[dead]
Most people license out the software under specific requirements and prohibitions. BSD requires attribution. GPL variants require adherence to copyleft when distributing derivative works. A little under half of all github repos don't even have a license, which means that though the source is published, no one has any license under which to copy it or derive new works from it.
So far as I have seen, whether aggregating and munging these works into abstract LLM weights constitutes fair use is still legally unclear. If not deemed fair use, it is almost certainly a massive violation of copyright.
If you don't want your code to be used as possible inspiration, then you are not actually for open source, and are using the wrong license. The licenses are legal bindings, not moral bindings.
"Don't use any concept found within this code" would be a license that doesn't really fit with any current copyright law, and it wouldn't allow any software to exist, except that made in the 70's.
Traditional reimplementation often separates the roles of investigation and implementation specifically to avoid assertions of copyright infringement. WINE, for example, does not accept patches from anyone with prior experience in the Windows code base.
By training and generating from the same the LLM, as one necessarily must do as LLMs are built from training, you inherently violate this distinction.
>If you don't want your code to be used as possible inspiration
Inspiration is a human affect. Training an LLM and generating tokens therewith are mechanical processes.
Courts have not yet decided whether LLM data mogrification truly constitutes fair use.
>then you are not actually for open source, and are using the wrong license. The licenses are legal bindings, not moral bindings
It is not for you to decide what rights someone else wishes to attach to code they release. There are many open source licenses for those wishing to grant various sets of rights. Your reference to morality seems more in line with the GPL specifically, as the Free Software Foundation has a moral stance on freedom in computing not necessarily shared by other open source licenses. 'Free Software' is the term taking a moral software stance.
>"Don't use any concept found within this code" would be a license that doesn't really fit with any current copyright law
Yes. That would be a patent.
>and it wouldn't allow any software to exist, except that made in the 70's.
Patents only last 20 years. They have frequently delayed the spread of certain algorithms and data file formats under their restrictions. This has frequently lead to open source, and proprietary for that matter, being forced to invent their own methods to work around the prohibited ones.
That is, they knowingly and willingly broke the law by stealing an unprecedented volume of proprietary, copyrighted materials.
Books: Bartz v. Anthropic
Films and TV: Disney Enterprises Inc. v. Midjourney Inc.
Music: Concord Music Group, Inc. v. Anthropic
Photography: Getty Images v Stability AI
Journalism: Postmedia Network Inc., Torstar Corporation, The Globe and Mail Inc., and The Canadian Press v. Anthropic PBC
[0] https://en.wikipedia.org/wiki/Grand_Upright_Music%2C_Ltd._v.....
Or at least just childishly naive for failing to notice that beforehand.
The point of the open source I work on is to contribute to a commons, not to have it stolen so that it can be used to destroy those commons, used for the profit of techbros, and used to justify the murder of children.
To be further pedantic, is that really stealing? They are disregarding copyright but was anything taken from anybody? I thought that was the old argument for piracy, ie, nobody was deprived of anything.
This works for established profitable brands that want to build / maintain a good public image.
This isn’t the marketing needed by an unprofitable startup that wants to show hyper growth before its IPO. They need the “use our product or get pwned” kind of marketing.
https://openai.com/form/enterprise-trusted-access-for-cyber/
"Daybreak enables vetted enterprise customers and cybersecurity practitioners to use our most capable models for dual-use cybersecurity work."
They explicitly give out access to those who will make a big announcement of bugs found. OpenAI does not want projects to fix bugs themselves so it can have more bugs and better marketing.
https://openai.com/form/codex-for-oss/ is their program for giving access directly to open source maintainers directly so they can fix bugs.
And I doubt throwing a pile of money at OSS projects will make much difference. Those that care are already doing "100% code coverage, run ASAN and fuzzers" (we are, for example) without getting the funding, those that don't will at most make a token effort to justify the funding and leave it at that. The issue is both lack of interest in doing it and, more importantly, lack of people and time to do it. Having a third party come in, do the audit, and submit the results, means the work actually gets done rather than indefinitely deferred due to lack of time, interest, or people.
Finally, the AI audit turns up complex technical issues that no amount of testing, ASAN, and fuzzing will ever find. They're two completely different things, we've found exactly zero overlap between what SAST tools and AI has found.