Of all the possible outcomes of Copilot, someone suing Github and demanding they make their source code available would be by far the most hilarious timeline of the whole Copilot debacle.
I think saying all off Github source should now be GPL is going a little far but I do feel very strongly that the people who contributed to the "intelligence" in copilot (most likely everyone who has committed to a public GH repo) should have access to the training dataset and the underlying model and its weights - obviously there is a lot more involved in actually making copilot from this but it would allow other people to start to compete fairly
Of course I don't think there will be any legal route to anything of this kind but I think there is a strong moral case that obviously MS will ignore completely...
I find it hard to believe that an organisation with GitHub's expertise and resources haven't analysed (and got comfortable with) the legal issues associated with the use of GPL / AGPL software to train CoPilot - so the lack of public comment on this is surprising.
Edit: Thanks to those who have pointed out that Nat Friedman has publicly commented on this (on HN!). My mistake.
>In terms of the permissibility of training on public code, the jurisprudence here – broadly relied upon by the machine learning community – is that training ML models is fair use.
But the legal opinion will be "your in completely new waters here, it's for us to guide the legal debate in our own favor" - a fundamental part of that will be to pretend no issues exist and to wait for the moves of other actors first
My best guess is that they have a legal 'argument' which they have chosen not to disclose yet. I think it's unlikely that 'brazen it out' would have got the green light - especially for MS and GH which, lets face it, depend a lot on developer buy-in.
Oh yeah of course - I am sure they have multiple legal arguments and different ones will be deployed based on how they are legally challenged - I doubt very much they didn't see this coming - but at its heart I think MS are confident they can get away with it...
Like any criminal. The risk of getting caught and punished is balanced against the potential reward. They know the courts can be gamed long enough to make more money than it will cost them. This is the essential nature of business at their scale. Uber, AirBnb, and now Copilot: screw the law, there’s profit to be made.
You point out one of the bigger problems with the whole entire giant corporation situation we have today. What is even the point of enforcing laws against those who can simply ignore the law until it's enforced (making massive profits along the way), then pay up, and still come out the other side massively enriched from their crime?
As long as enforcement and punishment of corporate lawbreakers doesn't hurt them at all, they're gonna continue to find new ways to abuse the system and get away with it. Only way to change it is to make their crimes really hurt them when they're called to task over it.
Reading this chain of comments made me think: What if Copilot was a purely academic creation. Imagine a bunch of computer scientists from ETH Zürich created something identical. Would we be having the same debate? I'm not sure.
And yes, I do agree that some tech companies push the boundary of information and commercial law and wait to be tested by someone with deep pockets.
We absolutely would if their plan was then to produce a paid for product of the backs of all the people who unknowingly contributed - if say they were to release the model and the training corpus in its entirety then nope...
This is a valid point. FSF is very particular about requiring people to reassign copyrights to FSF when you contribute to GNU software. (It is controversial!) They do this to strenghten their legal stance. They can more effectively defend their license and copyrighted code base if the copyright is fully owned by a single legal entity. I could imagine a legal challenge by FSF backed by legal resources from EFF. All we need to do is get Copilot to spit out some non-trivial code (including comments!) from some core GNU utilities. That should be enough to start a lawsuit.
Sometimes large institutions with lots of smart people can analyze and get comfortable with positions on issues that turn out to be completely wrong a decade or so later. Happens all the time.
I'm not sure whether or not I agree that is happening here, but I've spent enough time in big companies to develop a healthy skepticism of their decision-making processes. So much groupthink.
Completely agree with the broad point on big companies. But GH is a company with a technically very engaged and informed management - I could be wrong but just blundering into this seems surprising.
What I'm saying is given the frequency that consensus positions that large institutions support get overturned, I think it is wise to treat heterodox opinions more charitably. OP's blog post could be wrong, but it should be refuted on the merits rather than with a credibility argument.
I actually rather support the OP's position - all my comments above were on the likely processes inside GH rather than the merits or otherwise of their position.
There is no groupthink, most companies have a legal department that does impartial due diligence, esp. FAANG like Microsoft.
I still don't understand how there's so much armchair quarterbacking around legality of Copilot, from people with zero legal skills and just anti-big-tech hot-takes.
I don't actually see anyone suggesting that they haven't thought about the legal implications as you said it would be almost impossible for them not to have - but just because MS believes they are in the clear does not mean they are and more than that they may well be in the clear legally but that still dorles not mean they are doing the right thing...
Seriously? This thread is based on an article where a GitHub-competitor’s developer is arguing that Microsoft/GitHub have not thought through the legal implications. The comments section is another bunch of legal armchair speculation.
Regardless, if you’d rather discuss morals - I don’t believe what they’ve done is immoral or wrong either. I use Linux, and write FOSS code and contribute to the FOSS community quite regularly.
Have you ever worked at an org that size? Because many devs completely fail to even consider legal, let alone actually reach out to them before they implement something.
I currently do and have before actually, so I'm unsure if you have?
Devs can ignore legal for a very short time, but the moment you have a team working on it, you need legal approval to continue. And if there's going to be a public launch, you have an entire legal, data, and privacy team to vet it first.
Put simply, there is no universe wherein MS's legal team hasn't cleared Copilot before launch, and I'm disappointed HN groupthink believes otherwise.
I do work at a reasonably large one, yes. Less, then a month ago a new thing was announced, and among the comments, someone asked if legal was involved. The answer was: oh, right, we'll ask them.
>In terms of the permissibility of training on public code, the jurisprudence here – broadly relied upon by the machine learning community – is that training ML models is fair use.
While your question is intellectually worthy, I doubt there is any serious case law in existence testing this scenario. I could imagine very soon, someone will create a video game that can generate art based upon a trained model. At some point, the model will regurtitate an exact replica (or very very close). Someone will screenshot it, and the original artist -- who likely was not paid -- will sue. Or musician. Take your pick. Any performance or visual arts could fall under this umbrella.
GPL'ed code is not public code. It has the license, which requires fair exchange: if you use my code, then I can use your code under the same license. M$ uses GPL'ed code, so now we have the right to use their code under the same license.
>Public means a very specific thing in this context
What are you basing that? Especially when this is what is on the Copilot FAQ:
>GitHub Copilot is powered by OpenAI Codex, a new AI system created by OpenAI. It has been trained on a selection of English language and source code from publicly available sources, including code in public repositories on GitHub.
Compliance with the license is not necessary if it's actually Fair Use.
>In its most general sense, a fair use is any copying of copyrighted material done for a limited and “transformative” purpose, such as to comment upon, criticize, or parody a copyrighted work. Such uses can be done without permission from the copyright owner.
>> If an author did not grant license to his code, then nobody can use it, by default, according to copyright law.
this is false. Fair Use is not about the license, it is a set of exemptions from copyright. for example I do not need a license to reproduce and publish a snippet of book for the proposes of review / criticism. The author may not like what I have to say, and did not grant me a license but I certainly can use the snippet under copy right law.
The Legal Experts of ML are relaying I believe on the "education" exemption in Fair use for their "training of ML models is fair use". That will be an interesting case for sure
M$ should demonstrate, how fair use works, on their own code. If they are afraid that such "fair use" will lead to copyright infringement of their code, then they have no ground to stay that same use is fair for my code.
But with this approach you can generate outputs that are identical or near identical to some of its inputs. It is clearly that copyright laws apply in this situation.
My clipboard is an ML model that trains on exactly one sample at a time. Ctrl + C is a hotkey for doing a training run on currently highlighted data, and Ctrl + V is a hotkey for generating output from the previous run.
1) You don't need a license to look at things. Copyrights reserve very specific rights: Reproduction, creating derivative works, distribution (limited to first sale), performance, display, and in some cases, transmission
2) And data can't be copyrighted.
US IP law is based on a clause in the US Constitution, and is fundamentally bounded in reach.
If you have a legal argument, please make it. If you're going to make random, incorrect, unsubstantiated statements, this might not be the best forum for it.
I'm not going to engage in a flame war here. I clearly laid out references to relevant parts of the law: (1) What a license is and is not needed for under US copyright law (2) purpose of the GPL, and (3) distinction between copyright and data rights.
If you have any sort of citation for this nonsense, please post it. Otherwise, I'm checking out here.
A computer program cannot look at things in the same sense as a human can. Moreover, a computer program is not a "public", because, for example, your smartphone is not considered as a guest at a show.
When you say that a computer program "looks" at my data, because my code is for public, it means that the owner of the computer program use my code to make derivative work without obeying of my license, which is explicitly forbidden by copyright law.
For example, you cannot pretend that your smartphone is just looking at a copyrighted film in a cinema. Nobody will ever bother to ask your smartphone, what it's doing. Stop pretending that your smartphone can "look at data".
While correct, using protected works in an AI model requires some form of reproduction. In Canada, even the loading of information into RAM is considered a reproduction (although such reproductions may be excluded from infringement under s. 30.71 of the Copyright Act, RSC 1985, c C-42).
> 2) And data can't be copyrighted.
True, but data is often an abstraction of other expressions that are protected by copyright. Additionally, compilations of data and database structures attract different protections in various jurisdictions. E.g. sui generis database rights in the EU.
So what does he mean by public? It seems to me that he is essentially saying because he can see it publicly I can use it to train anything without caring about the license?
Based on his assertion, can I take a copy of windows (or github for that matter) and train an ML on it to replicate its behavior (assuming I have such a powerful AI)? It seems to me that is essentially what follows. In fact I'd argue that this is more akin to clean-room reverse engineering.
It also seems to fly in the face of case law for using soundsnippets in songs. Isn't what the model is doing really just a sophisticated algorithmic rearrangement of samples?
“Public data” is not a legal term w.r.t. copyright. If the work is not in the public domain you cannot just use it for whatever reason you want. You must get permission from the author.
Second, code is not data, it is a copyright-protected creative work.
It’s really hard not to see this as him erasing the rights of individual developers for his own benefit.
IANAL. I don't know if that distinction exists in law. But it doesn't make sense to me. How do you distinguish code from data? Isn't the whole point of code that it is treated (by the machine) as both code and data?
Suppose I make a "copyright-protected creative work", for example a melody, and then encode that as a database table?
Suppose I have a list of population statistics? Suppose those population statistics have been ingeniously contrived (e.g. by encoding, ordering or whatever), so that given the right interpreter or compiler, the logic of a copyright software work can be replicated exactly, using the list as code?
It's hard to imagine a list of statistics that can be read by a human as easily as he can read code; but that doesn't matter. It's hard to read machine-code too; but copying machine-code without permission is infringing.
It doesn't help that copyright law has drifted over the years, and that despite international conventions, the law varies from place to place. USA and EU see copyright differently. Commenters here are not declaring whose copyright law they are referring to.
> IANAL. I don't know if that distinction exists in law.
It does. Data is not copyright-able but source code is. There is so much legal precedence around this it’s nearly impossible to contest.
Calling code data is a way to minimize its status as a copyright protected creative work, so as to defend ignoring the protections it has under the law.
Ask 10 lawyers about the legality of ML code, and you will get 100 pages of obfuscation and 1/2 answers.
The reality is there is zero case law that fits training of ML models enough for any legal expert to claim jurisprudence makes it legal. ML is too new of a technology for that claim.
If ML model is reproducing verbatim entire sections of code, I fail to see how that is "fair use" and not reproduction. I also fail to see how any legal expert would make the claim that it is.
The response of "oops it should not have done that" would also not hold up well in a licensing / copyright dispute
He's correct that AI can train, but it's not relevant.
(1) The issue is with CoPilot outputting copyrighted code AND attaching a separate license to it (looks like it's hiding the initial license and can generate another license automatically). This is reproducing copyrighted code and misrepresenting the license, neither is allowed.
(2) He posted that the output belong to the operator. It's factually wrong. Original copyrighted code belongs to their original writer, not the operator. In effect Github Copilot cannot "launder" license and it is very wrong for their CEO to claim otherwise.
(3) Looks like he's trying to waive responsibility of Github by stating that the developer receiving the code is responsible? Wrong, GitHub is responsible for their actions (vary with the jurisdiction). There's a complex matter of who's responsible when some proprietary code will end up in a company product and they get sued. The company is in violation, they can turn against GitHub for providing copyright code, GitHub was responsible for it. There's a complex chain of responsibility, any lawyer worth their salt would cringe at the claims and responsibility that GitHub is exposing itself to.
The thing that gets my goat here is that repos, and individual files, have their licenses. With effort, github could have linked snippets to the files they came from, and used a mostly-automatic process to identify the license and copyright holder of every quoted snippet. Then, as code gets generated, a conglomerate license could be assembled in parallel. It could emit warnings that licenses are incompatible, or better yet, give the user a choice over which licenses they find acceptable and disallow incompatible licenses.
This whole thing could be done above board, and it's pure sloppiness on the part of github that they've chosen not to.
That’s an understatement. There is a deep lack of understanding of IP issues as demonstrated by their public representatives. Surprising for a company like GitHub where software IP should be a part of their core competency. They have made defenses like “it’s public data” which means nearly nothing in regard to copyright enforcement. The Avengers is public “data” (it’s not data in terms of the law), that doesn’t mean you can use the content for whatever you want. It shows a total lack of respect for the work that the FOSS community does and their rights. This has irreparably changed my perception of GitHub forever in a strongly negative way.
> With effort, github could have linked snippets to the files they came from, and used a mostly-automatic process to identify the license and copyright holder of every quoted snippet.
Actually, they should not be able to, as the whole point is that CoPilot does not just paste code, but instead understands it and applies knowledge, not finished snippets.
The fact that it does paste snippets is the problem, not the authorship of the snippets, as these simply should not exist.
On one hand, there's a whole field of study on explicable AI and I'm unconvinced that this cannot be baked into that automatic reasoning process.
On the other hand, a wholly independent system to search the training set based on AST matching and text similarity could solve this problem in the majority of cases.
Considering that their entire business model from the start has been "capturing the open-source ecosystem onto a closed and proprietary platform that doesn't interoperate", I'm more inclined to assume malice here than 'sloppiness'.
Edit: By which I mean that their approach most likely just couldn't work well enough for end users, in terms of hassle, if they actually did it above board and included licensing information. So not caring about that was the profitable option.
> It shouldn't do that, and we are taking steps to avoid reciting training data in the output.
Seems like he agrees with you that __reproducing__ copyrighted code is not permissible. Doesn't answer the broader point about training with that code.
Whether or not the AI can be trained on GPL'd code without becoming GPL'd itself is completely relevant. That's what the article is about.
If it can then there's no problem unless CoPilot actually did produce code that was a close copy of GPL'd code and GitHub used it. Their own analysis says that that is really unlikely and easy to prevent anyway.
> I find it hard to believe that an organisation with GitHub's expertise and resources haven't analysed (and got comfortable with) the legal issues associated with the use of GPL / AGPL software to train CoPilot
Almost certainly. But what people tend to forget is that "working out the correct legal interpretation" isn't actually the job of a lawyer; it's the job of a judge. The job of a lawyer is to devise a legal strategy that works for the client.
In practice that will quite often mean "yes, this is illegal, but we will publicly claim that it's legal and ride the wave, and the consequences will cost us less than we can profit off it".
Even if it's not explicitly stated like that and couched in vague "legal risk" handwaving, the lawyer ultimately works for their client and that's who their allegiance is to, not to the law.
I think the maximalist interpretation of copyright as it applies to software is dying out. Just as the phrase "Once upon a time" certainly isn't copyrightable its equivalents in software obviously cannot be either. While the legal system hasn't 100% caught up to this fact because software is still a relatively new thing, it eventually will. Implementing, for instance, Dijkstra's algorithm with the help of a tool that has read a bunch of GPL'd code will not create a derived work, the comments can get you in trouble certainly, but without them I have a hard time seeing it. Even so the standard for damages in most of the world is actual damages.
When the same problem was with Google News - news industry saying, that Google just takes their copyrighted work and makes it available for free through machine learning - people on here usually sided with Google.
That isn’t what Google News does. Google News takes a snippet and links to the full story, the equivalent of, say, taking the type signatures from a library and then linking to the library.
Not quite - they would need to determine the relevancy of the news story within clusters of stories as well, so it's likely they would take the whole article in order to feed into the clustering algorithm. The result is that a number of articles are clustered together through that algorithm and displays a link to the story with a snippet to allow the user to determine the relevancy.
Thats probably the difference that explains the different reactions. At the end of the day, Google News gave traffic to publishers websites. Copilot is very different.
The difference to my eyes is that while Google News processes the article, it doesn't spit it back out. It tags it for searching and for sorting into a directory, and presents it within that directory in the same way it would be displayed in any search engine.
I've always thought the riskiest part of Google News are the tiny thumbnail images used to illustrate each story section. I wonder if they pay for those; I think they might.
There’s a curious tendency in these discussions to focus on the GPL as though it were special. If the original licenses apply, then you’ll be embedding code under all kinds of different licenses—some of which are sure to be mutually incompatible.
To be sure, the infectious nature of the GPL is likely to be a bigger deal, but permissive licenses will be violated by missing acknowledgement just as much as the GPL will be violated by not licensing your code GPL.
If this license-washing doesn’t work, then you can’t just say “we’ll exclude GPL sources”, because you’ll still be breaking the rules on any copyrighted work that doesn’t have very specific public-domain-like do-whatever-you-like-and-don’t-acknowledge-me licensing.
The whole thing truly does depend on the fair-use classification of ML models. If that falls apart, the entire thing’s done (and a lot of other ML stuff will be, too). And that’s where regurgitation becomes so problematic, because it directly undermines that fair-use exemption.
Yep. They would have had to filter their training data down to the most permissive licenses to be entirely safe. The WTFPL, CC0, and any others that give full "do as you please" permissions.
WTFPL and CC0 apply to a tiny fraction of FLOSS software.
More importantly, just because a chunk of code is published under CC0 on github that does not give you any guarantee that such code is not already breaching an existing copyright.
It happened in various occasions that closed source code was leaked into FLOSS projects and if you reuse it you are in breach of the license as well.
This is specifically addressed as not a solution in the article.
For example MIT, one of the most permissive licenses there is, still requires you to include the MIT license and copyright notice "in all
copies or substantial portions of the Software".
You might be one of the people that down-voted my submission. This is probably a language problem, I don't think the original MIT license is a permissive license at all in this case.
In the open source space, the term “permissive license” is well understood to mean licenses like MIT and Apache2 and CC-BY, which allow you to do whatever you like with the work so long as you acknowledge the author and license terms.
It sounds like you meant something more like a public domain dedication like CC0, which is about the only way you can go more permissive past the likes of MIT/Apache2/CC-BY.
Also, CC0 etc. are not really called "permissive licenses", because they explicitly waive away any and all rights a license would entail. In the same way "off" isn't a TV channel.
Creative commons specifically calls CC0 an "alternative to our licenses" [1]
Or zero-clause BSD and ISC. Although both are generally discouraged and EU advise on using MIT instead, which we now end up with the acknowledgement problem.
It's not "fair-use classification of ML models". If the ML black box:
- produces an output
- that output is the exact same thing - text, code, image, et c - that went in
- that thing is licensed
- fails to fulfill the requirements of the license
than it's breaking the license. I don't see how it can be wiggled around.
The black boxes that produce entirely different outputs, or the ones that slurped billions of photos without even blinking at license but never vomits actual images are, at least, not reproducing the source material.
I think another important analogy is that you couldn't do this same operation with a human. In my eyes a human and an ML algorithm are both "agents". An ML algorithm is a computerized actor on a system but they are still able to do something novel based on previous inputs. If we take these two scenarios:
1. A hypothetical employer asks an employee to find a really fast algorithm to find an inverse square root. The employee has a perfect memory and can regurgitate fast inverse square root from Quake 2.
2. A hypothetical employer asks an employee to find a really fast algorithm to find an inverse square root. The employee uses this ML algorithm to generate the code which essentially regurgitates the only previously seen inverse square root function it was trained on.
At some point in time in the future id Software sees this is happening at our hypothetical company and sues. In neither situation is the "actor" held accountable since the "actor" was employed by the company which allowed for practices that enabled this infringement to take place.
I think an important legal question is: Do we consider a ML algorithm being trained on data the same as a human reading prior art for an innovation?
> I think an important legal question is: Do we consider a ML algorithm being trained on data the same as a human reading prior art for an innovation?
It seems pretty obvious that it is the same thing to me. Instead of the human reviewing the prior art themselves the human has written a program to do so, but this can't change the acceptable outputs produced by the human's creative process (that includes the ML in this case).
I agree with this sentiment but I don't know if the courts do. There is so much cruft in the legal system from problems entirely removed from today's moral and ethical standards for disagreements from bygone eras that will be used as case law here.
It's more complex. Are you laundering 5 lines of code? Probably fair use. Are you laundering Windows? Clearly not okay. Are you trying to launder, or is it unintentional? Etc.
There's a line somewhere, but it's somewhere, not at either edge, and it's a complex, odd-shaped line we haven't yet defined. I don't know where it is. However, it's not where you're putting it, and there isn't a slippery slope to "IP is over." If you use five lines of my code in a different system, IP hasn't ended.
> Are you laundering 5 lines of code? Probably fair use.
The amount of copying does not matter for a copyright claim. If you copy a single character from a codebase that could could get nowhere but there, and lawyers could prove it, that could go to court. This is a hypothetical but this is entirely possible. There have been copyright cases fought over single sentences especially in the music industry.
> Are you trying to launder, or is it unintentional?
I'm not a lawyer but in the US, Copyright is a strict liability statute which means intent does not matter.
> that could could[sic] get nowhere but there, and lawyers could prove it
Also, the letters in this case are not representative of the creative work itself. If you used the title font to write your post (hypothetically, I know HN does not allow this), you'd be in bad water already.
I could copy a whole sentence from the book and it would not matter at all.
Or even 5 lines like the parent post said.
>....you'd be in bad water already.
Not true either, writing my message in harry potter font would do absolutely nothing. the internet is full of images which use these or similar looking fonts. Its called fan art or whatever, copyright laws are not applicable to this.
Bear in mind that there must be creativity in that choice of character to qualify for copyright protection. If only one character is correct, there's no creativity.
A sentence in a song has far more discretion for creativity than a single character in a software program.
As best as I can tell, you would need to construct some sort of super-APL where "a single character" had significantly more information content than any Unicode glyph, to exceed any de minimis standard applied to a programming language.
(Think Prince's "Love Symbol".)
> that could go to court
I think you mean "that could be found infringing." Going to court is trivial, even if there is no infringement.
> As best as I can tell, you would need to construct some sort of super-APL where "a single character" had significantly more information content than any Unicode glyph, to exceed any de minimis standard applied to a programming language.
Even if you didn't have the street's name, if you copied the road on the map (no words, just the shape) they would know you stole their IP. I do not think there is literally a character that would satisfy this condition. The point of what I was saying was the "size" of the copying does not matter at all.
The Substantial Similarity is explicitly about this phenomenon. For something to be substantially similar, from a software perspective, you could hypothetically see the modules and data structures contain roughly the same data types and that the flow of logic is the same. You could also point to a function and say "these are the same variable names". Substantial similarity is not the only component of a legal analysis of a copyright claim. Another important component of copyright is if someone had access to the material. If I had code on my laptop that I showed to no one, uploaded nowhere, and at some point I find another developer who is doing some code that is character for character identical to my work, I likely cannot do anything.
The law is complex here, I am not a lawyer, but I think the important component here: The length of copying is not a factor at all. If for some reason your algorithm requires `magic_code.seed(20154)` and your code does this by doing `magic_code.seed(ord('人'))` and you find someone else doing the same thing you'd definitely want to investigate what's going on there.
The entire copyright doctrine is created to help protect the creativity of an author. If there is something creative in your code that is copied, you likely have a copyright claim you could argue.
Your scenario was "If you copy a single character from a codebase that could could get nowhere but there". It was that "entirely possible" scenario I questioned.
Not "roughly the same data types", "same variable names", "magic_code.seed(20154)", etc. I have no question with those. Those are enough characters that they may contain creative - and thus copyrightable - content.
That is, I question your assertion that 'the "size" of the copying does not matter at all' by asking you to come up with an entirely possible scenario for why there is no de minimis case in software, even down to a single character, when there is in every other area of copyright.
BTW, the WP page you pointed to notes that "Trap streets are not copyrightable under the federal law of the United States." Thus, "stole their IP" has no meaning - they have no copyright, trademark, patent, etc.
> I question your assertion that 'the "size" of the copying does not matter at all' by asking you to come up with an entirely possible scenario for why there is no de minimis case in software, even down to a single character, when there is in every other area of copyright.
Where in copyright law for any area is there an established minimum "length"? I've never heard this nor heard lawyers claim of such a thing.
I never made that claim. I even posited a "super-APL" where a single character was enough to contain the creativity which is a prerequisite for copyright protection. Such a language does not exist, and I don't think it ever could, but there is a slightly-greater-than-0% chance that it could happen.
OTOH, your original context for an "entirely possible" scenario at https://news.ycombinator.com/item?id=27730596 was "The amount of copying does not matter for a copyright claim", which implied your scenario was not that hypothetical example I posited.
(A 1E-20 probability * maximum expected lawsuit payment with successful lawsuit = don't worry about that scenario.)
We do know that the courts have decided many cases are de minimis non-infringing use of materials otherwise under copyright.
Do you think there is no acceptable de minimis argument in software? If not, why is software somehow special compared to other areas of copyright?
If 'de minimis' use exists in software, what realistic scenario are you thinking of where a single character is enough?
To be clear, I think zero shared characters can still show copyright infringement, for reasons you mentioned about abstraction-filtration-comparison.
But your "entirely possible" example had no other shared similarities beyond a single character, and I can't see how any court wouldn't think that was a de minimis use of that character - assuming it had copyright protections in the first place!
>> Are you laundering 5 lines of code? Probably fair use.
>The amount of copying does not matter for a copyright claim.
This is incorrect. The amount of material used is the third factor in a fair use test. There are other ways it comes up as well (e.g. damage calculations).
>> Are you trying to launder, or is it unintentional?
> I'm not a lawyer but in the US, Copyright is a strict liability statute which means intent does not matter.
In this context, this is incorrect as well. People seem to be misinterpreting laws pretty badly, so instead of explaining how to apply here, I'll give a simpler, analogous context:
In this context, it depends on a lot of things, such as direct versus contributory infringement. This would likely be a contributory infringement case, where intent is almost a requirement. https://www.legalmatch.com/law-library/article/what-is-contr...
Keep in mind these are all factors. They matter, so they'll help swing a case one way or the other, but they're not something you can bank on in isolation. That's what will make for interesting case law.
> This is incorrect. The amount of material used is the third factor in a fair use test. There are other ways it comes up as well (e.g. damage calculations).
The 3rd factor of the fair use test deals with how substantial the copied material is in relation to the entire work. You can make a copy of 100% of the original work and have it still be fair use while in another situation copying 0.002% of an original work would not be fair use. The measurable amount (bytes, seconds, square inches) you are copying does not matter here. Instead the "importance" of what you are copying to your criticism is being defined in this prong.
For instance:
I am a movie buff and:
1. Make a copy of the entire movie of Citizen Kane
2. Remove the audio and replace it with a commentary track going over every framing/camera trick through the movie
3. Upload this to an educational youtube channel that teaches viewers how to shoot a movie
I would likely be allowed to use fair use as a defense to a copyright claim. Here, if an expert could say all 100% of Citizen Kane's film, contained relevant film techniques that I was actively commenting on, I would have copied the correct amount for my usage.
If I instead owned a movie review channel and I said "Citizen Kane is my favorite movie" and I displayed the entire movie after that I would likely not be using an appropriate amount of the film.
It's also important to note that fair use is a very narrow defense that covers a very limited subset of uses. It is not a generally applicable, or even a guideline, for how to skirt around copyrights.
There are plenty of errors in this, and you're confusing the four prongs, but I'll run with it for now, since it's good enough.
If I am doing code autocomplete, and copying three lines out of your program, those three lines are exceptionally unlikely to be "substantial ... in relation to the entire work."
Where you're confused is lots of places, but the biggest one is you're mixing up the prongs. Most of the reason your Citizen Kane example might work (it probably wouldn't) is Factor #1, character of use. Commentary and education are favorable.
I can come up with examples where 0.002% of an original work would not be okay, but they're pretty contrived.
> The amount of copying does not matter for a copyright claim.
It absolutely does for fair use analysis, see 17 USC § 107: “[…] In determining whether the use made of a work in any particular case is a fair use the factors to be considered shall include—[…]the amount and substantiality of the portion used in relation to the copyrighted work as a whole”
My point is only that running the text through an ML algorithm changes nothing. If the 5 lines are fair use, you could have copy pasted the lines yourself. If its infringement, it doesn't matter which tools you used to put the infringing code in your file.
One big difference is that the human will (... hopefully) never be considered themselves a derivative work, whereas there seems to be a case to be made that the model is.
Algorithms are not subject to copyright. Writing and copying an inverse square root is fine, doesn't matter if it's human, computer or alien.
The trouble is verbatim copy of original copyrightable code, with an attached license that doesn't allow it. Github is most likely in violation because it's doing just that.
However that specific square root square example may or may not be a violation. There's a difficult question of what constitutes original copyrightable work, a trivial well defined algorithm isn't, a larger code with comments could be.
> Writing and copying an inverse square root is fine, doesn't matter if it's human, computer or alien.
This is very myopic because there's a big difference between "memorizing an algorithm" and "memorizing an implementation of an algorithm".
> There's a difficult question of what constitutes original copyrightable work, a trivial well defined algorithm isn't
I don't think copyright law agrees with this sentiment in the US. Even the spacing, variable names, and comments are non-functional attributes of this code. And, this also goes further, because the machine code it produces is also data that has copy rights. There's layers and layers of complexity here that is difficult to enumerate with forum posts.
>>> This is very myopic because there's a big difference between "memorizing an algorithm" and "memorizing an implementation of an algorithm".
No there's isn't. An implementation of an algorithm is not copyrightable. It's specifically cited as an exception in European directives.
I should say I speak more from a EU perspective. US may vary slightly. Both vary by country/state as well.
There is a challenge with determining the threshold for copyrightable original work and it's not the same in every jurisdiction. That we can agree on. (I personally think comments are a big problem because they're always freeform text). In my opinion the tool should consider doing an autoformatting and removing comments, to avoid these issues.
>> "There is an observable trend in US law, based on fair use and older notions in US copyright law of the need for creativity, that judges give a looooot of leeway to “machines that read”. Copilot fits pretty squarely in that tradition."
It’s more of I created a search engine that is context aware. Then claiming that it generates novel code because it can take snippets from multiple sources. Then have a bunch of people not understand what it is then are trying to claim it does x which would make this a general ai.
It can be wiggled around. For example, if I ship a robot which can paint a famous painting, but not the painting itself, I would argue the copyright violation happens by the user of the robot when it paints the painting, not by the maker of the robot.
If that's something I'd planned on and intended, and you own the copyright to the painting, you have all sorts of legal tools to go after me -- contributory infringement, collusion, and so on. Still, contributing to a legal violation is not the same as engaging in one.
I suspect an argument can be made that github now incorporates AGPL code generated by co-pilot, and so is AGPL. A fair use argument might be made as well; we've all copied one-liners from blog posts and tutorials, and that's okay. I'm having a harder time seeing a reasonable argument that an ML model is directly infringing just because it can produce a copyrighted work, though.
So I don't think it's a cut-and-dry legal question.
I will give a caveat: Coders tend to read laws much too literally, like computer code. When I was was an obnoxious teenager, I thought I'd found all sorts of contract / license / etc. loopholes in all sorts of legal documents, and I considered myself profoundly clever, thinking I'd outsmarted the lawyers.
Nope.
In college I took law classes, got into the real world, did a few startups, and saw a few legal cases. Court systems have technical rules you need to be aware of, of course (e.g. if you miss a deadline....), but interpreting the law is really grounded in common sense. Common sense is culturally situated, and ours is situated in hundreds of years of case law.
> copyright violation happens by the user of the robot when it paints the painting, not by the maker of the robot.
Thats very interesting. Because AFAIK Github is not "shipping" copilot to anyone. They run it and make it available only to those that use their online editor.
If the user of the robot is responsible for the copyright violation, then the user of Copilot is responsible, correct?
If that's the case, then there will not be any users of Copilot except those that unknowingly open themselves to liability. I suspect there will be few.
I would be okay with that situation. But I'm not okay with the situation as it currently stands.
Where it stands: We have a new technology. We don't really understand it. There aren't well-defined ethical or legal bounds. We're figuring them out, blumbering along as we go. People are trying things, and are making all sorts of arguments, some of which will stand the test of time, and some of which won't.
I'm more concerned when we do this with weapons, medicine, or social science, but an autocomplete tool seems like a relatively benign place to start figuring this out.
I don't want to agree with you that an autocomplete tool is a relatively benign place to start, mostly because I am upset about GitHub using my code in this way. But you are correct.
But let's fix this before it goes further, especially since mindlessly copying output from a machine will probably result in more bugs.
Unlike humans, ML models can be attacked to pull out the original training data.
Not all networks are susceptible to this, but if you can get a 1:1 copy, that's no different from bittorrent, limewire, or KaZaA. That doesn't seem implausible for text.
Napster was an easy litigation mostly because of intent. There was a document trail a mile long that the primary goal of Napster was to facilitate copyright infringement, although on paper, it could be used to share anything.
Cameras, xerox machines, and audio recorders can all be used for infringement, but aren't illegal since that's not their primary purpose. For even finer lines, see the Betamax case. You can also look at cases about different sorts of transformations and transmissions:
- I buy a DVD. It is transferred via USB cable from a DVD player connected to my computer, temporarily copied to computer memory, and then shown on my monitor.
- I buy a DVD. It is transferred via the internet from a DVD player in my data center, via the Internet, temporarily copied to your computer memory, and then shown on your monitor.
Can you see how these have nearly identical technology, yet different legally? If you ever take a law class, there are a lot of discussions about how to draw such lines (disclaimer: IANAL, but I've sat in on law classes before).
To be clear, I'm not taking a stance about where this ought to land legally. I don't know. But the analogy to bittorrent, limewire, or KaZaA is a faulty one.
GitHub and Microsoft intend to commercialize Copilot. This means they are taking huge swaths of copyrighted material that they did not license and using it to sell a commercial product. That really hurts their “fair use” defense. It’s even worse since they are facilitating the customers to pirate copyrighted material as well, which doubly harms their case.
>>> For example, if I ship a robot which can paint a famous painting, but not the painting itself,
Plot twist: Depending on the jurisdiction, you are responsible for distributing means specifically designed to circumvent copyright, which makes you liable for a much greater punishment, and liable for every reproduction done by your users.
There's a reason that painting robots are sold as general painting robots for various industrial usage, they're not advertised to and shipped with templates to reproduce copyrighted paintings. ;)
> if I ship a robot which can paint a famous painting, but not the painting itself, I would argue the copyright violation happens by the user of the robot when it paints the painting, not by the maker of the robot.
How is that different than sending someone a jpeg of a copyrighted painting? Or the jpeg and the executable that can render the jpeg. Or the jpeg and the executable and the computer it runs on. Each of those gets closer to what you said.
> It's not "fair-use classification of ML models". If the ML black box:
> [four part test for rejecting fair use that has two obvious conflicts with the nature of the fair use exception deleted]
There is no such thing as the "infectious nature of the GPL". Just like any other license, it has restrictions. If you violate them you are breaching copyright law.
Github contains plenty of software uploaded without any license, which, by default, means closed source. Similarly, if use significant portions of those you violate copyright law.
There is no concept of "infection" and "virality" in copyright law.
The fact that GPL isn’t special is exactly what I’m saying.
But I think you know what I’m referring to by “the infectious nature of the GPL”: that such licenses as GPL and the CC-SA family require that derived works be under a similar license. And the fact of the matter is that people are likely to care about that a bit more than missed attribution, whether they should or not. But, as I say, it’s still violation.
No, that’s no different. With all licenses, derived work must comply with the terms or else be illegal.
For something like MIT/Apache2, the burden is that your derived work must acknowledge the copyright and license of the original work.
For something like GPL, the burden is that your derived work must acknowledge the copyright and license of the original work, and must be under a similar license to the original work.
So yeah, it requires more of you, but it’s fundamentally the same proposition of “obey the terms or it’s illegal”.
The legal conclusion of a case where one embeds GPL Code, but doesn't release their own code is, as always in law, hard to predict. However gpl-violations.org documents different court case which ended in publication of code based on GPL'd code.
OK, I see where you’re coming from now. I’m still sceptical that it’d be fundamentally any different: I wouldn’t expect a court to be able to compel them to release their code, only to order that they either comply or cease distribution, and issue fines—both of which would be the same on any license, though to be sure compliance is easier on permissive licenses than copyleft licenses. (I also note that you could easily have mingled other-licensed stuff that says you must not release the code; I wonder what a court would make of such a situation; I doubt that they’d quite order you to violate one license in order to comply with another.) Do you have a link for a particular case where an entity was ordered to release their software?
Absolutely incorrect. With the GPL the distribution of software contrary to the terms of the license remains illegal just as with any software under any license.
As with any other software you must either stop distribution or come to an agreement with the party owns the copyright to the code. The GPL merely provides you a get out of infringement free card whereby you may release all of the code under the GPL. This is different only insofar as it is more permissive not less compared to proprietary software.
The idea that the GPL infects your code is a fantasy.
The concept of infection is in the license terms of the GPL. It requires any code derived or linked against GPL software to also be GPL. This is where the term "infectious" comes from. As the previous poster says, this isn't the question here, as most licenses have terms which are not fulfilled by the copilot, if it is considered a derivative work. BSD for example requires attribution which copilot doesn't do either.
There's an interesting dichotomy here. Linux is super-successful largely because it is GPL, but only because the syscall boundary (as a widely-accepted "GPL firewall") separates it from company code.
Meanwhile companies will more or less blanket-ban GPL and AGPL software, even if the terms would not impact them at all.
What annoys me most is that the “infection clause” so often results in a strictly worse user experience. Take Audacity, it’s a fully open source piece of software, but to do lots of common operations in it you need to figure out how to link in FFmpeg. This is something your or I can do no problem in our sleep, but it’s an absolute dealbreaker for someone like my dad, and probable millions of other people trying to get into audio projects using free software. I imagine a large number will simply bounce out and stick to GarageBand or whatever.
I’m conflicted on this, on one hand I think FFmpeg is a brilliant piece of engineering and I want the creators to receive credit, but on the other I think Audacity and its built in components as listed in its “third party licenses” document are brilliant pieces of software that do receive credit. Further, I believe the one of the primary purposes of technology should be to enable the masses to create, and this licensing places an arbitrary yet powerful restriction on that for folks who aren’t already computer-proficient.
> Take Audacity, it’s a fully open source piece of software, but to do lots of common operations in it you need to figure out how to link in FFmpeg.
Audacity and FFmpeg are both under the L/GPL, compatible versions even. The reason Audacity doesn't include FFmpeg is because they are afraid of software patents. GPL has nothing to do with it. At all.
> Because of software patents, Audacity cannot include the FFmpeg software or distribute it from its own websites. Instead, following the links below to instructions to download and install the free and recommended FFmpeg third-party library.
What you are describing as "infection" is in fact an extra escape hatch for license violators not an extra restriction.
If you incorporate closed source software into your work you may stop distributing your software or rip it out possibly while paying a massive fine.
If you incorporate GPL licensed software into your work you may stop distributing your software, rip it out, OR release your software as GPL. Furthermore while being discovered using someone else's proprietary software in yours will almost certainly result in at best a threat of near instant lawyer assisted corporate suicide using GPL software the same way has historically led to a strongly worded letter and months to years to fix your problem.
This is to say that nearly all copyright is inherently viral and GPL is slightly less so than many because you have additional options. Hearing people, many of whom metaphorical develop software Ebola for a living describe the GPL as viral is in a word, amusing.
You’re comparing it with the wrong thing. When people speak of the GPL as infectious or viral, they’re comparing it with permissive licenses like MIT/Apache2, not closed-source licenses.
Particularly nobody says proprietary licensing is viral even though most licenses are and almost every refers to and focuses on the fact that you may avoid infringement by releasing the combined work under the GPL often confusing the fact that you can for must or even assuming that the combined work is automagically GPL.
Also aficionados of permissive licensing seem to be frequently not only OK with proprietary licensing but approve of the fact that code can be used in such a fashion. It's almost as if the attitude is everyone's else's work MUST be free for ME to use in MY proprietary code else they are somehow taking away MY freedom!
> It requires any code derived or linked against GPL software to also be GPL. This is where the term "infectious" comes from.
And it's still an incorrect and arbitrary use of term.
If you release software that is breaching GPL due to a dependency you have many options to rectify the issue.
Under no conditions your software "catches" a GPL "infection" and magically changes its license while you are not looking. There is such concept in copyright law.
It’s a really interesting tendency. People treat GPL as more restrictive than the lack of a license. I was wondering about this in the thread on GPT-J last night.
Maybe it’s easier to see an issue when the GPL specifically lays out the creator’s intent, compared to the nebulous intent and law that underlies unlicensed content. GPL focuses the discussion on a concrete license rather than the entire body of IP law around fair use.
Or maybe it’s just easier to see an issue when it’s “our” community’s content being used.
> Another tweet suggests that, if the answer is “no”, GitHub Copilot can be used as a means of washing the GPL off of code you want to use without obeying its license.
eevee’s tweet actually suggests the opposite: that even derivative works of GPL-licensed software must also use the GPL.
I think this is an interesting problem that will likely be discussed for the forseeable future. On one hand, finding large datasets where you have a legal guarantee that all data is licensed for thus purpose is impossible. If you say that a license needs to be obtained, you'd make such products impossible. If you say that a license does not need to be obtained though, you get the situation that you can launder licenses. Either GPL, or even proprietary licenses if it ran through a decompiler.
The pessimist in me believes that this fundamental conflict will be used by big established players to get rid of smaller competition, and otherwise won't benefit anyone.
Ultimately, this question also involves one of humans. When I read a book on programming, and use some of the tricks I've just learned in a project of mine, do I violate the publisher's copyright? Do humans posess a "license to launder" that silicon training circuits lack?
The author and the book were published for the exact this reason, you learning stuff .
But in this case situation is different, someone creates a blackbox program and puts in all of your code that is under license X . Then they sell this blackbox program, and depending on what input people give to the blackbox it will output parts of your stuff. If your stuff is original then the chance is that most of it will be inside the blackbox and it will be spit out with the right inputs, and copyright and licenses are now washed.
Personally I am surprised on how amateurish this seems to be, seems like they used mostly text as input and not something more advanced , if MS did not put the properietary code they own in the blackbox then I am also suspicious.
I deleted my GitHub almost a year ago, for reasons (see later).
Apparently this doesn't prevent them publishing things in the Code Vault, or via this; that I might have wished to remove from their custody.
User agreements that amount to "you agree to be used," I guess.
If whatever stalker that I offended becomes unhappy that they might not have gotten my code off the net completely, are they gonna blame GitHub for it, or continue to try getting others to take actions against me? If some court sided with them and decided I had liability for publishing that code; would GitHub's possible resurrection of it be their responsibility, or mine?
EDIT: previously stated "after they offered me the option to do that or adopt a Code of Conduct on a single contributor project of mine."
Perhaps I'm wrong about the source of that; but I did delete my account and expected that they would no longer publish my code as such; others had forked things and that was as expected.
> I deleted my GitHub almost a year ago, after they offered me the option to do that or adopt a Code of Conduct on a single contributor project of mine.
As in: they reached out to you directly and stated "you must adopt this CoC or we'll ban you from GitHub"? I can't find any other instances of people encountering this...
I may have fallen for someone's scam; i haven't heard of anyone else offered that choice, either. Then again, i was asked to pull that stuff off Steam Workshop too; which is also similarly unheard of afaik.
> I deleted my GitHub almost a year ago, after they offered me the option to do that or adopt a Code of Conduct on a single contributor project of mine.
For which code did they use copilot. If it was just software for internal use, there is no real problem with the GPL. That only starts when you distribute binaries based on GPL-ed code.
It is not a derivative work if what they say about copilot is true. This is the same as a human learning to code from gpl libraries and then generating code from memory. Obviously it is less likely to be the same and is definitively not derivative.
While I disagree with this sentiment, if we take this as true and consider it "the same as a human learning to code from gpl libraries" this opens up an entirely different can of worms when it comes to patent assignment.
If you read something that is copyrighted and rewrite it from memory, that’s still copying for purposes of the copyright act. There are cases about music where that’s unintentionally happened and the inadvertent copier was held liable. It’s basically what the machine learning is doing. Committing something to memory is no defense to copyright - I would recon a good number of people could recite any number of copyrighted works from memory (e.g., episodes of The Office, Seinfeld, or popular songs). If a person wrote that down and tried to sell it, I’m convinced a court would hold that person liable. There is a defense of “independent creation,” but basically if you saw/heard the copyrighted work before then it’s very hard to use that as a defense.
If copilot produces a verbatim copy or just small changes, like changing the names of variables, for a long enough piece of code, this is definitely copyright infringement if they don't obey the license terms of the code that copilot "learned" from.
You’ve fallen into the trap of thinking machine learning = human learning. It’s not at all equivalent. You can’t give GP3 4 years of course work at Carnegie Mellon and get autopilot. Similarly you can’t get a human to consume the complete GitHub corpus and even if they had the time they’d be unable to repeat code snippets they read verbatim with simple prompting.
I’m not sure technically how difficult it is for copilot to give an attribution when needed.
But as a temporary legal fix, couldn’t they put all the attributions in one large file and after each output of copilot write: “results based on the work of these people [link to attributions.txt].“
In fact, it would probably hurt their "fair use" argument to make a token effort to comply with more permissive licenses while failing to comply with the GPL. They're better off continuing to argue fair use.
That assumes attribution is the only issue here. It's not. Code under open source licenses comes with other conditions (warranty disclaimers, release under open source license, etc).
The harsh truth for a lot of license purists (myself included) is that nobody cares about GPL/copyleft when push comes to shove. It’s a purely PR thing. Nobody will ever put energy into taking legal action.
I know several programmers working at multi million/billion dollar companies that use GPL/AGPL libraries within completely closed source codebases. Some of these products are shipped as DLLs/binaries rather than hidden behind web services, and even still, nothing has ever come out of it as far as license enforcement. Your company’s legal department will not look for these things proactively.
Copilot may be the Napster moment that changes this, though.
Maybe you and your friends do not care, but I do. Do you actually think there has never been an enforcement action taken on GPL code? Did you even Google it before vomiting this nonsense on the screen?
I care deeply about licenses, and as a contributor to some (A)GPL licensed works, I’d love for people to follow the license to the tee.
The truth is that stealing open source code does not have the same monetary repercussions as stealing closed source code. Nowhere close to it. You have to acknowledge that there is an enforcement issue, either due to monetary or motivational (Linux) reasons.
Have there been license enforcements? Yes, a small number. But nowhere close to enough to make a team with a deadline think twice. Compared to stealing a competitor’s code, the expected value of the punishment for using some GPL code quietly is a rounding error.
This is simply false, organizations like Software Freedom Conservancy has taken legal action against companies before, they also do alot behind the scenes to get companies to comply with GPL before it needs to become a legal action
However This is one of the complaints that is leveraged by many in the Linux community, as Linux Foundation seems to take the stance you have outlined. Under no circumstance it seems will they enforce the licensing for the projects under their banner, that is sad but also not shocking since they are not Business Organization with some of the largest closed source companies in the world backing their existence...
Yes, copyleft violations increased, and often gotten also quite brass and arrogant in the last decade or so.
> I know several programmers working at multi million/billion dollar companies who use GPL/AGPL libraries within completely closed source codebases. Some of these products are shipped as DLLs/binaries rather than hidden behind web services, and even still, nothing has ever come out of it as far as license enforcement. Your company’s legal department will not look for these things proactively.
Even if it may sound naïve, I still hope & believe they take all those proprietary leeches down, ideally bleeding those out, that still not want to comply.
<<Woah>> If this claim is real: Please, please, please someone blow the whistle. Can we get some of these DLLs and get people to extract strings or reverse engineer to extract GPL/AGPL code? This seems entirely possible. EFF would surely help with the legal side.
>>the tech community may have yet to address, or even understand the depth of.
I think the offical position of most tech companies is to simply hand wave away any concerns the community(ies) may have about the legality, ethics, or anything else related to these disruptive technologies.
They want to push them as fast as possible into the market to make them impossible to economically remove "fixing" the issues later.
When I worked for $BIGCORP, someone pulled a chunk of GPL crypto code into our proprietary commmercial product. When the CTO found out, that GPL code was ejected from the project. I can't remember if we had to hunt down a replacement with a looser licence, or do a clean-room re-implementation, but it cost the company money to come into compliance.
This goes beyond Copilot, it's also about big tech exploitation of any publicly available asset - whether its your blog or wikipedia.
Big tech uses other public or "free" CC, etc knowledge bases to train ML models. Like Wikipedia as a training set for a GPT or word2vec model. Or using WikiData to seed a knowledge graph. Or training based on a common crawl dataset. All of these resources are used to make the assets that major tech companies use to make their products a lot smarter. They're built on the free labor of the rest of society.
Big tech reaps tremendous, society altering benefits from the free labor of others. And "training a model" seems to whitewash away the licensing concerns.
Shouldn't that be disconcerting whether we are developers or wikipedia editors?
I agree completely. It would be great to see content licenses that were “viral” towards ML the way GPL is within code, plus restrictions on fair use for this kind of thing. Then if you want to use everyone’s collective labor, you have to give back as well.
Instead, we just see everyone using the “all rights reserved” license, and the commercializer saying who cares it’s fair use.
I think we have overwhelming data at this point. What you rather have: Linux or Windows? The WWW or American Online? Wikipedia or Encyclopedia Britannica? Sqlite or Oracle?
Copyright law hinders the creation of ideas, not helps. It's time for Intellectual Freedom.
Abolishing copyright will remove copyleft as well. Careful what you wish for; it might just become a pre free software world with all source carefully locked away from the public eye.
I think they're referring to the idea of companies jealously guarding access to any and all source code because copyright doesn't protect them anymore, while FOSS authors have no protections.
I don't think that that's a realistic fear, though; this is basically already how it works with FOSS code being used in remotely-hosted SaaS systems and there being no effective legal recourse for FOSS authors.
Well, for one, I am going to miss all those GPL kernel releases for various hardware devices. You will be able to forget about any sort of custom cell phone ROMs.
> I think we have overwhelming data at this point.
I mean, I disagree with your conclusion, I think "aboloishing" copyright is a bad idea.
But I even more strongly disagree with how you phrase this. "Overwhelming" data? What are you talking about? There's a valid debate to be had, but if you're starting form the assumption that it's completely clear that your way is right, I think it's going to be pretty hard to convince anyone else of this since almost everyone disagrees with this idea.
> "Overwhelming" data? What are you talking about?
Well first I am a big believer in always building more datasets, and I have been involved with some efforts to built datasets on the copyright issue, and expect there to be many more. But this is a "pebbles" and "planets" type of situation, where the value of the public domain creations dwarf those of the copyrighted ones (American Online vs The World Wide Web; Microsoft Windows vs Linux; Patented medicines vs public domain ones). It's not that public domain innovations are a little bit better, they are OOM better. In the long run it's no contest.
So I think building bigger and better datasets across all domains is important, but this is not going to be a close call. I thought I might have a blind spot in medicine, but then spent a few years in biomedical research and realized that nope, the copyrighted and patented stuff in there is mostly junk compared to the public domain innovation.
Right on every account. This GitHub debacle allowed me to see how these machine learning products coming from large tech corporations are parasites on not just software released in good faith by the community but all copyright-protected content released by the community, especially photos. Someone else did the labor of labeling and creating the training set for them. They know exactly how much value they are getting for free. It’s sickening
What a cool court case this would make. Is copilot's model sufficiently abstracted from the code it has read? Judges and juries learning about how the GitHub team avoided overfitting? Are humans who have read open source code producing derivative works?
Won't be long until we see an infringement case. /me grabs popcorn
More interesting question is "Can it be proven and how?". Proof may be obtained via audit of those 300 GitHub employees' contribution during their Copilot evaluation. Who may order such an audit? On what basis?
> this may entitle all GitHub users to receive a copy of GitHub’s source code under the terms of the AGPL
Given that GitHub’s code runs on their own servers, doesn’t that protect them from needing to provide source code to anybody? I’ve always assumed running GPL code in the data center is fine.
Not all of the code GH is using is GPL-licensed. I share your view that it's fine to use GPL code in-house, or generally copy it for private use. But you can't use Windows in-house without a licence.
226 comments
[ 6.1 ms ] story [ 230 ms ] threadEdit: Thanks to those who have pointed out that Nat Friedman has publicly commented on this (on HN!). My mistake.
>In terms of the permissibility of training on public code, the jurisprudence here – broadly relied upon by the machine learning community – is that training ML models is fair use.
https://news.ycombinator.com/item?id=27677177
As long as enforcement and punishment of corporate lawbreakers doesn't hurt them at all, they're gonna continue to find new ways to abuse the system and get away with it. Only way to change it is to make their crimes really hurt them when they're called to task over it.
And yes, I do agree that some tech companies push the boundary of information and commercial law and wait to be tested by someone with deep pockets.
I'm not sure whether or not I agree that is happening here, but I've spent enough time in big companies to develop a healthy skepticism of their decision-making processes. So much groupthink.
I still don't understand how there's so much armchair quarterbacking around legality of Copilot, from people with zero legal skills and just anti-big-tech hot-takes.
Because Microsoft's legal department (and the company itself) has a spotless reputation for ethical and legal compliance.
Regardless, if you’d rather discuss morals - I don’t believe what they’ve done is immoral or wrong either. I use Linux, and write FOSS code and contribute to the FOSS community quite regularly.
Devs can ignore legal for a very short time, but the moment you have a team working on it, you need legal approval to continue. And if there's going to be a public launch, you have an entire legal, data, and privacy team to vet it first.
Put simply, there is no universe wherein MS's legal team hasn't cleared Copilot before launch, and I'm disappointed HN groupthink believes otherwise.
I’m saying FAANG+MS definitely have this process, you can ask any employee how it works there.
There is 0% chance that this wasn't run past their legal team.
>In terms of the permissibility of training on public code, the jurisprudence here – broadly relied upon by the machine learning community – is that training ML models is fair use.
https://news.ycombinator.com/item?id=27677177
Anything that is licensed has some level of exclusivity on it, and therefore it is not Public Domain.
What are you basing that? Especially when this is what is on the Copilot FAQ:
>GitHub Copilot is powered by OpenAI Codex, a new AI system created by OpenAI. It has been trained on a selection of English language and source code from publicly available sources, including code in public repositories on GitHub.
Absolutely zero mentions of public domain.
2) If an author did grant license to his code, then somebody, but not anybody, can use the code according to license.
3) If a somebody refuses to comply with license, then he permanently loses the right to use the code under such license, so then see (1).
>In its most general sense, a fair use is any copying of copyrighted material done for a limited and “transformative” purpose, such as to comment upon, criticize, or parody a copyrighted work. Such uses can be done without permission from the copyright owner.
https://fairuse.stanford.edu/overview/fair-use/what-is-fair-...
this is false. Fair Use is not about the license, it is a set of exemptions from copyright. for example I do not need a license to reproduce and publish a snippet of book for the proposes of review / criticism. The author may not like what I have to say, and did not grant me a license but I certainly can use the snippet under copy right law.
The Legal Experts of ML are relaying I believe on the "education" exemption in Fair use for their "training of ML models is fair use". That will be an interesting case for sure
GitHub's CEO posted this:
> In general: (1) training ML systems on public data is fair use (2) the output belongs to the operator, just like with a compiler.
https://news.ycombinator.com/item?id=27678354
Not sure I understand what fair use means in this context though and I can't believe that it's an argument that works for every conceivable model.
My clipboard is an ML model that trains on exactly one sample at a time. Ctrl + C is a hotkey for doing a training run on currently highlighted data, and Ctrl + V is a hotkey for generating output from the previous run.
What do you think the 'P' in GPL stands for?
Regardless:
1) You don't need a license to look at things. Copyrights reserve very specific rights: Reproduction, creating derivative works, distribution (limited to first sale), performance, display, and in some cases, transmission
2) And data can't be copyrighted.
US IP law is based on a clause in the US Constitution, and is fundamentally bounded in reach.
What do you think the 'L' in GPL stands for?
GPL code ≠ public data
I'm not going to engage in a flame war here. I clearly laid out references to relevant parts of the law: (1) What a license is and is not needed for under US copyright law (2) purpose of the GPL, and (3) distinction between copyright and data rights.
If you have any sort of citation for this nonsense, please post it. Otherwise, I'm checking out here.
When you say that a computer program "looks" at my data, because my code is for public, it means that the owner of the computer program use my code to make derivative work without obeying of my license, which is explicitly forbidden by copyright law.
For example, you cannot pretend that your smartphone is just looking at a copyrighted film in a cinema. Nobody will ever bother to ask your smartphone, what it's doing. Stop pretending that your smartphone can "look at data".
While correct, using protected works in an AI model requires some form of reproduction. In Canada, even the loading of information into RAM is considered a reproduction (although such reproductions may be excluded from infringement under s. 30.71 of the Copyright Act, RSC 1985, c C-42).
> 2) And data can't be copyrighted.
True, but data is often an abstraction of other expressions that are protected by copyright. Additionally, compilations of data and database structures attract different protections in various jurisdictions. E.g. sui generis database rights in the EU.
Based on his assertion, can I take a copy of windows (or github for that matter) and train an ML on it to replicate its behavior (assuming I have such a powerful AI)? It seems to me that is essentially what follows. In fact I'd argue that this is more akin to clean-room reverse engineering.
It also seems to fly in the face of case law for using soundsnippets in songs. Isn't what the model is doing really just a sophisticated algorithmic rearrangement of samples?
Second, code is not data, it is a copyright-protected creative work.
It’s really hard not to see this as him erasing the rights of individual developers for his own benefit.
IANAL. I don't know if that distinction exists in law. But it doesn't make sense to me. How do you distinguish code from data? Isn't the whole point of code that it is treated (by the machine) as both code and data?
Suppose I make a "copyright-protected creative work", for example a melody, and then encode that as a database table?
Suppose I have a list of population statistics? Suppose those population statistics have been ingeniously contrived (e.g. by encoding, ordering or whatever), so that given the right interpreter or compiler, the logic of a copyright software work can be replicated exactly, using the list as code?
It's hard to imagine a list of statistics that can be read by a human as easily as he can read code; but that doesn't matter. It's hard to read machine-code too; but copying machine-code without permission is infringing.
It doesn't help that copyright law has drifted over the years, and that despite international conventions, the law varies from place to place. USA and EU see copyright differently. Commenters here are not declaring whose copyright law they are referring to.
It does. Data is not copyright-able but source code is. There is so much legal precedence around this it’s nearly impossible to contest.
Calling code data is a way to minimize its status as a copyright protected creative work, so as to defend ignoring the protections it has under the law.
But the moment I redistribute (1) the model and that (2) model reproduces the original copyrighted training data that is an obvious violation.
The reality is there is zero case law that fits training of ML models enough for any legal expert to claim jurisprudence makes it legal. ML is too new of a technology for that claim.
If ML model is reproducing verbatim entire sections of code, I fail to see how that is "fair use" and not reproduction. I also fail to see how any legal expert would make the claim that it is.
The response of "oops it should not have done that" would also not hold up well in a licensing / copyright dispute
He's correct that AI can train, but it's not relevant.
(1) The issue is with CoPilot outputting copyrighted code AND attaching a separate license to it (looks like it's hiding the initial license and can generate another license automatically). This is reproducing copyrighted code and misrepresenting the license, neither is allowed.
(2) He posted that the output belong to the operator. It's factually wrong. Original copyrighted code belongs to their original writer, not the operator. In effect Github Copilot cannot "launder" license and it is very wrong for their CEO to claim otherwise.
(3) Looks like he's trying to waive responsibility of Github by stating that the developer receiving the code is responsible? Wrong, GitHub is responsible for their actions (vary with the jurisdiction). There's a complex matter of who's responsible when some proprietary code will end up in a company product and they get sued. The company is in violation, they can turn against GitHub for providing copyright code, GitHub was responsible for it. There's a complex chain of responsibility, any lawyer worth their salt would cringe at the claims and responsibility that GitHub is exposing itself to.
This whole thing could be done above board, and it's pure sloppiness on the part of github that they've chosen not to.
That’s an understatement. There is a deep lack of understanding of IP issues as demonstrated by their public representatives. Surprising for a company like GitHub where software IP should be a part of their core competency. They have made defenses like “it’s public data” which means nearly nothing in regard to copyright enforcement. The Avengers is public “data” (it’s not data in terms of the law), that doesn’t mean you can use the content for whatever you want. It shows a total lack of respect for the work that the FOSS community does and their rights. This has irreparably changed my perception of GitHub forever in a strongly negative way.
> It shouldn't do that, and we are taking steps to avoid reciting training data in the output.
Seems like he agrees that __reproducing__ copyrighted code is not permissible.
Also seems likely to me that Nat etc were probably misled / incurious (no excuse) about precisely what CoPilot would do in practice.
Actually, they should not be able to, as the whole point is that CoPilot does not just paste code, but instead understands it and applies knowledge, not finished snippets.
The fact that it does paste snippets is the problem, not the authorship of the snippets, as these simply should not exist.
On the other hand, a wholly independent system to search the training set based on AST matching and text similarity could solve this problem in the majority of cases.
Considering that their entire business model from the start has been "capturing the open-source ecosystem onto a closed and proprietary platform that doesn't interoperate", I'm more inclined to assume malice here than 'sloppiness'.
Edit: By which I mean that their approach most likely just couldn't work well enough for end users, in terms of hassle, if they actually did it above board and included licensing information. So not caring about that was the profitable option.
Seems like he agrees with you that __reproducing__ copyrighted code is not permissible. Doesn't answer the broader point about training with that code.
If it can then there's no problem unless CoPilot actually did produce code that was a close copy of GPL'd code and GitHub used it. Their own analysis says that that is really unlikely and easy to prevent anyway.
Almost certainly. But what people tend to forget is that "working out the correct legal interpretation" isn't actually the job of a lawyer; it's the job of a judge. The job of a lawyer is to devise a legal strategy that works for the client.
In practice that will quite often mean "yes, this is illegal, but we will publicly claim that it's legal and ride the wave, and the consequences will cost us less than we can profit off it".
Even if it's not explicitly stated like that and couched in vague "legal risk" handwaving, the lawyer ultimately works for their client and that's who their allegiance is to, not to the law.
That's the way it works in practice; in theory, lawyers are "officers of the court", and are supposed to serve the law.
Thats probably the difference that explains the different reactions. At the end of the day, Google News gave traffic to publishers websites. Copilot is very different.
I've always thought the riskiest part of Google News are the tiny thumbnail images used to illustrate each story section. I wonder if they pay for those; I think they might.
To be sure, the infectious nature of the GPL is likely to be a bigger deal, but permissive licenses will be violated by missing acknowledgement just as much as the GPL will be violated by not licensing your code GPL.
If this license-washing doesn’t work, then you can’t just say “we’ll exclude GPL sources”, because you’ll still be breaking the rules on any copyrighted work that doesn’t have very specific public-domain-like do-whatever-you-like-and-don’t-acknowledge-me licensing.
The whole thing truly does depend on the fair-use classification of ML models. If that falls apart, the entire thing’s done (and a lot of other ML stuff will be, too). And that’s where regurgitation becomes so problematic, because it directly undermines that fair-use exemption.
More importantly, just because a chunk of code is published under CC0 on github that does not give you any guarantee that such code is not already breaching an existing copyright.
It happened in various occasions that closed source code was leaked into FLOSS projects and if you reuse it you are in breach of the license as well.
For example MIT, one of the most permissive licenses there is, still requires you to include the MIT license and copyright notice "in all copies or substantial portions of the Software".
It sounds like you meant something more like a public domain dedication like CC0, which is about the only way you can go more permissive past the likes of MIT/Apache2/CC-BY.
Creative commons specifically calls CC0 an "alternative to our licenses" [1]
https://creativecommons.org/share-your-work/public-domain/cc...
- produces an output
- that output is the exact same thing - text, code, image, et c - that went in
- that thing is licensed
- fails to fulfill the requirements of the license
than it's breaking the license. I don't see how it can be wiggled around.
The black boxes that produce entirely different outputs, or the ones that slurped billions of photos without even blinking at license but never vomits actual images are, at least, not reproducing the source material.
1. A hypothetical employer asks an employee to find a really fast algorithm to find an inverse square root. The employee has a perfect memory and can regurgitate fast inverse square root from Quake 2.
2. A hypothetical employer asks an employee to find a really fast algorithm to find an inverse square root. The employee uses this ML algorithm to generate the code which essentially regurgitates the only previously seen inverse square root function it was trained on.
At some point in time in the future id Software sees this is happening at our hypothetical company and sues. In neither situation is the "actor" held accountable since the "actor" was employed by the company which allowed for practices that enabled this infringement to take place.
I think an important legal question is: Do we consider a ML algorithm being trained on data the same as a human reading prior art for an innovation?
It seems pretty obvious that it is the same thing to me. Instead of the human reviewing the prior art themselves the human has written a program to do so, but this can't change the acceptable outputs produced by the human's creative process (that includes the ML in this case).
There's a line somewhere, but it's somewhere, not at either edge, and it's a complex, odd-shaped line we haven't yet defined. I don't know where it is. However, it's not where you're putting it, and there isn't a slippery slope to "IP is over." If you use five lines of my code in a different system, IP hasn't ended.
The amount of copying does not matter for a copyright claim. If you copy a single character from a codebase that could could get nowhere but there, and lawyers could prove it, that could go to court. This is a hypothetical but this is entirely possible. There have been copyright cases fought over single sentences especially in the music industry.
> Are you trying to launder, or is it unintentional?
I'm not a lawyer but in the US, Copyright is a strict liability statute which means intent does not matter.
Clearly that's not how copyright works.
> that could could[sic] get nowhere but there, and lawyers could prove it
Also, the letters in this case are not representative of the creative work itself. If you used the title font to write your post (hypothetically, I know HN does not allow this), you'd be in bad water already.
>....you'd be in bad water already.
Not true either, writing my message in harry potter font would do absolutely nothing. the internet is full of images which use these or similar looking fonts. Its called fan art or whatever, copyright laws are not applicable to this.
Please explain how it "is entirely possible".
Bear in mind that there must be creativity in that choice of character to qualify for copyright protection. If only one character is correct, there's no creativity.
A sentence in a song has far more discretion for creativity than a single character in a software program.
As best as I can tell, you would need to construct some sort of super-APL where "a single character" had significantly more information content than any Unicode glyph, to exceed any de minimis standard applied to a programming language.
(Think Prince's "Love Symbol".)
> that could go to court
I think you mean "that could be found infringing." Going to court is trivial, even if there is no infringement.
This used to be something cartographers did: https://en.wikipedia.org/wiki/Trap_street
Even if you didn't have the street's name, if you copied the road on the map (no words, just the shape) they would know you stole their IP. I do not think there is literally a character that would satisfy this condition. The point of what I was saying was the "size" of the copying does not matter at all.
The Substantial Similarity is explicitly about this phenomenon. For something to be substantially similar, from a software perspective, you could hypothetically see the modules and data structures contain roughly the same data types and that the flow of logic is the same. You could also point to a function and say "these are the same variable names". Substantial similarity is not the only component of a legal analysis of a copyright claim. Another important component of copyright is if someone had access to the material. If I had code on my laptop that I showed to no one, uploaded nowhere, and at some point I find another developer who is doing some code that is character for character identical to my work, I likely cannot do anything.
The law is complex here, I am not a lawyer, but I think the important component here: The length of copying is not a factor at all. If for some reason your algorithm requires `magic_code.seed(20154)` and your code does this by doing `magic_code.seed(ord('人'))` and you find someone else doing the same thing you'd definitely want to investigate what's going on there.
The entire copyright doctrine is created to help protect the creativity of an author. If there is something creative in your code that is copied, you likely have a copyright claim you could argue.
Not "roughly the same data types", "same variable names", "magic_code.seed(20154)", etc. I have no question with those. Those are enough characters that they may contain creative - and thus copyrightable - content.
That is, I question your assertion that 'the "size" of the copying does not matter at all' by asking you to come up with an entirely possible scenario for why there is no de minimis case in software, even down to a single character, when there is in every other area of copyright.
BTW, the WP page you pointed to notes that "Trap streets are not copyrightable under the federal law of the United States." Thus, "stole their IP" has no meaning - they have no copyright, trademark, patent, etc.
Where in copyright law for any area is there an established minimum "length"? I've never heard this nor heard lawyers claim of such a thing.
OTOH, your original context for an "entirely possible" scenario at https://news.ycombinator.com/item?id=27730596 was "The amount of copying does not matter for a copyright claim", which implied your scenario was not that hypothetical example I posited.
(A 1E-20 probability * maximum expected lawsuit payment with successful lawsuit = don't worry about that scenario.)
We do know that the courts have decided many cases are de minimis non-infringing use of materials otherwise under copyright.
Do you think there is no acceptable de minimis argument in software? If not, why is software somehow special compared to other areas of copyright?
A "de minimis analysis ... usually focuses on the amount of the copyrighted material that is copied." - quoting http://patentarcade.com/2020/04/nba-2k-avoids-tattoo-copyrig...
If 'de minimis' use exists in software, what realistic scenario are you thinking of where a single character is enough?
To be clear, I think zero shared characters can still show copyright infringement, for reasons you mentioned about abstraction-filtration-comparison.
But your "entirely possible" example had no other shared similarities beyond a single character, and I can't see how any court wouldn't think that was a de minimis use of that character - assuming it had copyright protections in the first place!
>The amount of copying does not matter for a copyright claim.
This is incorrect. The amount of material used is the third factor in a fair use test. There are other ways it comes up as well (e.g. damage calculations).
>> Are you trying to launder, or is it unintentional?
> I'm not a lawyer but in the US, Copyright is a strict liability statute which means intent does not matter.
In this context, this is incorrect as well. People seem to be misinterpreting laws pretty badly, so instead of explaining how to apply here, I'll give a simpler, analogous context:
https://en.wikipedia.org/wiki/Online_Copyright_Infringement_...
In this context, it depends on a lot of things, such as direct versus contributory infringement. This would likely be a contributory infringement case, where intent is almost a requirement. https://www.legalmatch.com/law-library/article/what-is-contr...
Keep in mind these are all factors. They matter, so they'll help swing a case one way or the other, but they're not something you can bank on in isolation. That's what will make for interesting case law.
The 3rd factor of the fair use test deals with how substantial the copied material is in relation to the entire work. You can make a copy of 100% of the original work and have it still be fair use while in another situation copying 0.002% of an original work would not be fair use. The measurable amount (bytes, seconds, square inches) you are copying does not matter here. Instead the "importance" of what you are copying to your criticism is being defined in this prong.
For instance:
I am a movie buff and:
1. Make a copy of the entire movie of Citizen Kane 2. Remove the audio and replace it with a commentary track going over every framing/camera trick through the movie 3. Upload this to an educational youtube channel that teaches viewers how to shoot a movie
I would likely be allowed to use fair use as a defense to a copyright claim. Here, if an expert could say all 100% of Citizen Kane's film, contained relevant film techniques that I was actively commenting on, I would have copied the correct amount for my usage.
If I instead owned a movie review channel and I said "Citizen Kane is my favorite movie" and I displayed the entire movie after that I would likely not be using an appropriate amount of the film.
It's also important to note that fair use is a very narrow defense that covers a very limited subset of uses. It is not a generally applicable, or even a guideline, for how to skirt around copyrights.
If I am doing code autocomplete, and copying three lines out of your program, those three lines are exceptionally unlikely to be "substantial ... in relation to the entire work."
Where you're confused is lots of places, but the biggest one is you're mixing up the prongs. Most of the reason your Citizen Kane example might work (it probably wouldn't) is Factor #1, character of use. Commentary and education are favorable.
I can come up with examples where 0.002% of an original work would not be okay, but they're pretty contrived.
For your benefit, a random link: https://guides.lib.utexas.edu/fairuse/fourfactor
Size definitely matters. It's not a hard-and-fast rule, but a factor.
It absolutely does for fair use analysis, see 17 USC § 107: “[…] In determining whether the use made of a work in any particular case is a fair use the factors to be considered shall include—[…]the amount and substantiality of the portion used in relation to the copyrighted work as a whole”
How are these statements not contradictory? Do you know where the line is, or not?
The trouble is verbatim copy of original copyrightable code, with an attached license that doesn't allow it. Github is most likely in violation because it's doing just that.
However that specific square root square example may or may not be a violation. There's a difficult question of what constitutes original copyrightable work, a trivial well defined algorithm isn't, a larger code with comments could be.
This is very myopic because there's a big difference between "memorizing an algorithm" and "memorizing an implementation of an algorithm".
> There's a difficult question of what constitutes original copyrightable work, a trivial well defined algorithm isn't
I don't think copyright law agrees with this sentiment in the US. Even the spacing, variable names, and comments are non-functional attributes of this code. And, this also goes further, because the machine code it produces is also data that has copy rights. There's layers and layers of complexity here that is difficult to enumerate with forum posts.
No there's isn't. An implementation of an algorithm is not copyrightable. It's specifically cited as an exception in European directives.
I should say I speak more from a EU perspective. US may vary slightly. Both vary by country/state as well.
There is a challenge with determining the threshold for copyrightable original work and it's not the same in every jurisdiction. That we can agree on. (I personally think comments are a big problem because they're always freeform text). In my opinion the tool should consider doing an autoformatting and removing comments, to avoid these issues.
The gist:
>> "There is an observable trend in US law, based on fair use and older notions in US copyright law of the need for creativity, that judges give a looooot of leeway to “machines that read”. Copilot fits pretty squarely in that tradition."
If that's something I'd planned on and intended, and you own the copyright to the painting, you have all sorts of legal tools to go after me -- contributory infringement, collusion, and so on. Still, contributing to a legal violation is not the same as engaging in one.
I suspect an argument can be made that github now incorporates AGPL code generated by co-pilot, and so is AGPL. A fair use argument might be made as well; we've all copied one-liners from blog posts and tutorials, and that's okay. I'm having a harder time seeing a reasonable argument that an ML model is directly infringing just because it can produce a copyrighted work, though.
So I don't think it's a cut-and-dry legal question.
I will give a caveat: Coders tend to read laws much too literally, like computer code. When I was was an obnoxious teenager, I thought I'd found all sorts of contract / license / etc. loopholes in all sorts of legal documents, and I considered myself profoundly clever, thinking I'd outsmarted the lawyers.
Nope.
In college I took law classes, got into the real world, did a few startups, and saw a few legal cases. Court systems have technical rules you need to be aware of, of course (e.g. if you miss a deadline....), but interpreting the law is really grounded in common sense. Common sense is culturally situated, and ours is situated in hundreds of years of case law.
Thats very interesting. Because AFAIK Github is not "shipping" copilot to anyone. They run it and make it available only to those that use their online editor.
If that's the case, then there will not be any users of Copilot except those that unknowingly open themselves to liability. I suspect there will be few.
I would be okay with that situation. But I'm not okay with the situation as it currently stands.
Where it stands: We have a new technology. We don't really understand it. There aren't well-defined ethical or legal bounds. We're figuring them out, blumbering along as we go. People are trying things, and are making all sorts of arguments, some of which will stand the test of time, and some of which won't.
I'm more concerned when we do this with weapons, medicine, or social science, but an autocomplete tool seems like a relatively benign place to start figuring this out.
But let's fix this before it goes further, especially since mindlessly copying output from a machine will probably result in more bugs.
Not all networks are susceptible to this, but if you can get a 1:1 copy, that's no different from bittorrent, limewire, or KaZaA. That doesn't seem implausible for text.
Napster was an easy litigation mostly because of intent. There was a document trail a mile long that the primary goal of Napster was to facilitate copyright infringement, although on paper, it could be used to share anything.
Cameras, xerox machines, and audio recorders can all be used for infringement, but aren't illegal since that's not their primary purpose. For even finer lines, see the Betamax case. You can also look at cases about different sorts of transformations and transmissions:
- I buy a DVD. It is transferred via USB cable from a DVD player connected to my computer, temporarily copied to computer memory, and then shown on my monitor.
- I buy a DVD. It is transferred via the internet from a DVD player in my data center, via the Internet, temporarily copied to your computer memory, and then shown on your monitor.
Can you see how these have nearly identical technology, yet different legally? If you ever take a law class, there are a lot of discussions about how to draw such lines (disclaimer: IANAL, but I've sat in on law classes before).
To be clear, I'm not taking a stance about where this ought to land legally. I don't know. But the analogy to bittorrent, limewire, or KaZaA is a faulty one.
Plot twist: Depending on the jurisdiction, you are responsible for distributing means specifically designed to circumvent copyright, which makes you liable for a much greater punishment, and liable for every reproduction done by your users.
There's a reason that painting robots are sold as general painting robots for various industrial usage, they're not advertised to and shipped with templates to reproduce copyrighted paintings. ;)
How is that different than sending someone a jpeg of a copyrighted painting? Or the jpeg and the executable that can render the jpeg. Or the jpeg and the executable and the computer it runs on. Each of those gets closer to what you said.
What case did this proposed legal test come from?
Github contains plenty of software uploaded without any license, which, by default, means closed source. Similarly, if use significant portions of those you violate copyright law.
There is no concept of "infection" and "virality" in copyright law.
But I think you know what I’m referring to by “the infectious nature of the GPL”: that such licenses as GPL and the CC-SA family require that derived works be under a similar license. And the fact of the matter is that people are likely to care about that a bit more than missed attribution, whether they should or not. But, as I say, it’s still violation.
With other licenses if you distribute derived work, the distribution is illegal.
With GPL in the mix the derived work becomes GPL as well.
For something like MIT/Apache2, the burden is that your derived work must acknowledge the copyright and license of the original work.
For something like GPL, the burden is that your derived work must acknowledge the copyright and license of the original work, and must be under a similar license to the original work.
So yeah, it requires more of you, but it’s fundamentally the same proposition of “obey the terms or it’s illegal”.
Correct. On top of that, GPL is very lenient and provides multiple escape mechanisms. Also it does not require any damage compensation.
As with any other software you must either stop distribution or come to an agreement with the party owns the copyright to the code. The GPL merely provides you a get out of infringement free card whereby you may release all of the code under the GPL. This is different only insofar as it is more permissive not less compared to proprietary software.
The idea that the GPL infects your code is a fantasy.
Meanwhile companies will more or less blanket-ban GPL and AGPL software, even if the terms would not impact them at all.
I’m conflicted on this, on one hand I think FFmpeg is a brilliant piece of engineering and I want the creators to receive credit, but on the other I think Audacity and its built in components as listed in its “third party licenses” document are brilliant pieces of software that do receive credit. Further, I believe the one of the primary purposes of technology should be to enable the masses to create, and this licensing places an arbitrary yet powerful restriction on that for folks who aren’t already computer-proficient.
Audacity and FFmpeg are both under the L/GPL, compatible versions even. The reason Audacity doesn't include FFmpeg is because they are afraid of software patents. GPL has nothing to do with it. At all.
> Because of software patents, Audacity cannot include the FFmpeg software or distribute it from its own websites. Instead, following the links below to instructions to download and install the free and recommended FFmpeg third-party library.
If you incorporate closed source software into your work you may stop distributing your software or rip it out possibly while paying a massive fine.
If you incorporate GPL licensed software into your work you may stop distributing your software, rip it out, OR release your software as GPL. Furthermore while being discovered using someone else's proprietary software in yours will almost certainly result in at best a threat of near instant lawyer assisted corporate suicide using GPL software the same way has historically led to a strongly worded letter and months to years to fix your problem.
This is to say that nearly all copyright is inherently viral and GPL is slightly less so than many because you have additional options. Hearing people, many of whom metaphorical develop software Ebola for a living describe the GPL as viral is in a word, amusing.
Also aficionados of permissive licensing seem to be frequently not only OK with proprietary licensing but approve of the fact that code can be used in such a fashion. It's almost as if the attitude is everyone's else's work MUST be free for ME to use in MY proprietary code else they are somehow taking away MY freedom!
And it's still an incorrect and arbitrary use of term.
If you release software that is breaching GPL due to a dependency you have many options to rectify the issue.
Under no conditions your software "catches" a GPL "infection" and magically changes its license while you are not looking. There is such concept in copyright law.
EDIT: you can do better than silent downvotes.
Maybe it’s easier to see an issue when the GPL specifically lays out the creator’s intent, compared to the nebulous intent and law that underlies unlicensed content. GPL focuses the discussion on a concrete license rather than the entire body of IP law around fair use.
Or maybe it’s just easier to see an issue when it’s “our” community’s content being used.
Perhaps somebody with an AGPL'd project on GitHub and deep enough pockets could force them to open source Copilot...
(No, I don't think that's actually plausible, but the scenarios are fun to think about)
eevee’s tweet actually suggests the opposite: that even derivative works of GPL-licensed software must also use the GPL.
Thread on the tweet in question https://news.ycombinator.com/item?id=27687450
The pessimist in me believes that this fundamental conflict will be used by big established players to get rid of smaller competition, and otherwise won't benefit anyone.
Ultimately, this question also involves one of humans. When I read a book on programming, and use some of the tricks I've just learned in a project of mine, do I violate the publisher's copyright? Do humans posess a "license to launder" that silicon training circuits lack?
The author and the book were published for the exact this reason, you learning stuff .
But in this case situation is different, someone creates a blackbox program and puts in all of your code that is under license X . Then they sell this blackbox program, and depending on what input people give to the blackbox it will output parts of your stuff. If your stuff is original then the chance is that most of it will be inside the blackbox and it will be spit out with the right inputs, and copyright and licenses are now washed.
Personally I am surprised on how amateurish this seems to be, seems like they used mostly text as input and not something more advanced , if MS did not put the properietary code they own in the blackbox then I am also suspicious.
Apparently this doesn't prevent them publishing things in the Code Vault, or via this; that I might have wished to remove from their custody.
User agreements that amount to "you agree to be used," I guess.
If whatever stalker that I offended becomes unhappy that they might not have gotten my code off the net completely, are they gonna blame GitHub for it, or continue to try getting others to take actions against me? If some court sided with them and decided I had liability for publishing that code; would GitHub's possible resurrection of it be their responsibility, or mine?
EDIT: previously stated "after they offered me the option to do that or adopt a Code of Conduct on a single contributor project of mine."
Perhaps I'm wrong about the source of that; but I did delete my account and expected that they would no longer publish my code as such; others had forked things and that was as expected.
As in: they reached out to you directly and stated "you must adopt this CoC or we'll ban you from GitHub"? I can't find any other instances of people encountering this...
Can you please elaborate on this?
My comment assumed that GPL meant the GNU Public License, where you are allowed to use the code, but are restricted to distribute binaries.
AGPL is a different license, and it's probably not legal that code with that license should have been used in their training set.
You were able to get pretty much that same output from an Enterprise install.
But as a temporary legal fix, couldn’t they put all the attributions in one large file and after each output of copilot write: “results based on the work of these people [link to attributions.txt].“
would that still be problematic?
I know several programmers working at multi million/billion dollar companies that use GPL/AGPL libraries within completely closed source codebases. Some of these products are shipped as DLLs/binaries rather than hidden behind web services, and even still, nothing has ever come out of it as far as license enforcement. Your company’s legal department will not look for these things proactively.
Copilot may be the Napster moment that changes this, though.
I would guess 0.1% of GPL violations have as much as a legal demand letter, let alone a law suit.
I care deeply about licenses, and as a contributor to some (A)GPL licensed works, I’d love for people to follow the license to the tee.
The truth is that stealing open source code does not have the same monetary repercussions as stealing closed source code. Nowhere close to it. You have to acknowledge that there is an enforcement issue, either due to monetary or motivational (Linux) reasons.
Have there been license enforcements? Yes, a small number. But nowhere close to enough to make a team with a deadline think twice. Compared to stealing a competitor’s code, the expected value of the punishment for using some GPL code quietly is a rounding error.
However This is one of the complaints that is leveraged by many in the Linux community, as Linux Foundation seems to take the stance you have outlined. Under no circumstance it seems will they enforce the licensing for the projects under their banner, that is sad but also not shocking since they are not Business Organization with some of the largest closed source companies in the world backing their existence...
> I know several programmers working at multi million/billion dollar companies who use GPL/AGPL libraries within completely closed source codebases. Some of these products are shipped as DLLs/binaries rather than hidden behind web services, and even still, nothing has ever come out of it as far as license enforcement. Your company’s legal department will not look for these things proactively.
There are companies (e.g., those producing mainly FOSS themselves) and organizations who do care, for example the SFC: https://sfconservancy.org/copyleft-compliance/enforcement-st...
You can also allow them to pursue violations on your, or a project, behalf: https://sfconservancy.org/copyleft-compliance/
Even if it may sound naïve, I still hope & believe they take all those proprietary leeches down, ideally bleeding those out, that still not want to comply.
By using GPL where you shouldn't you're putting your whole company at risk.
It's only a matter of time before lawyers come along smelling blood.
I think the offical position of most tech companies is to simply hand wave away any concerns the community(ies) may have about the legality, ethics, or anything else related to these disruptive technologies.
They want to push them as fast as possible into the market to make them impossible to economically remove "fixing" the issues later.
https://en.m.wikipedia.org/wiki/Betteridge%27s_law_of_headli...
Big tech uses other public or "free" CC, etc knowledge bases to train ML models. Like Wikipedia as a training set for a GPT or word2vec model. Or using WikiData to seed a knowledge graph. Or training based on a common crawl dataset. All of these resources are used to make the assets that major tech companies use to make their products a lot smarter. They're built on the free labor of the rest of society.
Big tech reaps tremendous, society altering benefits from the free labor of others. And "training a model" seems to whitewash away the licensing concerns.
Shouldn't that be disconcerting whether we are developers or wikipedia editors?
Instead, we just see everyone using the “all rights reserved” license, and the commercializer saying who cares it’s fair use.
I think we have overwhelming data at this point. What you rather have: Linux or Windows? The WWW or American Online? Wikipedia or Encyclopedia Britannica? Sqlite or Oracle?
Copyright law hinders the creation of ideas, not helps. It's time for Intellectual Freedom.
Someone should make a movie about a world without copyright.
We don’t need copyleft in a world without copyright.
I don't think that that's a realistic fear, though; this is basically already how it works with FOSS code being used in remotely-hosted SaaS systems and there being no effective legal recourse for FOSS authors.
It just doesn't officially say it yet in a law.
I mean, I disagree with your conclusion, I think "aboloishing" copyright is a bad idea.
But I even more strongly disagree with how you phrase this. "Overwhelming" data? What are you talking about? There's a valid debate to be had, but if you're starting form the assumption that it's completely clear that your way is right, I think it's going to be pretty hard to convince anyone else of this since almost everyone disagrees with this idea.
Well first I am a big believer in always building more datasets, and I have been involved with some efforts to built datasets on the copyright issue, and expect there to be many more. But this is a "pebbles" and "planets" type of situation, where the value of the public domain creations dwarf those of the copyrighted ones (American Online vs The World Wide Web; Microsoft Windows vs Linux; Patented medicines vs public domain ones). It's not that public domain innovations are a little bit better, they are OOM better. In the long run it's no contest.
So I think building bigger and better datasets across all domains is important, but this is not going to be a close call. I thought I might have a blind spot in medicine, but then spent a few years in biomedical research and realized that nope, the copyrighted and patented stuff in there is mostly junk compared to the public domain innovation.
Given that GitHub’s code runs on their own servers, doesn’t that protect them from needing to provide source code to anybody? I’ve always assumed running GPL code in the data center is fine.