Hacker News Reader

Comment by capableweb | Hacker News Reader

If GitHub could guarantee that the code Copilot had ingested was only made with OSS licenses, then I don't see what the problem is.

But as far as I understand, GitHub trained Copilot on any public repository on GitHub, meaning even if it doesn't have a license specified (so the user publishing it still has the copyright to it), then I don't see how it can be OK.

View on HN

Here's an example: https://twitter.com/ChrisGr93091552/status/15397316329318031...

> I checked if it had code I had written at my previous employer that has a license allowing its use only for free games and requiring attaching the license. yeah it does

That's a pretty bad example. He prompted it using the exact function header taken from the code he is complaining about.

It'd be much more interesting if he setup a function that was doing a similar thing but with different parameter types and names, and a different order of parameters (ie, like a real problem).

Does that matter? A code provided should be provided with the license needed to use the code, otherwise the user is opening themselves up to litigation.

Hence why I agree with another comment somewhere that Microsoft is banking on software developers not litigating about use of their open source code in closed source projects.

Even if it was trained with OSS licenses, some of them require proper attribution, which copilot doesn’t do.

Now, where the threshold is for substantial derivative work in order to require attribution is an interesting question.

It is hard to see how verifying licenses is a solvable problem, when licensing for code dependencies can be transitive. For ex - if I copy code from a GPL codebase like Linux and create a Github repository with an MIT license.

You should be able to choose flavors of the model trained only on public-domain code which does not require attribution, for example.

But that would mean Microsoft acknowledging license violations.

Sorry, to be clear, I meant even if a Github user asserts their code is public-domain/no-attribution/unlicensed, they could have lifted it off a codebase that doesn't allow it. It would be tricky for Github to establish the code was indeed original and hence their agreement with the user allows them to train their models on it.

> they could have lifted it off a codebase that doesn't allow it

Ah. But then someone else is guilty of redistributing code without permission.

But you're suggesting, GitHub should implement something like ContentID but for code. Which should be cheaper (since code is cheap to analyze, while videos are much more bandwidth-intense). And this would kill two birds with one stone.

many OSS licenses require attribution

Maybe when you accepted GitHub ToS you gave them permission for your code to be used for ML training.

I can’t say I remember the terms saying anything to the effect of granting Microsoft a perpetual unlimited license in addition to whatever license I package with the code when I signed up. Not doubting it, but I would have expected that to raise some suspicion long before Copilot was around.

It could be something as innocuous as "you allow your code to be analyzed, processed or otherwise handled by Github software" I suppose, which wouldn't raise suspicion.

Reply on news.ycombinator.com