Live data from Hacker News

AI-powered open-source code laundering

github.com

81–90 of 93 posts

Re: AI-powered open-source code laundering

#81
post #61

If we step back and examine LLMs more broadly (beyond our personal use cases, beyond "economic impact", beyond the underlying computer science) what we are largely looking at is an emerging means of collaboration. I am not an expert computer scientist, and yet I can "collaborate" (I almost feel bad using this term) with expert computer scientists when my LLM helps me design my particular algorithm. I am not an expert…

Me copying and pasting your post verbatim to put on my blog under my name: "I greatly enjoyed collaborating with arthurofbabylon on this piece."

Forget about copying and pasting – the act of reading it is on the spectrum of collaboration. But thanks for the citation.

Re: AI-powered open-source code laundering

#82

The license was MIT until two months ago. That gives anyone the right to get the source code of that commit and do whatever. The article does not specified if the company is still using the code AFTER the license change. The rest of the points are still valid.

MIT places the following condition on the licencee if they wish to re-distribute the code:

> The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

Which the other party was not doing.

Re: AI-powered open-source code laundering

#83

Is the allegation here that a LLM generated code that was very similar to the author's copyright protected code or that they copied the code and then tried to use AI to hide that fact?

The allegation is that the party in question copied the author's code verbatim and stripped off the copyright / licence notices.

Re: AI-powered open-source code laundering

#84
post #32

This will kill open source. Anything of value will be derived and re-derived and re-re-derived by bad players until no-one knows which package or library to trust. The fatal flaw of the open internet is that bad players can exploit with impunity. It happened with email, it happened with websites, it happened with search, and now it's happening with code. Greedy people spoil good things.

Yup, a fundamental side effect of freedom is that some people are assholes and will abuse it.

No, it won't kill open source, just as it hasn't killed the Internet.

Re: AI-powered open-source code laundering

#85
post #82

The license was MIT until two months ago. That gives anyone the right to get the source code of that commit and do whatever. The article does not specified if the company is still using the code AFTER the license change. The rest of the points are still valid.

MIT places the following condition on the licencee if they wish to re-distribute the code: > The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. Which the other party was not doing.

I looked at their codebase and it seems the other party was doing. I'm seeing a pattern here where either this is not really a copyright problem but possibly a marketing stunt if its not, then it may well be an emotional spiral or lash-out for one person extending another's open source logic even with attribution clearly given. If so then this is not healthy for the open-source community.

Also is it legal to start with MIT and change to Apache midway? The laws around opensource licensing are so tricky and cutthroat at this point.

Also does anyone know what this Intentional License is from the other party, I have never seen it before. It seems that's what their main package is while the other packages are Apache. If its custom is it even legal to just create a new OSS License out of nothing?

There's too much gray area with OSS especially when it comes to legalities we almost need a standard.

Re: AI-powered open-source code laundering

#86

Earlier quoted context omitted.

Stop being a coward and have a discussion with me with your real identity. You can whine about something till you're dead, but incentives drive actions, full stop. Instead of whining about normalization, lobby lawmakers to make actual change and build tools to help creators detect the issue.

1 Stop telling me what to do 2 The incentives is to steal and rampage and rape. Some incentives deserve to die in fire, period. To change incentives we punish people or change people. Posts like these help I think trying to shut up these efforts by saying this is "normal" is only done by people in that industry or invested in it who profit from this disaster

How about this... If I was afraid to attach my public identity to my views on the internet, that would probably trigger some reflection in me as to the root cause of that emotion. I'm guessing shame, but people are complex so YMMV.

If the incentive was to steal and rampage and rape, people would be doing it more. The incentives are reversed though; 10 years in prison for rape, 6 years for stealing, and the odds are you will get caught eventually. If we removed law enforcement, there would be a lot more stealing and raping, though people would take justice in to their own hands as they did in cases of theft and rape in olden times.

Ultimately this is a dumb back and forth because we agree about the wrongness of the act, we just disagree about the best course of action and the ultimate value of certain approaches. You keep doing you, but if you really care about this I'd suggest you do something more productive than trying to high horse people on the internet about norms.

Re: AI-powered open-source code laundering

#87

Earlier quoted context omitted.

1 Stop telling me what to do 2 The incentives is to steal and rampage and rape. Some incentives deserve to die in fire, period. To change incentives we punish people or change people. Posts like these help I think trying to shut up these efforts by saying this is "normal" is only done by people in that industry or invested in it who profit from this disaster

How about this... If I was afraid to attach my public identity to my views on the internet, that would probably trigger some reflection in me as to the root cause of that emotion. I'm guessing shame, but people are complex so YMMV. If the incentive was to steal and rampage and rape, people would be doing it more. The incentives are reversed though; 10 years in prison for rape, 6 years for stealing, and the odds are y…

You agree with me, incentives against rape and robbery because of laws and punishment. Sadly copyright laws are not made for LLMs yet. But we can still name and shame.

Re: AI-powered open-source code laundering

#88
post #82

Earlier quoted context omitted.

MIT places the following condition on the licencee if they wish to re-distribute the code: > The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. Which the other party was not doing.

I looked at their codebase and it seems the other party was doing. I'm seeing a pattern here where either this is not really a copyright problem but possibly a marketing stunt if its not, then it may well be an emotional spiral or lash-out for one person extending another's open source logic even with attribution clearly given. If so then this is not healthy for the open-source community. Also is it legal to start wi…

I'm the victim and yes, this is not entirelly about AI. If you have read the hall of shame, you'll know that they tends to lie. If it was only someone tried to use my code as their basis and forgot to include the attribution, after my notice they added, it's totally not worth a "hall of shame", and I'm actually glad that someone finally appreciates my works and make them useful.

But the reality is, they lied to everyone and I'm a chained victim. I was introduced to him by NativeScript, and before that he didn't even know the existence of rEFui. Now rEFui has become the most important fundament of their entire project, clearly indicates that they want to get something for nothing from the very beginning.

Till now they still didn't answer me why they made the basic mistakes and how it was fixed.They avoid everything I ask about them unless I presure them very hard, they'll give a very vage respond that answers nothing.

> is it legal to start with MIT and change to Apache midway?

As the author of the project, I have every right to change the license to anything. But also, I didn't wash the history to hide that the project was MIT. Technically I can, but that actually violates MIT itself and I don't want to be someone that say one thing and do another.

> even with attribution clearly given

They won't until I presured them very hard. They also washed much more than my projects, but also without attribution until I notified those project's authors. Actually, till now the code are still not fully attributed, only few get a proper attribution. They have now extracted code blocks from my original project into many many small separated files (potentially trying to hide the origin even further), but the code logic are actually not changed at all. According to those license, each piece of code they extract should keep an attribution to my original project.

I have a backup of the deleted project that contains the entire commit history of how he laundered these projects, and I can provide the entire Discord message history if you need evidence of all my statements.

Re: AI-powered open-source code laundering

#89

Earlier quoted context omitted.

I looked at their codebase and it seems the other party was doing. I'm seeing a pattern here where either this is not really a copyright problem but possibly a marketing stunt if its not, then it may well be an emotional spiral or lash-out for one person extending another's open source logic even with attribution clearly given. If so then this is not healthy for the open-source community. Also is it legal to start wi…

I'm the victim and yes, this is not entirelly about AI. If you have read the hall of shame, you'll know that they tends to lie. If it was only someone tried to use my code as their basis and forgot to include the attribution, after my notice they added, it's totally not worth a "hall of shame", and I'm actually glad that someone finally appreciates my works and make them useful. But the reality is, they lied to every…

Based on what you just said, it's not a copyright issue since you admitted that they gave attribution of which we can all see in their licenses and in some file notices. And based on my analysis of their codebase and as someone who's been coding for 20 years and what you just admitted to its not an AI issue either. Anyone who knows how to code would be able to tell AI Slop from structured human code. However, you kept referencing two or more repositories so which one?

> They also washed much more than my projects,

There's a lot of projects that use others as the basis of theirs as long as they have given attribution and have created a different upstream. Also the projects seemed very different from each other. If the case is a washed up project then that actually means its a completely different project.

> till now the code are still not fully attributed

My advice will be to reach out to the authors and point exactly the files you think is missing attribution. Since they have already added attribution and licenses as I can see, then I'm sure a few missing notices wouldn't kill them. But that's something you'd need to work out with them.

> I have a backup of the deleted project that contains the entire commit history of how he laundered these projects,

This is not relevant if its a deleted repository. I would suggest you focus on the new project you think is still in violation instead of referring to a completely different project if you want to hold a good stance.

In my opinion there's really no value in code anymore, I think the value should be what problem you are solving in a unique way. There are already millions of open-source projects on the internet and any one of them could have the same logic not because someone copied the other but because they were probably trying to solve the same problem and hence came to the same conclusion.

> Till now they still didn't answer me why they made the basic mistakes and how it was fixed.They avoid everything I ask about them unless I presure them very hard, they'll give a very vage respond that answers nothing.

As someone who has been in the industry for a long time, this comes off as entitled and demanding which may put the other party off and force them not to collaborate with you, I have seen this happen many times when people reach out to others to use their work as the foundation for a new work there is usually a sense of collaboration involved especially in OSS. When one party becomes entitled this is what causes forks and upstreams.

If you ask me as someone who has been in the same position as you it really is an easy fix. Simply reach back out in private since you've already been introduced without any anger or grandiosity (I know the situation can cause one to feel emotional). Someone arguing in good faith is always better than someone venting or spiraling. This will also be a good look for you and your project otherwise everyone one on the internet will just keep telling you what you want to hear but not the reality of how the industry work or how to actually fix it.

> it's totally not worth a "hall of shame"

You are right here. Imagine if every project that upstreamed another MIT or Apache project added this to their repository. An example would be if Feather Icons added Lucide Icons to their hall of shame because Lucide Icons created a derivative but still totally different work from Feather Icons. Also, Imagine someone added your own project to their hall of shame, you would no longer want to work with them would you? OSS has always been about community and collaboration. This is not it.

But my opinion are just mine feel free to approach this anyway you like but nobody wants the creators of the projects they use to have a bad look.

> I'm actually glad that someone finally appreciates my works and make them useful

I think you already have leverage here since they are most likely to even go out of their way to keep you happy but you just have to approach it from a sensible way especially if they are people with more resources than you which it seems if they where introduced by NativeScript.

> clearly indicates that they want to get something for nothing from the very beginning

Since they where introduced to you by a trusted party then your assessment on them trying to get something for nothing may not be true. Because bad actors would usually not bother in the first place. So its most likely they don't actually have any bad intentions and where probably put off by something else. Also you mentioned they Sponsored you in the hall of shame this is not the behavior of people with bad intentions. I'm just saying there is a possibility that you are seeing or approaching this wrongly.

Re: AI-powered open-source code laundering

#90
We've seen cases where AI-generated code includes snippets that look suspiciously like they came from proprietary codebases. If an AI model was trained on copyrighted code and reproduces patterns from it, who's liable? The training process makes it really hard to trace back to original sources.
Post reply on HN