Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub Copilot for Business is now available

github.blog

Post reply on HN
Print view View original

101–110 of 127 posts

Re: GitHub Copilot for Business is now available

#101

Post by JoshTriplett »

danuker wrote: post #99
JoshTriplett wrote: post #95

Earlier quoted context omitted.

> I would prefer to see full license attributions included in generated responses, though. Something that then also wouldn't be that difficult to generate a licenses file from? Exactly. By all means build tools like this, but build them to actually comply with Open Source licenses . Provide a list of the licenses you don't mind copying from, and get back attributions with your suggestions.

Suppose Copilot offered some pure-MIT licensed flavor. Copilot could comply with MIT licenses by just outputting an MIT license with ALL the authors of code used in training.

That'd be a valid solution, if impractical. I doubt that people would be willing to copy hundreds of thousands of license notices into their project.

Re: GitHub Copilot for Business is now available

#102

Post by danuker »

fire wrote: post #88
LelouBil wrote: post #81

Earlier quoted context omitted.

> Amazon's CodeWhisperer has a "reference tracker" that tells you the license of training data code if the generated response is within some similarity threshold, but that's still not good enough imo. I don't think it's possible to do better than that with this technology.

like I probably don't understand this in the right way, but I could have sworn we had the ability to probe latent space on models like these and make mappings based on them? Or was that only for diffusers?

Sure, you could build an index of attribution latent space coords, but it would not be clear whether a generated document near several index entries would require compliance.

I guess this is where the threshold comes from. Choose a generous margin and over-attribute rather than under-attribute.

Re: GitHub Copilot for Business is now available

#103

Post by JoshTriplett »

Kiro wrote: post #43
JoshTriplett wrote: post #5

Sadly, "simple license management" here just refers to "who in your organization has a license to use this tool", rather than "where did this code come from and what license is it under". This tool remains the equivalent of money laundering for violation of Open Source licenses (or software licenses in general).

You make it sound like Copilot is just copy-pasting something from a single repo. The code Copilot generates for me is extremely specific to my application. It understands the context, my code style and what I'm trying to do. The result looks like my own code and is utilizing the already existing parts of my application. The code it writes for me solves problems that you cannot find a standard solution for anywhere a…

> You make it sound like Copilot is just copy-pasting something from a single repo.

Not at all. I'm saying it's derived from large amounts of code, without respecting the licenses on that code.

> How Copilot is trained is an issue but answering the question "where did this code come from and what license is it under" would be impossible.

Then it shouldn't exist outside of demos of what could exist in the future if the showstopper legal problem gets solved. Let's get people treating that constraint as business-critical and start coming up with clever solutions, and see how long "impossible" lasts.

Re: GitHub Copilot for Business is now available

#104

Post by danuker »

JoshTriplett wrote: post #101
danuker wrote: post #99

Earlier quoted context omitted.

Suppose Copilot offered some pure-MIT licensed flavor. Copilot could comply with MIT licenses by just outputting an MIT license with ALL the authors of code used in training.

That'd be a valid solution, if impractical. I doubt that people would be willing to copy hundreds of thousands of license notices into their project.

One perspective is that those authors actually contributed to the end result.

But sure, disk size could be a problem.

Re: GitHub Copilot for Business is now available

#105

Post by JoshTriplett »

hathawsh wrote: post #72
aunch wrote: post #7

if you want an actual enterprise solution with in-customer-tenant/on-prem hosting, check out Codeium ( https://www.codeium.com/enterprise ) disclaimer: i'm from the Codeium team. but really, we will even ship you a physical box if that level of data security is important to you

I looked around your web site and I thought about trying out your product, but one feeling never stopped nagging me: even though I'm not in a large organization, I need absolute assurance that the AI is trained only on our code and permissively licensed open source software (like MIT or BSD.) Also, whenever it uses permissively licensed code, I need a complete list of everything it based its work upon so I can declar…

Exactly this. Also, even the "our code" case if not done carefully may copy code from one or more internal projects that had in turn copied with attribution from an Open Source project, and fail to propagate the attribution.

Re: GitHub Copilot for Business is now available

#106

Post by thesuperbigfrog »

Gigachad wrote: post #84
thesuperbigfrog wrote: post #71

Earlier quoted context omitted.

>> All AI tools are trained on copyrighted data. The tools are too useful to cripple with restrictive laws written for a previous era. Are you sure that Disney and Games Workshop will not mind if make your own Mickey Mouse / Warhammer 40K cross-over movie for profit? (I would watch it!) AI can help generate it, so it must be okay.

Those are protected by trademark law which will still be strong in a post AI world. I'm sure those companies will be making massive use of AI to speed up content production.

You previously stated "The tools are too useful to cripple with restrictive laws written for a previous era." and also "Those are protected by trademark law which will still be strong in a post AI world."

So do you believe in legal protections for trademarked and copyrighted works or not?

If an AI assistant generates content that includes copyrighted or trademarked elements is the content "too useful to be crippled by restrictive laws" or "protected by laws which will still be strong" ?

Re: GitHub Copilot for Business is now available

#107

Post by JoshTriplett »

Maxious wrote: post #74
rwalle wrote: post #24

So the code suggestion comes from the same data trained for the public version, which could include GPL code or have other issues? I doubt any company would use this in their production code. Internal tools, maybe.

This version specifically removes snippets that appear in open source code.

So instead of Open Source license violations for which it'd theoretically be possible to provide information to comply with those licenses, it instead only violates proprietary software licenses for which you shouldn't be using the code at all?

Re: GitHub Copilot for Business is now available

#108

Post by thesuperbigfrog »

ndriscoll wrote: post #98
thesuperbigfrog wrote: post #76

Earlier quoted context omitted.

>> Nothing is forcing them to do that. If you use AGPLv3-licensed code in your codebase, you are agreeing to the terms of the license. Practically all corporate legal teams for companies that creates software will strictly prohibit the use of AGPLv3-licensed software, if not all GPL-based licenses.

Using AGPL code doesn't mean you agree to the terms. It means if you don't agree to and obey the terms, you don't have a license, which is copyright infringement.

>> if you don't agree to and obey the terms, you don't have a license, which is copyright infringement

So you either agree to the license terms or you are breaking the law.

If your company violates copyright law, it can be taken to court and sued for damages or forced compliance to the license terms:

https://www.mend.io/resources/blog/the-100-million-case-for-...

https://www.natlawreview.com/article/gpl-open-source-litigat...

https://wiki.fsfe.org/Migrated/GPL%20Enforcement%20Cases

Re: GitHub Copilot for Business is now available

#109

Post by JoshTriplett »

danuker wrote: post #104
JoshTriplett wrote: post #101

Earlier quoted context omitted.

That'd be a valid solution, if impractical. I doubt that people would be willing to copy hundreds of thousands of license notices into their project.

One perspective is that those authors actually contributed to the end result. But sure, disk size could be a problem.

> One perspective is that those authors actually contributed to the end result.

They absolutely did, yes. The approach you're suggesting would work from a legal perspective, but the size might pose practical problems.

Re: GitHub Copilot for Business is now available

#110

Post by hn_throwaway_99 »

ilc wrote: post #56
rectang wrote: post #19

Is Copilot HIPAA compliant? It sends data to the cloud, so if you paste PHI…

Source: Ex Hospital IT. I wouldn't risk it. It is too easy to write the wrong prompts and leak PHI. ChatGPT: "Write me a parser for this HL7 message..." Copilot: "Using this example message please write a parser for it..." Yeah... If it was compliant, people would write those in a heartbeat. Unless sold as HIPAA compliant, and the conditions of use for that compliance are known... don't trust it, for SAAS. This is st…

Realizing that many people still fundamentally misunderstand HIPAA and PHI:

1. First, you really only need to worry about the specifics of HIPAA if you are a "covered entity" under the law (primarily a hospital or other healthcare provider, or a health insurer), or if you have signed a BAA with another company (more on that below). There are all sorts of misunderstandings that you can't, for example, say something like "Jane couldn't make the meeting because she's out with the flu" at a company - that's not how it works. Unless you're a covered entity, you're under no obligation to keep PHI private under HIPAA.

2. If you do work at a HIPAA covered entity, it usually is made explicitly clear where patient data is or is not allowed. Even if GitHub Copilot were "HIPAA Compliant", unless they signed a HIPAA BAA (business associate agreement) with your company, it's still not OK to send them any PHI.

Point being, there are plenty of reasons to be worried about customer privacy and data security, but people like to bring up HIPAA rules in lots of situations where they simply don't apply.

Post reply on HN