Updates to GitHub Copilot interaction data usage policy • Hacker News Board

Re: Updates to GitHub Copilot interaction data usage policy

#121

Post by halfcat » Thu, Mar 26, 2026, 1:28 AM UTC

stefanos82 wrote: post #109

Serious question: let's say I host my code on this platform which is proprietary and is for my various clients. Who can guarantee me that AI won't replicate it to competitors who decide to create something similar to my product?

If the code is ever visible to anyone else ever, you have no guarantee. If it’s actually valuable, you have to protect it the same way you’d protect a pile of gold bars.

What does “my code...for my clients” mean (is it yours or theirs)? If it’s theirs let them house it and delegate access to you. If they want to risk it being, ahem...borrowed, that’s their business decision to make.

If it’s yours, you can host it yourself and maintain privacy, but the long tail risk of maintaining it is not as trivial as it seems on the surface. You need to have backups, encrypted, at different locations, geographically distant, so either you need physical security, or you’re using the cloud and need monitoring and alerting, and then need something to monitor the monitor.

It’s like life. Freedom means freedom from tyranny, not freedom from obligation. Choosing a community or living solo in the wilderness both come with different obligations. You can pay taxes (and hope you’re not getting screwed, too much), or you can fight off bears yourself, etc.

Re: Updates to GitHub Copilot interaction data usage policy

#122

Post by stavros » Thu, Mar 26, 2026, 2:11 AM UTC

nulld3v wrote: post #106

QuadrupleA wrote: post #79

Fun fact: Copilot gives you no way to ignore sensitive files with API keys, passwords, DB credentials, etc.: https://github.com/orgs/community/discussions/11254#discussi... So by default you send all this to Microsoft by opening your IDE.

Sadly, this issue is systemic: https://github.com/openai/codex/issues/2847

OpenCode has a plugin that lets you add an .ignore file (though I think .agentignore would be better). The problem is that, even though the plugin makes it so the agent can't directly read the file, there's no guarantee the agent will try to be helpful and do something like "well I can't read .envrc using my read tool, so let me cat .envrc and read it that way".

Re: Updates to GitHub Copilot interaction data usage policy

#123

Post by heavyset_go » Thu, Mar 26, 2026, 2:18 AM UTC

sph wrote: post #5

Thanks to Github and the AI apocalypse, all my software is now stored on a private git repository on my server. Why would I even spend time choosing a copyleft license if any bot will use my code as training data to be used in commercial applications? I'm not planning on creating any more opensource code, and what projects of mine still have users will be left on GH for posterity. If you're still serious about openso…

Made the same choice, my open source projects with users are in maintenance mode or archived. New projects are released via SaaS, compiled artifacts or not at all.

I scratch my open source itch by contributing to existing language and OS projects where incremental change means eventually having to retrain models to get accurate inference :)

Re: Updates to GitHub Copilot interaction data usage policy

#124

Post by phendrenad2 » Thu, Mar 26, 2026, 2:20 AM UTC

So I do all the work of thinking about how to do something, and as soon as I tell Copilot about it, not it's in the training data and anyone can ask the LLM and it'll tell them the solution I came up with? Great. I'm going to cancel.

Re: Updates to GitHub Copilot interaction data usage policy

#125

Post by w4yai » Thu, Mar 26, 2026, 2:46 AM UTC

matltc wrote: post #39

hmate9 wrote: post #24

For what it's worth they're not trying to hide this change at all and are very upfront about it and made it quite simple to opt out.

They didn't even link the setting in their email. They didn't even name it specifically, just vaguely gestured toward it. Dark patterns, but that's Microslop for ya

I've seen worse dark pattern to be honest... I don't think they're being malicious here.

Re: Updates to GitHub Copilot interaction data usage policy

#126

Post by thrdbndndn » Thu, Mar 26, 2026, 2:59 AM UTC

lenova wrote: post #36

mentalgear wrote: post #8

> On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out. Review this update and manage your preferences in your GitHub account settings. Now "Allow GitHub to use my data for AI model training" is enabled by default. Turn it off here: https://github.com/settings/copilot/features Do they have this set on business accounts also by default? If so, this is really shady.

Ugh, can't believe they made this opt-in by default, and didn't even post the direct URLs to disable in their blog post. To add on to your (already helpful!) instructions: - Go to https://github.com/settings/copilot/features - Go to the "Privacy" section - Find: "Allow GitHub to use my data for AI model training" - Set to disabled

I always thought "opt-in" (not "opt in") meant something you have to actively choose to enable; otherwise, it stays off. So calling something "opt-in by default" sounds like a misnomer to me.

But English is not my first language so please correct me if I'm wrong.

Re: Updates to GitHub Copilot interaction data usage policy

#127

Post by tglman » Thu, Mar 26, 2026, 3:06 AM UTC

UqWBcuFx6NV4r wrote: post #100

rzmmm wrote: post #69

Earlier quoted context omitted.

I wish my GPL license would transit along with my code.

If you are wholly confident that model training is a violation of the GPL then go sue.

I guess freedom of study and use may include also training AI, but would be cool if all the derivate work, as AI models and generated code from AI models should be licensed as GPL, layers needed here

Re: Updates to GitHub Copilot interaction data usage policy

#128

Post by WatchDog » Thu, Mar 26, 2026, 3:07 AM UTC

0xbadcafebee wrote: post #97

QuadrupleA wrote: post #79

Fun fact: Copilot gives you no way to ignore sensitive files with API keys, passwords, DB credentials, etc.: https://github.com/orgs/community/discussions/11254#discussi... So by default you send all this to Microsoft by opening your IDE.

Separate fun fact: Gemini CLI blocks env vars with strings like 'AUTH' in the name. They have two separate configuration options that both let you allow specific env vars. Neither work (bad vibe coding). Tried opening an issue and a PR, and two separate vibe-coding bots picked up my issue and wrote PRs, but nobody has looked at them. Bug's still there, so can't do git code signing via ssh agent socket. Only choice is…

Gemini also won't help you with C++ if you are under 18, since it would be unsafe.

https://news.ycombinator.com/item?id=39632959

Re: Updates to GitHub Copilot interaction data usage policy

#129

Post by martinwoodward » Thu, Mar 26, 2026, 3:27 AM UTC

gpm wrote: post #19

archb wrote: post #10

Earlier quoted context omitted.

Interestingly, it is disabled by default for me.

Me too, which is making me wonder if they're planning on silently flipping this setting on April 24th (making it impossible to opt out in advance).

We are not. The reason we wanted to announce early was so that folks had plenty of time to opt-out now. We've also added the opt-out setting even if you don't use Copilot so that you can opt-out now before you forget and then if you decide to use Copilot in the future it will remember your preference.

Re: Updates to GitHub Copilot interaction data usage policy

#130

Post by 8cvor6j844qw_d6 » Thu, Mar 26, 2026, 3:48 AM UTC

martinwoodward wrote: post #77

OtherShrezzing wrote: post #48

It’s not clear to me how GitHub would enforce the “we don’t use enterprise repos” stuff alongside “we will use free tier copilot for training”. A user can be a contributor to a private repository, but not have that repository owner organisation’s license to use copilot. They can still use their personal free tier copilot on that repository. How can enterprises be confident that their IP isn’t being absorbed into the…

We do not train on the contents from any paid organization’s repos, regardless of whether a user is working in that repo with a Copilot Free, Pro, or Pro+ subscription. If a user’s GitHub account is a member of or outside collaborator with a paid organization, we exclude their interaction data from model training.

For private repositories under a personal account, if the repo owner has opted out of model training but a collaborator has not, would the collaborator's Copilot interactions with that repo still be used for training?