I noticed a very peculiar thing with copilot. I was writing a twitter api wrapper and had hardcoded access token for a test user. Copilot when testing a function that requires a user id suggested one. I searched the id and it belonged to my test user. I searched my entire codebase but couldn't find any place I had used the particular id. The only place it could have extracted it from would have been access token whic…
Ask HN: Any indications Copilot scans your local files?
41–50 of 88 posts
Re: Ask HN: Any indications Copilot scans your local files?
#42Earlier quoted context omitted.
I’m assuming you meant “blurb” instead of “blur”?
Thanks corrected. While we are at it. Is it "make the following experiment" or "do the following experiment" ?
Re: Ask HN: Any indications Copilot scans your local files?
#43Have you told your client that you are making use of tools that upload the intellectual property they’ve shared with you / they’ve paid you to create for them, onto third-party servers? If I was paying for work and the contractor was uploading the end result onto some sort of shared AI training set, we would not be working together for very long. You may have brought up an excellent point that needs to be inserted in…
> uploading the end result onto some sort of shared AI training set Does Copilot use the data it collects for training their AI? From their terms [1] > GitHub Copilot does not use these URLs, file paths, or snippets collected in your telemetry as suggestions for other users of GitHub Copilot. This information is treated as confidential information and accessed on a need-to-know basis. [1] https://docs.github.com/en/g…
So someone just needs access to your account to get snippets from your private code.
Re: Ask HN: Any indications Copilot scans your local files?
#44I noticed a very peculiar thing with copilot. I was writing a twitter api wrapper and had hardcoded access token for a test user. Copilot when testing a function that requires a user id suggested one. I searched the id and it belonged to my test user. I searched my entire codebase but couldn't find any place I had used the particular id. The only place it could have extracted it from would have been access token whic…
What was the user id? testuser1? Or something more convoluted?
Re: Ask HN: Any indications Copilot scans your local files?
#45How exactly does Copilot not open Microsoft up to significant legal liability, when it has been demonstrated that copilot will regurgitate entire blocks of scanned code?
EDIT: The user would perhaps be the direct infringer as the person who made a copy of the code, even unwittingly.
Source: current law student taking copyright and writing a paper about Copilot.
[0] https://en.wikipedia.org/wiki/American_Broadcasting_Cos.,_In....
[1] https://en.wikipedia.org/wiki/Sony_Corp._of_America_v._Unive....
Re: Ask HN: Any indications Copilot scans your local files?
#46I noticed a very peculiar thing with copilot. I was writing a twitter api wrapper and had hardcoded access token for a test user. Copilot when testing a function that requires a user id suggested one. I searched the id and it belonged to my test user. I searched my entire codebase but couldn't find any place I had used the particular id. The only place it could have extracted it from would have been access token whic…
I was creating a unit test in a Go codebase and I had dumped the JSON that I was going to be decoding at the top of the file, and when I started writing the assertions, Copilot was very quick to use the data from the JSON, with quite high accuracy, based solely on me typing which ticker I was going to assert against.
Re: Ask HN: Any indications Copilot scans your local files?
#47How exactly does Copilot not open Microsoft up to significant legal liability, when it has been demonstrated that copilot will regurgitate entire blocks of scanned code?
It's unclear whether MS would be directly liable for copyright infringement; the Aereo case[0] perhaps expanded a device-maker's direct liability for user actions. MS would likely escape secondary copyright liability because the verbatim suggestions are really rare, and the standard under the Sony VCR case[1] is whether the device is "capable of substantial non-infringing uses." EDIT: The user would perhaps be the di…
Re: Ask HN: Any indications Copilot scans your local files?
#48Earlier quoted context omitted.
Thanks for the pointer but I don't think this is what happened in my case. I never opened the marketing assets in VSCode. They reside in completely separate folders.
Are you using Windows? IIRC Microsoft collects a hefty amount of data from your filesystem.
Re: Ask HN: Any indications Copilot scans your local files?
#49Have you told your client that you are making use of tools that upload the intellectual property they’ve shared with you / they’ve paid you to create for them, onto third-party servers? If I was paying for work and the contractor was uploading the end result onto some sort of shared AI training set, we would not be working together for very long. You may have brought up an excellent point that needs to be inserted in…
> you are making use of tools that upload the intellectual property [...] onto third-party servers? That's the whole point: if they did, it was NOT willingly: they have the intellectual property stored in a completely separate folder, which should not be uploaded to Github.
Re: Ask HN: Any indications Copilot scans your local files?
#50Earlier quoted context omitted.
It's unclear whether MS would be directly liable for copyright infringement; the Aereo case[0] perhaps expanded a device-maker's direct liability for user actions. MS would likely escape secondary copyright liability because the verbatim suggestions are really rare, and the standard under the Sony VCR case[1] is whether the device is "capable of substantial non-infringing uses." EDIT: The user would perhaps be the di…
Fascinating, thank you! I imagine this would make it even more likely that large orgs would ban the use of VS Code.
Other stuff within copyright makes infringement of a small Copilot snippet less likely too, and the recent Google v. Oracle decision reinforced the fact that copyright is an awkward fit within copyright and may sometimes get less protection than things like fictional books. Fair use also comes in here, too; remember something as "egregious" as Google copying 37 Java packages worth of package / class / method declarations into Android was held a fair use. Declaring code is sort of special because it's more like an interface, but the Court really reinforced the notion that it likes cool new technology stuff that opens new markets, makes new products, etc., and a fair use finding for small snippets of code is in line with that as adapting copyright doctrine in the face of tech changes like AI / ML.