Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub scraped your code. And they plan to charge you

twitter.com

Post reply on HN
Print view View original

181–190 of 212 posts

Re: GitHub scraped your code. And they plan to charge you

#181

Post by anothernewdude »

randallsquared wrote: post #137
kuschku wrote: post #114

Earlier quoted context omitted.

> you grant each User of GitHub a nonexclusive, worldwide license to […] reproduce Your Content […] as permitted through GitHub' functionality If you upload code to GitHub, you grant them (and every GitHub user) a license to do exactly what Copilot does. This ToS change happened 2017, and I actually had to get approval from all contributors of my projects to accept to the changed ToS: https://github.com/justjanne/Qua…

Yeah, and https://docs.github.com/en/github/site-policy/github-terms-o... has this language: This license includes the right to do things like copy it to our database and make backups; show it to you and other users; parse it into a search index or otherwise analyze it on our servers; share it with other users; and perform it, in case Your Content is something like music or video. This license does not grant GitHub t…

It's irrelevant. There is no guarantee that the people uploading code even have the ability to grant github such a licence if they aren't the copyright holders.

Re: GitHub scraped your code. And they plan to charge you

#182

Post by hvis »

randallsquared wrote: post #177
hvis wrote: post #158

Earlier quoted context omitted.

Reproducing copylefted code is neither indexing nor analysis. To be clear, a piece of code that creates a copy of some GPL code is not a problem by itself. However, it's misrepresented as something the tool "generated" rather than code belonging to an existing human actor, without appropriate attribution and licensing info.

I think we're assuming that they used GPT3 (or whatever) on code that was stored on github.com in accordance with their TOS, which means (if I understand correctly as a non-lawyer) that they didn't share it under the terms of the GPL, since they can't, but if whatever licenses the code already had attached were not sufficient, that code was also licensed to github for the purposes of indexing, analysis, and sharing w…

> that code was also licensed to github for the purposes of indexing, analysis, and sharing with other github service users

Even if said code was licensed to Github for sharing with other users (e.g. displaying it when another user browses the page), that doesn't mean that the same permission is given to all other users under the same conditions. Or allows them extra liberties, like using said code for purposes other than "sharing with other github service users".

Re: GitHub scraped your code. And they plan to charge you

#183

Post by ineedasername »

TeMPOraL wrote: post #160
ineedasername wrote: post #129

Earlier quoted context omitted.

Are they actually using the source to make a derivative/fork though? If reusing the code in another codebase then definitely attribution would be required. But using it as a dataset seems a bit different-- a grey area. Though I would still agree that the right thing to do would be to have an attribution area, even if it was thousands of entries long. Whether technically required by the license or not, the spirit of t…

> If reusing the code in another codebase then definitely attribution would be required. But using it as a dataset seems a bit different-- a grey area. It's already been demonstrated that Copilot - like all tools in the GPT family - frequently output large chunks of their training dataset verbatim. It's not hard to trigger this behavior, even unintentionally. To me, this is much closer to "reusing". But I'm not a law…

frequently output large chunks of their training dataset verbatim

Ah, that then is extremely problematic.

I really like the idea of Copilot to speed development-- basically code completion taken to an extreme-- but this seems like a very bad way to go about it.

Re: GitHub scraped your code. And they plan to charge you

#184

Post by ineedasername »

jraph wrote: post #169
ineedasername wrote: post #140

Earlier quoted context omitted.

My non-expert reading of the AGPL seems to indicate that using AGPL code in a commercial project is find as long as you don't change it . GitHub wouldn't necessarily have needed to change it to include it in a data set, so I'm not sure there's a license violation. However the gray area is that the massive data set of which it is a part will spit out new code that has, in some way big or small, been influence by the A…

> My non-expert reading of the AGPL seems to indicate that using AGPL code in a commercial project is find as long as you don't change it Any restriction imposed by the GPL is also true for the AGPL. In particular, if you reuse some code from a (A)GPL project, even if you don't change the code, you must release your whole project under this license too, and give attribution to the author. For the LGPL, the same thing…

But AGPL & LGPL still don't prohibit commercial use do they? They impose obligations on those using the code to--potentially-- release their own code, but commercial use in & of itself isn't prohbited.

Again, I think GitHub is going against the spirit of these licenses and should behave differently. What I'm trying to do in this discussion is simply explore the limitations within the letter of the license.

Basically the boundary between being legal, and being legal but still wrong in some other sense. Consider it my exploration of the ethical constraints vs. legal constraints.

Re: GitHub scraped your code. And they plan to charge you

#185

Post by randallsquared »

hvis wrote: post #182
randallsquared wrote: post #177

Earlier quoted context omitted.

I think we're assuming that they used GPT3 (or whatever) on code that was stored on github.com in accordance with their TOS, which means (if I understand correctly as a non-lawyer) that they didn't share it under the terms of the GPL, since they can't, but if whatever licenses the code already had attached were not sufficient, that code was also licensed to github for the purposes of indexing, analysis, and sharing w…

> that code was also licensed to github for the purposes of indexing, analysis, and sharing with other github service users Even if said code was licensed to Github for sharing with other users (e.g. displaying it when another user browses the page), that doesn't mean that the same permission is given to all other users under the same conditions. Or allows them extra liberties, like using said code for purposes other…

No argument, there! I'm pretty concerned about the consequences of using Copilot, legally. It all seems to turn on whether a judge or judges believe that a long sequence can be produced by "learning" rather than "copying". ¯\_(ツ)_/¯

Re: GitHub scraped your code. And they plan to charge you

#186

Post by joe_the_user »

yangff wrote: post #130

So.. I can see that this ML model is generating some code exactly same as the original dataset, which definiately a problem. A defect model, sure. Beside that, I cannot understand why the overall idea, using open-source project to train a ML model that generates code would ever be a problem. We human beings are learning as the model, we read others code, books, articles, design patterns... and it becomes part of us.…

Beside that, I cannot understand why the overall idea, using open-source project to train a ML model that generates code would ever be a problem. We human beings are learning as the model, we read others code, books, articles, design patterns... and it becomes part of us.

It's an interesting question.

1) When a human being reads code or a CS text book, we think of them extracting general principles from the code and so not having to repeat that particular code again. In contrast, what GPT-3 and Copilot seem to do is just extract sequences of little snippets, something that apparently requires them to regurgitate the text they've been trained on. That seem rather permanently dependent on the training corpus.

2) Human beings have a natural urge, a natural ethos, to help people learn. It's understandable. The thing is, when suddenly you're not talking people but machines, the reason for this urge easily vanish. Even if github was extracting knowledge from the code, I wouldn't have a reason to help them do so since that knowledge would be their entirely private property. They expect to charge people whatever they judge the going rate would be - why should anyone be helping them without similar compensation? That this is being done by "OpenAI", a company which went from open-nonprofit to closed-for-profit in a matter of few years, should accent this point. We're nowhere near a system that could digest all the knowledge of humankind. But if we got there, one might argue the result should belong to humankind rather than to one genius entrepreneur. And having the result belong one genius entrepreneur has some clear downsides.

Re: GitHub scraped your code. And they plan to charge you

#187

Post by IAmLiterallyAB »

krapp wrote: post #179
thinkingemote wrote: post #174

Earlier quoted context omitted.

And once again RMS was proven right.

How would the GPL have prevented this, exactly? More explicitly, how would a license that gives everyone the right to copy, modify and redistribute source code for any purpose without compensation or attribution have prevented Github from building a tool that copies, modifies and redistributes source code without compensation or attribution?

Because if you use GPL code, you must release your use/changes under the GPL. That's why the GPL is often called infectious. If copilot spits out GPL code verbatim, the user of the code must respect the license.

Re: GitHub scraped your code. And they plan to charge you

#188

Post by [deleted] »

dathinab wrote: post #147
yangff wrote: post #130

So.. I can see that this ML model is generating some code exactly same as the original dataset, which definiately a problem. A defect model, sure. Beside that, I cannot understand why the overall idea, using open-source project to train a ML model that generates code would ever be a problem. We human beings are learning as the model, we read others code, books, articles, design patterns... and it becomes part of us.…

> A defect model, sure More like a defect approach, behavior like that is well known(1) to be basically guaranteed to happen with GPT-3 and similar approaches. (1): By people involved in the respective science categories (Representation Learning/Deep Learning, NLP, etc.).

[deleted]

Re: GitHub scraped your code. And they plan to charge you

#189

Post by coliveira »

Newsflash: all open source means that you're already doing free work for the largest corporations in the world! It seems like developers, as a group, decided that it would be better to spend their nights writing free code for FAANG, so they would be able to keep their day jobs. Bezos and friends thank you all. #genius

Re: GitHub scraped your code. And they plan to charge you

#190

Post by dogma1138 »

blibble wrote: post #173
dogma1138 wrote: post #51

Earlier quoted context omitted.

Snyk did the same with Snyk code to build their “ML driven SAST” offering. Pretty much anyone can scrape GitHub and train their model. What exactly is the legal implications of this has yet to be tested. Pretty much every model is susceptible to some sort of model inversion or set inclusion attack. By their own admissions Co-Pilot sometimes outputs PII that part of the code and code snippets verbatim, even if it’s ra…

if I feed the entirety of github (sans licenses) into a java HashMap and provided an interface to query that I very much doubt that its output would qualify as "fair use" why is it different if a slightly more complicated data structure is used?

I’m not saying it is, the courts should really decide on what exactly counts as fair use in this case.

All I’m saying that you don’t need to be a huge corporation to do it, and that others are doing similar things as well.

I passed on Snyk code due to similar concerns especially since they pull out examples from FOSS projects directly and even had a “fix me” option where they push pull requests into your repo with fixes.

On ML in general the current policy I’m working on for my org is that we do not use any pre-trained models trained on public data and pushed the legal team to actually start figuring out how we should deal with these issues properly in the future.

ML currently is a Wild West it’s too new to have been tested and defended in court regardless of how to chips would or should fall.

As far as your specific example it would really depend on what data is actually preserved.

Since they do parrot whole code snippets comments and all it seems that they don’t have a generalized model at least for every problem.

However it’s also my personal legal opinion (ANAL) that if you can prove that the model holds nothing but a generalized solution for a given problem the code it outputs isn’t a derivative work anymore than a the code of a person learning from copyleft code.

However then there is the whole issue of “allowed use” none of the existing licenses specify if the code can be used to train a model, this also means that we probably need to update all existing licenses to include a clause that explicitly states the limitations for this use case.

For code under existing licenses the fair use needs a proper judgement.

My gut feeling would be that it would count as fair use just as using code in a course or a book would be. GitHub definitely needs to make a page with attributions tho for that to happen and make sure their model doesn’t output anything but a generalized solution.

Post reply on HN