can be a little subjective at times that does mean people are often forced to defend their position that their usage of the source material fell under "fair dealing".
Generally speaking, this sounds incredibly dangerous to me - if the courts retroactively decide it isn't fair use - companies who have used Copilot generated code in their closed source offerings could find themselves in hot water.
If so, then the other edge of the sword may be sharp enough. Collect all bigco source code leaks and create a fancy Schmopilot model out of it. Publish said model on GitHub.
I suspect any such model will have weird biases that don't match public usage. Monolith code can be impressive, but it probably only happens outside the context window of Copilot.
Correct. Co-pilot is simply operating under the current interpretation of copyright law, which has provisions for fair use which is actually very important for how software development works. Fair use is crucial. Without that we can't implement proprietary APIs or allow ourselves to be inspired by other people's work. The samples of code you get from co-pilot aren't any different from those you find in a book (copyrighted and typically not OSS), on stackoverflow, or code you have seen somewhere else (for example on Github). And programmers use all of the above. If you don't like that, keep your code proprietary and refrain from publishing it.
In the same way, Google is making use of fair use by providing website titles, summaries, book samples, etc. There has been some controversy with news about them taking that too far. But by and large, they are still legal. And people of course have tried to challenge that in courts. It's just small samples being distributed, not a complete work. There are lots of examples of companies depending on fair use for all sorts of things. E.g. quoting an author or paraphrasing their work is fine. You don't need their permission for that.
Also another point here is that it isn't necessarily just MS that would be violating copyright (if the above somehow wasn't the case) but the receiver of the auto-completed code that ends up distributing that code. Because it is that code that ends up being distributed. All MS does is show you some code sample, it's the programmer that decides what to do with it. Whether you receive your sample from Stackoverflow, co-pilot, or a book is not relevant: you are responsible for the code you distribute.
Finally, the Github terms of use give Github some rights to doing things to your code if you choose to put it on Github. That probably also covers what they are doing with Github Co-pilot. That's a valid reason for removing your code from Github if you don't agree with that but of course no guarantee that Github Co-pilot would not crawl external public git repositories or that whomever you pick as an alternative wouldn't have some similar legalese in their terms of use. If these things matter to you, review it. Just because Gitlab hasn't launched a co-pilot competitor doesn't mean they couldn't.
As a GPL code auhtor, I gave anybody the right to use my code as a complete program or to build derivative programs that have a strong tie with my original code (derivative work).
I didn't envision that my code would be split into tons of little code snippets and then sold around. Doing so, the spirit of the GPL-isation of my software has been betrayed.
There's also a free flow of information argument. Citing pieces of my code is good for that flow. But MSFT doesn't seek free flow here, it seeks a money-making flow. So I disagree.
I understand your explanation and somehow, it sounds right on the pragmatic level. But on the idealistic level, it sounds wrong :-/
It's right in the legal sense. Until someone with a smart lawyer proves it wrong in a court and gets the judge to agree. Ideology does not factor into the interpretation of the law by judges in court cases. Only in the making of the law (by politicians).
On balance, you are distributing software that is copyrighted (nothing you can do about that). The GPL gives users some limited permissions that undo some of the restrictions that come with copyright. Fair use applies to copyrighted material regardless of the license and is not something you can actually restrict with a license. That kind of is the whole point of fair use. So, the GPL, it's (supposed) intentions, and idealism don't factor into the equation here. That's just not how it works.
Yes. But I'm under the impression the core issue is GH charging $10 p/m for CoP, not CoP itself. That is, taking what should be free and adding a price tag.
>Copilot depends entirely on being exempt from copyright restrictions (under fair use doctrine), and you cannot restrict this with any license, because they're not using that license.
I feel like this has not really been tested, especially in a court that resides outside the United States. Microsoft, as far as I know, probably has legal entities in other countries as well. A German developer residing in Germany could take Microsoft Deutschland GmbH to court in Germany.
That clause is doing a lot of work here. You seem to be starting with an assumption that their claim is correct, but it's kind of a ridiculous assumption. Here are the usual categories of fair use, according to the US copyright office.
"criticism, comment, news reporting, teaching, scholarship, and research"
Which of these do you think describes Copilot? I say none. I also suspect that most people and most courts would say none. I don't think "arbitrary incorporation into other works without attribution" fits even a generous definition of fair use. Some might even recognize it as a definition of plagiarism. Can you make your case instead of assuming it?
I am reporting facts, not making any judgement on the legitimacy of their claim.
As far as practical consequences are concerned: if their fair use claim is struck down, Copilot is dead, unequivocally, because the only kind of license they can satisfy is a public-domain-equivalent one, and there’s not all that much such code. This is why I said “depends entirely on”.
> Simply moving away from Github is not enough to protect your code if you see this as a problem. Moving your code away from Github to some open alternative doesn't stop Github consuming it to use in Copilot unless you specifically forbid that in your license.
I mean it does in the short term, because Microsoft trains it on public GitHub code.
Beyond that, as long as Microsoft is operating under their “fair use” theory, licensing is irrelevant: if they decide to expand their funnel to public code from outside of GitHub, yours will get sucked in if it is public, regardless of license, since their entire theory is they don't need a license.
GitHub Copilot is powered by Codex, a generative pretrained AI model created by OpenAI. It has been trained on natural language text and source code from publicly available sources, including code in public repositories on GitHub"
Yes, if it is a use that doesn't require permission from the copyright owner, the license is irrelevant (unless you can demonstrate that the person doing the license-prohibited use agreed to the license anyway, in some context that makes it legally binding such as a contract.)
In most jurisdictions, copyright is automatic. If you put no license on the code, the default is "all rights reserved"; that is, no one can do anything with it.
When its my IP i can enforce it, send them a DMCA or sue them for damages. They used my stuff without having a license to do so. If they slapped an own license on it, granting others permission to it, that would increase the damages.
For git repos, include the current revision of your master branch as metadata to an SEPA transaction. This is a legal solid proof that you had code at time X.
I consider the SEPA tagging a secondary method. If someone was to contest the authorship of my code, i'd challenge them to explain why certain passages were written in that way. Or how specific magic numbers were picked. Linus for example used the birth date of his daughters as magic numbers for the reboot() syscall.
Generally i do recommend to avoid cryptocurrencies for anything serious. Its public image is beyond repair.
AGPL sure but i would say SSPL is better in the sense that they would have to give out source code of copilot and everything in and around it. i would love if github does that once
Perhaps one should create an open-source alternative to GitHub copilot also trained on proprietary source code, such as some leaked Windows source-code, and everyone will be happy and appreciate that we can use fair-use to train such AIs.
The model may not be illegal, but anyone using this model to generate any large enough code which is verbatim copy of Windows code will be doing a copyright violation. So you'll waste CPU to create model and not use it.
The failure of the free software movement of totally removing closed-source software has resulted in the creation of GitHub and the 'open-source' crowd with the tech bros happily running along with that despite not learning anything about what happened to Sourceforge.
The only one that learned very quickly to take advantage of this was Microsoft that is buying the open-source ecosystem and offering the best tools for free. It's not only a clever pricing scam, but a form of EEE; that suffocates the likes of JetBrains which they have to increase prices themselves.
It is not early days anymore and this time GitHub is part of Microsoft and it tells us that it will be around for a long time. The tech bros cheering on GitHub and Microsoft will soon realise that neither of them are their friends and Microsoft is still at its Embrace, Extend and Extinguish ways.
> Why Copilot was trained on FOSS code but not copyrighted Windows code, and whether the company can specify all the software licenses and copyright holders attached to code used in the training data set.
Seems a case of "license respect for me but not for thee".
Microsoft are just a string of companies changing their original promises when taking over smaller companies with proper values.
Meta is said to change the policy requiring a Facebook account soon, by the way.
I would hope when they release the new VR headsets, this would come into effect.
For me Github offers the best UI/UX of all public code hosting and collaboration platforms. At work we use Gitlab, which has come a long way. But I „grew up“ with GitHub and find it hard to switch.
Moving repos between hosts is trivial; e.g. I keep bare clones on my laptop, on an AWS server, and GitHub; with post-receive hooks that keep them all in sync.
GitHub's appeal is all the add-on functionality that's not actually stored in the git repo itself; e.g. Issues, Pull Requests, etc. That can't be migrated away easily.
Anyone who (a) has concerns about GitHub (monoculture, Microsoft, Copilot, whatever), and (b) relies on such add-on functionality, should look into moving that metadata into their repos. To give Microsoft some credit, GitHub Actions already does this (via YAML files in a .github/workflows folder)
Have a look at Gitea. You can run it as a podman rootless container off the box on your local machine.
The functionality is there, the community refuses to switch. There people who still have the idea that gh is still whatvit was 10 years ago.
We tried to migrate to Gitea at my company, ~100 repositories with a bunch of mirrors, lots of CI, renovate-bot using the API, etc. It was a disaster. It was unusably slow (10+ seconds to load the list of pull requests, API calls to open a new pull request timing out after 60s) despite never using more than a tiny fraction of the resources of a 16-core server. We tried to engage with the community to find out the cause of the slowness and were met with open hostility.
A DNS or firewall problem that causes Gitea to intermittently spend 10+ seconds responding to requests, when running in a cluster alongside other containers that have no such problems? Can you describe a plausible mechanism for that?
We did some profiling and spent quite a bit of time looking at Gitea's source code, it was pretty clear in the end that it's just very very inefficient for large setups. It does an excessive amount of I/O on the Git repositories every time you load a page; there is some caching but not enough / not of the right things. We were really open to implementing fixes and submitting PRs but the community was so hostile that we just abandoned it.
It was overall an enormous waste of time and I can't recommend Gitea to anyone with a setup larger than a handful of small repositories.
GitLab UI is full of warts though. Since they are there for 5+ years I doubt they will be fixed soon. I am talking about little things - weird button-with-dropdown to start a comment/discussion on a MR, infuriating emojis (no I don't want to put a sign :man-kissing-a-man: just because I entered a smiley) and similar. It looks like either their devs are not using the product or any change is hampered by red tape.
Still, we use it, but try to use just core functionality (git, CI, issues, wiki) and avoid anything else. Always wanted to try gitea, maybe now it's the time.
It's git-only. FWIW, I chose SourceHut in part because they support git and Mercurial, and I'm a Mercurial user. [1]
FWIW, the main SourceHut developer last year moved to the Netherlands. https://drewdevault.com/2022/03/24/Netherlands-update.html , and commented "I will be re-locating SourceHut, the incorporated entity, to the Netherlands, and gradually moving our infrastructure over the pond."
[1] Also because SourceHut is whole-heartedly pro-free software, and also because I feel better being able to pay for a service than depend on the largess of a large company, and also because I don't like monocultures.
Given the breadth of services Github provide, forge federation using ActivityPub (and ForgeFed extensions) open standards look very promising. A whole host of projects are working on it, and among them is Gitea. They will likely be the first to federate with other instances, so you can work on remote projects from your own environment.
Git is useful for all your textual versioning needs - but your friends don't really need access to all your git repos.
The whole idea of putting your whole life on GitHub is a dev's equivalent of putting all your life on Facebook - an excellent idea, as far as Microsoft and Facebook are concerned. If you can't sell ads to coders, then perhaps you can sell them recycled code.
The problem with that is that at that time GH was surviving with VC money. That money entered with the promise that at some point GH would monetize their users. The "paid account" model wasn't enough for them, And now that Microsoft owns them it's also not enough. They've found another way to monetize all that code.
It surprises me though that Microsoft hasn't added a Stack overflow like panel to github. More. People are jumping between GH for the code AZ md StackOverflow for the support.
As someone else has said, the alternative isn't to move away from GH (at least not for this specific issue). The alternative is to change your license to not allow for this.
If you change your license to exclude this particular use, it's no longer Open Source (no restrictions on how it's used).
If you change your license to forbid removing the license, then there's a good chance that it doesn't hold any legal power. Reason being that machine processing is allowed by copyright laws.
I don't get what's wrong with Copilot being trained on GPL code. If I, a human, had learnt to code by reading GPL code, would that have rendered all the code I ever write GPL too? After all, all human-created content is transformative due to how our brains work. And AI isn't all that different from us in the way it learns.
If CodePilot is outputting unique enough GPL code verbatim, then a simple search can inform the user about it and he can make the decision to keep it or not. This could be a feature requirement.
You might not be able, but larger enterprises pay serious money for solutions that make sure that the code is clean, so that a junior copypaster won't make the company liable.
"And AI isn't all that different from us in the way it learns."
Citation, as they say, is needed.
We have some vague ideas of how brains learn. We have some vague ideas of how GPT-3 works. They are not the same vague ideas. Is reality congruent? Nobody knows. There is certainly no existence proof of human- or gorilla- equivalency.
The thing that worries me here is that supporters of free software wants to strengthen copyright. I would have thought that most were against IP in general or at least in favor of making it weaker. Is protecting your code against Copilot really worth giving this weapon to Disney?
Can't speak for others, but I don't want to strengthen copyright at all, I want to strengthen copyleft: anyone should be able to make something like Copilot, but nobody should be allowed to hoard it to themselves and charge money for it. It should just be free.
> But most software can be compiled (and even obfuscated), making it unpractical to further modify and redistribute a copy.
Tell that to people who remove DRM restrictions, fix bugs and then distribute the result. The only reason there aren't companies and university courses dedicated for such modifications is that it's illegal.
Go create the movie counterpart of Copilot based on Disney material and you'll see how little Disney lawyers need additional "weapons" to sue you to hell and back.
Ironically I believe GitHub should play a bigger part in OSS. They and a few other platforms have a unique position which could help to make open source software more sustainable:
The option you propose in the article is an interesting one, though not what I'd choose.
Following the idea of "make it as friction-free as possible", something I'd like to be able to do is somehow track my usages of various packages across the course of a month, then divide a set amount of money, say £15, across each of them proportionally. Each project could have whatever amount they "earned" (doesn't seem like the right word, but never mind) automatically donated to them at the end of each month.
A library downloaded 3 times a year might just have users that know how to set up a local cache, while a library used by unskilled teams will be downloaded 15 times every time they run a build.
All your model does is push people to learn how to make local caches, and it also doesn't work at all with FLOSS licenses, since there is a right to redistribute.
I think that Copilot is independent of license since it auguments/manipulates the source but the idea of Copilot is independent of GitHub and that idea needs to be explored
GitHub appears to be relying on a fair-use defense for Copilot. So it doesn't matter what license you slap on the code; if they're correct that their use constitutes fair use, as long as they can see your code, they can use it.
You could slap some kind of a clause in your license that forbids the use of your code in conjunction with an AI-powered code tool, and then try to sue people who use Copilot. Microsoft's claim is after all that training Copilot is fair use.
Although if you find your code in a project even without such a clause, you can probably still attempt to sue them for copyright violation, since most likely they are not abiding by your license anyways.
No, fair use means that you can copy the code without agreeing to any license. It doesn't matter what clause you add. That's the whole point of fair use.
The Extinguish already started to happen. I know more than one person that stopped contributing to FLOSS because they feel it has been turned into unpaid labor for tech corps.
I remember back around 2011 I went to an Ionic framework meetup where they served pizza and soda.
After listening for hours about how they basically made a streamlined design system for any company to use freely, QA began. I raised my hand and when called upon I asked whether or not anyone in the room felt that the companies who would be using it actually deserved it.
The lead dev got flustered the room went quiet for a second before they moved on.
Feels like maybe people are beginning to wake up a bit, I hope.
https://sfconservancy.org/blog/2022/jun/30/give-up-github-la...