Hacker News Reader

Comment by rockemsockem | Hacker News Reader

I mean, he clearly knew about that code in advance and used his prior knowledge to coax Copilot into spitting it out, yeah? Three characters can get you pretty far, that's 1 combination out of 125,580 (considering all english letters, upper and lower, along with most of the numbers and symbols on my keyboard), plus the description of a fairly complex algorithm.

Also, this code is really just executing a mathematical operation in what I would assume is fairly standard, so it may not even fall under copyright. IANAL.

Even if it is a copyright violation, that is one out of, IDK, millions, maybe billions already of Copilot completions?

That sounds cherry-picked. Just because some high profile, highly-retweeted person says something doesn't make it not cherry picked.

View on HN

Of course it is cherry picked. The idea is that it allows you to INTENTIONALLY void any copyright you want.

So let's say I obtain an illegal copy of microsoft windows' source code. Under this precedent, what stops me from just (overfitting) training a neural network to produce the source code verbatim, sans any license notice?

But it doesn't end there. What stops me from making a neural network that exactly reproduces the bytes of Illegally_Ripped_Disney_Movie.mp4 that I obtain from the pirate bay? Copyright need not apply.

At what point can the neural network I've described (which is intentionally designed to violate copyright) distinguishable from a neural network like Copilot and others which violate copyright extrinsically?

It doesn't void anything. If you use Copilot to copy some licensed code illegally, you are the person in breach, not the tool. People using Copilot are possibly littering their code-base with future copyright liabilities, and they'd have no idea about it. Until someone writes an AI to find infringing software and automatically sue them...

Yes, that's the other outcome, which is the industry getting GPL'd to death for using this. But I don't think there is an established precedent when it comes to this.

I don't know much about AI/SL but I think the logical outcome is that using a transformer to generate source code is going to result in an over-trained system that produces sections of code verbatim because of the relative size of the space of all valid programs vs the space of all possible programs. It's not like art where you get soft failure if a single pixel or word is wrong: the inclusion, exclusion, or replacement of a single instruction or symbol is enough to introduce fatal bugs into a computer program. If the system doesn't have the capacity to understand programs generally (which it probably won't if it's just a transformer), then you're going to end up with a system that spits out samples from training data that do work.

A lot of M&A activity use tools like Blackduck software that does exactly this. It flags partials.

It’s fairly obvious if Copilot is regurgitating entire blocks of code that someone else wrote.

In 999 out of a 1000 cases it’s just spitting out boilerplate though.

Yep - it would be useful if more people had literacy of using the tool for these conversations. I don't blame them, that shouldn't be expected or required, but there is a large gap between how bad this looks and how materially bad it is when you take into account the actual way Copilot is usually used.

Yes but if you have a large team you'll be using it hundreds of times a day. I will not be surprised if Copilot indemnity insurance is a thing in M&A in a five years.

If you told the legal team at any mid-sized or larger company "we're pretty sure only 1 in 1000 lines of code our developers write breaches someone else's copyright" there'd be some serious hell to pay.

No, no. 1 out of every 1000 lines of code has the potential to breach some form of license.

If someone is motivated to search through our entire (proprietary, private) codebase. They match it with repositories that are freely available. They’re properly motivated to make a problem out of it (some twitter randos?), and most importantly they gain some benefit out of spending hundreds of thousands of dollars engaging with our legal team.

By the time you satisfy all the conditions required for it to be an issue you are talking nation-state actors.

> to copy some licensed [anything] illegally, you are the person in breach, not the tool

ahem napster, pirate bay ...

I don't think there will be a ruling like "anything from a neural net is yours", that'd be a bit ridiculous for very obvious reasons.

I'm no copyright law expert and I'm certainly not a lawyer, but it seems to me that in your examples you're setting out to violate copyright as a goal, which seems like it would be a factor in a court case.

To answer your last question, your examples are pretty clearly distinguishable from Copilot in their final states that you describe. IDK exactly *when* during overfitting that line is crossed, maybe it's crossed the moment you personally decide to knowingly publish copyrighted content and has nothing to do with the neural network itself?

> The idea is that it allows you to INTENTIONALLY void any copyright you want.

It doesn't void copyright.

Anyone that uses code that Copilot spits out which infringes on someone else's copyright is still liable. There's no requirement for intent. That may be a mitigating factor in terms of remediation, but it cannot void the copyright itself.

It can, however, produce a plague of completely ignorant copyright infringement, and since the user of Copilot has no idea where the code is coming from, there's no way to check if it was trained on infringing code.

If I used Copilot I would be real worried about the legal implications for me and that I could easily be accused of copyright infringement or plagiarism[*]. Of course people seem to not really care these days if they can cheat to get ahead so this is probably a feature, and 99.9% of user won't have their reputations ruined by using it.

[*] Although I'm personally more worried about the fact that most of the code will be wikipedia/blogs-quality and filled with bugs, edge cases and performance issues.

Buggy code can easily come from copying Stack Overflow or even from Github open-source repos so I doubt CoPilot would contribute to it anymore than it already is.

Large companies don't worry about this because they already have tooling that scans code and matches it against other public code out there (to avoid legal troubles if some dev quietly copies some GPL'd code or something like that). Everybody else basically has to manually check every snippet produced, which makes all the supposed convenience moot.

Between that and the typical quality of Copilot snippets, it's pretty obvious who the real beneficiary of this technology is: large sweatshops like Infosys.

This doesn't make sense, a byte identical copy of other work is obviously not transformed. So anyone claiming fair use relying heavily on transformation would fail.

But the only thing that does is make step 3 of fair use harder to clear. Not impossible.

There are fair uses of copyright that use the entire identical work as is.

Like this? https://github.com/ZoloZiak/WinNT4

> Even if it is a copyright violation, that is one out of, IDK, millions, maybe billions already of Copilot completions?

If you, only once, steal lines of code that you don't have license to do so and use them to make money, that's the same exact thing. "Trusting the algo" and saying "whoops I'm sorry" doesn't make a strong legal defense.

In a company of 1000 programmers, what are the odds that copilot increases the risk of using improperly licensed code because "well because microsoft gave it to us it has to be legit!"

And sure, stackoverflow copying is a thing, but they clearly tell you the license by which you can use said code: https://creativecommons.org/licenses/by-sa/4.0/

If copilot gives you CC-by-sa code, will it tell you so you can properly credit?

Not all lines of code are made equal under the law. If they were then Oracle would have a copyright on the Java API. Fortunately they do not.

So, no. You can in fact "steal" several lines of code and use them to make money and be legally clean as a whistle. It isn't that clear cut.

Oracle DOES have a copyright on the Java API. Google's use of it was found to be fair use, but the SCOTUS did rule that it was copyright infringement. https://www.supremecourt.gov/opinions/20pdf/18-956_d18f.pdf

The SCOTUS decision in Oracle v. Google didn't rule on API copyrightability. It merely assumed that the code in question is copyrightable, then showed how it's still fair use even if so, thus making the first question irrelevant to the decision. And this is very much intentional; they spell it all out:

"Google’s petition for certiorari poses two questions. The first asks whether Java’s API is copyrightable. It asks us to examine two of the statutory provisions just mentioned, one that permits copyrighting computer programs and the other that forbids copyrighting, e.g., “process[es],” “system[s],” and “method[s] of operation.” Google believes that the API’s declaring code and organization fall into these latter categories and are expressly excluded from copyright protection. The second question asks us to determine whether Google’s use of the API was a “fair use.” Google believes that it was.

A holding for Google on either question presented would dispense with Oracle’s copyright claims. Given the rapidly changing technological, economic, and business-related circumstances, we believe we should not answer more than is necessary to resolve the parties’ dispute. We shall assume, but purely for argument’s sake, that the entire Sun Java API falls within the definition of that which can be copyrighted. We shall ask instead whether Google’s use of part of that API was a “fair use.” Unlike the Federal Circuit, we conclude that it was."

The tragic irony here is that the understanding of copyright that those that do not like Copilot put forth would indeed make things like Java's API copyrightable and to the obvious detriment of innovation.

I don't see how this is related. The question wrt Copilot can be distilled down to "what constitutes a derived work", but there's no doubt that the original source code that Copilot was trained on is copyrightable. Conversely, with Java APIs, there was no doubt that Google's use of them produced a derived work - the question was whether the original is copyrightable and/or whether that is fair use.

> the SCOTUS did rule that it was copyright infringement.

In the US, "[T]he fair use of a copyrighted work ... is not an infringement of copyright." (17 USC 107, Oracle at 14). Whether there is a difference between a finding of no infringement or infringement with no liability is academic.

Practically, the copyright on the Java API is commercially worthless because after Oracle anyone may freely copy any and all of it and use it to compete with its creator.

Any other software vendor who thinks it has platform "lock in" because its customers built to their API should take notice. (e.g., Amazon AWS).

> what are the odds that copilot increases the risk of using improperly licensed code

In a company of a thousand programmers there are much easier ways to find improperly licensed code.

> And sure, stackoverflow copying is a thing, but they clearly tell you the license by which you can use said code: https://creativecommons.org/licenses/by-sa/4.0/

There are posts under an earlier license which was CC BY-SA 3.0.

There are people who don't have accounts anymore or haven't logged in to accept an updated license.

Only the changes to the post after the 3.0 to 4.0 in the above case are technically licensed under 4.0 (the original post is still under 3.0).

Furthermore, Stack Overflow didn't follow the proper process for updating the license.

https://meta.stackexchange.com/questions/333089/stack-exchan...

For example - https://stackoverflow.com/posts/11574647/timeline

Look at the license and the Aug 22 change and consider if that removing "Hope that helps" was a sufficient change to relicense it.

> That sounds cherry-picked. Just because some high profile, highly-retweeted person says something doesn't make it not cherry picked.

It's his code. This "high profile, highly-retweeted" crap is an appeal to emotion. He has a specific and legitimate interest in protecting his own intellectual property. It's not "cherry-picking" to report a crime being committed on your front lawn.

> It's not "cherry-picking" to report a crime being committed on your front lawn.

And as soon as he sees someone actually take the chair from his front lawn he can report it as a crime. He cannot report the people walking past because they could potentially steal his chair.

One could even argue that if he didn’t want his chair taken, maybe he should have locked it in his shed.

Of course, these chairs duplicate, so it’s not as if he loses his own chair.

Redistribution of that code, absent its license, is a violation of the license. That's already happened.

I'm done with this thread.

No, it is not.

For it to be a violation you have to lose a court case. To lose a court case a court has to find against your fair-use defense.

A fair use defense is fact specific to the parties involved. What's fair for you might not be fair for me.

Only a court can determine fair use.

Sure, duh, this discussion does not constitute a legal ruling. Nobody here is a lawyer nor a judge presiding over the case. We're potential subjects of a class action suit discussing grievances and merits of the case.

So why is he complaining about copilot and not the thousands of GitHub repositories redistributing his code with improper license? Typing the little code snippet he showed into copilot is analogous to typing it into the GH search bar and grabbing a properly-licensed result.

Microsoft Copilot is easily the greatest theft of intellectual property in the history of man.

You want to use my code, without ever knowing I wrote it? You want to use my hard work, regurgitated anonymously, stripped of all credit, stripped of all attribution, stripped of all identity and ancestry and citation? FUCK YOU

There's no need to defend something so obviously harmful, so why do you do it?

The law should be amended to make this kind of theft illegal.

It's not ambiguous.

Are you saying the act of training the model itself is theft? Or you’re saying that using it is theft?

You can have a totally legitimate business making hacksaws and bolt cutters.

Now if your customers use these tools to break into homes and steal things, then yes, that’s illegal.

But making the hacksaws and bolt cutters is not.

How is me building a novel application consisting of manually linked libraries and source code any different than building a novel application out of what Copilot generates? The difference is that Microsoft is pretending attribution and source licenses don't apply to the code it generates, even though it would in any other context.

The difference is that you could be unwittingly taking on liability in the copilot case. So that's fun. But also in the copilot case, microsoft distributed the code to you without a license, in violation of the license.

It is a code laundering tool so corporations can steal open source code rights . It's the plainest thing I've ever seen. They charge for it on top of it. The deniers are out of their minds if they can't see what's coming.

This has the potential to severely damage open source - I would not host my open source project on GitHub, especially if it was copyleft. I'm sure many others wouldn't either. Some of these authors make amazing software that we might not see because of this.

Training must be opt in, not opt out.

Every artist, every creative individual, must EXPLICITLY OPT IN to having their hard work regurgitated anonymously by Copilot or Dall-E or whatever.

If you want to donate your code or your painting or your music, so it can be used ("written", "painted"), in whole or in part, by everyone else, without attribution, then go ahead and opt in.

Otherwise, you can't use the artist's or author's creative work for training.

All these code/art washing systems, that absorb and mix and regurgitate the hard work of creative people must be strictly opt in.

> Even if it is a copyright violation, that is one out of, IDK, millions, maybe billions already of Copilot completions?

Are you saying that because there are millions of copyright violations, Copilot is too big to fail? Or are you’d saying that Copilot is too big to be held accountable for flagrant violations of the law?

I guarantee Copilot’s developers knew it was spitting out verbatim code. It’s too obvious, and probably would result in a perfect rating for the prompt.

I interpreted it as them saying only a tiny, tiny fraction of Copilot completions violate copyright.

Yeah, but that doesn’t matter does it? That’s like saying, “Well, your honor, most of my cars aren’t stolen vehicles.”

Yeah, degree generally matters. Airplane flights rarely kill people, so we allow them. If 50% of flights resulted in death, we would not. Google searches rarely illegally return copyrighted content, so it's allowed. The Pirate Bay searches often return copyrighted content, so regulators keep shutting it down.

Stealing a car is a large degree of crime for an individual. If they had stolen a penny, it would be a small degree of crime and we'd be more willing to let it slide.

I'm sure you see you've been downvoted. But I want to say I agree with you on the millions / billions bit.

While I understand the rub about licenses, the fact is the vast majority of code is not all that original or unique. Some fringe amount is, and those edge cases are worth discussing.

But the rest? Likely not all in all all that special. Yes, we get paid good money to do it. But is that a function of what it takes to do the work, or the demand for the skill (relative to supply of that skill)?

Frankly, I think some ppl just plain ol' fear Copilot. And either don't want ro admit it, or they have buried that fear. I'm not advocating ignoring the law / licenses. But putting a licence and lipstick on what is an everyday pig doesn't make that pig a unicorn. Does it?

This example is one of those rare pieces of code that is special though. It's the product of years of deliberate work by professor-level academics. This is exactly the kind of person who would have the least to fear from copilot if it really was just automating the boring plumbing parts and not shamelessly copying high-value, creative, insightful code.

I understand.

But that's not the type to fear Copilot. Yes, they might object to the license violation. I get that. I acknowledge that. But when you're that intelligent and that creative you don't fear being replaced - displaced? - by something like Copilot. Nah. That's a fear for the mundane and the common. That's a fear for the rest of us.

Right, so the fact that this is the person complaining implies that it's not about fear at all, and is likely a far more legitimate concern.

Or that the professor has a legitimate concern, and a lot of people in the comments here don't have any code being stolen and are just afraid of Copilot.

It can be both things. (I'm not endorsing either view, just trying to clarify.)

Fear here on HN.

Reply on news.ycombinator.com