Live data from Hacker News

Analyzing the legal implications of GitHub Copilot

fossa.com

61–70 of 173 posts

Re: Analyzing the legal implications of GitHub Copilot

#62

> As we mentioned, GitHub trains Copilot on numerous pieces of public code, many of which are covered by strong copyleft licenses (i.e. GPL v2, GPL v3). Copyleft licenses require that derivative works (of the copyleft-licensed code) must carry the same license as the original code. Even when no GPL v2/3 code is quoted by Copilot, is using the code for training a non-free product allowed under the license? Under the l…

When you upload code to Github, you agree to license it to them under Github's terms, and not whatever license the software is typically distributed under. You are effectively "dual licensing" software by uploading it to Github, whether you realize it or not. Of course, there are edge cases in which you don't have the rights to license the software to Github, but in those cases, I don't have the answer.

Re: Analyzing the legal implications of GitHub Copilot

#63

Earlier quoted context omitted.

I think it’s important to recognize that most ML models will not be built in top of copyleft material. It will mostly use data that we as users have voluntarily provided to someone at some point and to which that platform now claims ownership. So we need to think long and hard about whether or not we believe any of these models should receive any copyright protection at all and in a much broader context. I think if w…

I don't know if by "You’re basically saying" you mean me specifically, but if you do, you're dead wrong. I'm not ok with this at all. However, I'm not so stupid to think me, as a non-IP lawyer can make sense of the current legal situation (which is what copyright is; law) or even propose new laws. However, as a dev I can think about it and say "to me, this is immoral and unethical", and refuse to use Copilot, not wor…

I didn’t mean you specifically. I think the ethical conversation is more interesting but I also think that people will feel different if, say, the Linux Foundation releases its own version of copilot and it’s not just one company reaping the rewards of all that code. And I’d like to make it easy for other competitors to do exactly that. It will be harder for them to do that if we think that the models themselves are copyrightable. I don’t think something like copilot is going to make anyone think twice 5 yrs from now any more than we think twice about something like google autocomplete or google search thumbnail images. I think stuff like copilot if properly tuned won’t be providing a substitute for whole GPL projects. I don’t think OSS communities will be damaged by this in any way. In fact those same oss communities are going to be some of the biggest users of these sorts of tools just like they use stackoverflow today.

Re: Analyzing the legal implications of GitHub Copilot

#64
post #8

Earlier quoted context omitted.

What about open source projects where the uploader and github users are not the only copyright holders? As a user i can't grant github any random license for the code, if I maintain for example Linux or python or any other old project there. The ONLY available terms are those given by the license, surely?

If you are putting up code on GitHub to which you don’t have all the rights you’re actually in violation of their TOS and you are violating the rights of other copyright holders. I understand this is common and may not violate community norms or expectations but it is technically a license violation on multiple fronts. Contributors who add to existing GitHub projects are providing the same license to GitHub as the pr…

Today is the first time I've considered that, but it's certainly something we should think about. If big projects moved on this, I think github would take notice and "issue a clarification".

Re: Analyzing the legal implications of GitHub Copilot

#65
post #61

If this really counts as fair use it turns into a giant loophole to steal any IP you want. Just create a website with a github-like TOS, upload some disney copyrighted pictures to it, train a GAN super overfitted on the images, and then claim mickey mouse as your own.

This is interesting.

But I think you'd violate Disney's copyright by uploading their pictures to the website.

To make it work, Disney would have to upload the pictures themselves and agree to the TOS.

Re: Analyzing the legal implications of GitHub Copilot

#66
post #3

“If you look at the GitHub Terms of Service, no matter what license you use, you give GitHub the right to host your code and to use your code to improve their products and features,” Downing says. “So with respect to code that’s already on GitHub, I think the answer to the question of copyright infringement is fairly straightforward.” I don't know if it's really that straightforward. The TOS includes snippets like th…

Yeah, I don't think bettering their products includes verbatim incorporation of code into those products.

Also, for the part about small snippets being non copyrightable. I would suggest looking at the Google/Oracle case. Google was found guilty of infringement for a very small number of lines, but the award to Oracle was IIRC rather a joke (something like one dollar, indicating it was infringing but largely irrelevant).

Re: Analyzing the legal implications of GitHub Copilot

#67

Earlier quoted context omitted.

But legally, they can't provide such a license. So GitHub can't have that license, surely, because they never had the legal authority to bestow it upon Github.

That was a problem before copilot though. And copyright holders have and will continue to have the right to send DMCA take-down notices if they like.

I think the bigger question is whether GitHub will be able to honor DMCA requests that pertain to copyrighted materials showing up in Copilot's suggestions.

Re: Analyzing the legal implications of GitHub Copilot

#68
post #31

Given this fair use argument that the work is probably transformative enough here's what I'll be doing next. I'll take the Windows and Office source code, run it through a decompiler and then train a neural network on that output. This sequence of steps should be at least as transformative of Microsoft's copyright as what Copilot is doing with the open-source corpus, probably much more so. I will then use that neural…

I've heard something similar in response to Copilot in another thread (something like offering a sum of money to Github if they train their model exclusively on the Windows NT source code). But I think the legal theory here is that Copilot is trained on many thousands of sources. If Copilot was trained on a single source, or even a small handful of sources, the derivative work claim becomes much stronger. When traine…

> When trained on many sources, it becomes much harder to claim that its a derivative of another work.

Sounds good in theory, until it starts producing snippets verbatim from uniquely-identifiable sources.

Re: Analyzing the legal implications of GitHub Copilot

#69
> “If you look at the GitHub Terms of Service, no matter what license you use, you give GitHub the right to host your code and to use your code to improve their products and features,” Downing says. “So with respect to code that’s already on GitHub, I think the answer to the question of copyright infringement is fairly straightforward.”

GitHub's Terms of Service doesn't override licensing terms.

Re: Analyzing the legal implications of GitHub Copilot

#70
post #31

Given this fair use argument that the work is probably transformative enough here's what I'll be doing next. I'll take the Windows and Office source code, run it through a decompiler and then train a neural network on that output. This sequence of steps should be at least as transformative of Microsoft's copyright as what Copilot is doing with the open-source corpus, probably much more so. I will then use that neural…

I've heard something similar in response to Copilot in another thread (something like offering a sum of money to Github if they train their model exclusively on the Windows NT source code). But I think the legal theory here is that Copilot is trained on many thousands of sources. If Copilot was trained on a single source, or even a small handful of sources, the derivative work claim becomes much stronger. When traine…

>If I studied a bunch of different open-source projects, learned techniques from them, and implemented them in my own projects, is that a derivative work? Probably not.

That's pretty unclear actually. If it's quite close to the original work, it is derivative. Even though you have probably been "trained" on quite a few different codebases over the years. Hence the existence of clean-room implementations, wherein the people building a new implementation have never seen the original.

Also, given that code that has been passed through a biological network (ie, brain) can constitute infringement, it seems obvious that code passed through a mechanical one could too. Maybe not in every case, but it certainly seems plausible.

Post reply on HN