Copilot regurgitating Quake code, including sweary comments • Hacker News Board

Re: Copilot regurgitating Quake code, including sweary comments

#431

Post by __MatrixMan__ » Fri, Jul 02, 2021, 6:30 PM UTC

rgbrenner wrote: post #284

So this makes it official... this post[0] and the comments on the announcement[1] concerned about licensing issues were absolutely correct... and this product has the possibility of getting you sued if you use it. Unfortunately for GitHub, there's no turning back the clocks. Even if they fix this, everyone that uses it has been put on notice that it copies code verbatim and enables copyright infringement. Worse, ther…

Is it still a legal concern if I'm just coding because I want to solve a problem and I'm not trying to use it to do business?

Re: Copilot regurgitating Quake code, including sweary comments

#432

Post by ezfe » Fri, Jul 02, 2021, 6:30 PM UTC

JamesAdir wrote: post #367

jacurtis wrote: post #295

Earlier quoted context omitted.

> The ruby one isn't outright terrible, but shows a very Americanized way to do street addresses that would probably become a problem later. As someone who has been coding up address storage and validation for the past week in my current job, that one really made me laugh. Mostly because it tries to simplify all the stuff I have been analyzing and mulling over for a week into a single auto-complete. Spoiler: The Gith…

Isn't address storage and validation a solved problem? Why is it so complicated?

You are right that USPS maintains a database of canonical delivery points. However, it's inevitable this database might not be correct or up to date.

If you don't want to validate, then yes addresses are just a series of text fields. However, mapping them to that delivery point is where the problems arise.

Re: Copilot regurgitating Quake code, including sweary comments

#433

Post by armatav » Fri, Jul 02, 2021, 6:31 PM UTC

handrous wrote: post #344

lawl wrote: post #25

Earlier quoted context omitted.

Way better. It's susceptible to copyright trolling. Put up repos with snippets for things people might commonly write. Preferably use javascript so you can easily "prove" it. Write a crawler that crawls and parses JS files to search for matching stuff in the AST. Now go full patent troll, eh, i mean copyright troll.

1) Write a project heavily using Copilot (hell, automate it and write thousands of them, why not?) 2) AGPL all that code. 3) Search for large chunks of code very similar to yours, but written after yours, licensed more liberally than AGPL. Ideally in libraries used by major companies. 4) Point the offenders to your repos and offer a "convenient" paid dual-license to make the offenders' code legal for closed-source us…

6) Arms race with someone who trained an obfuscation version that goes through your AGPL code and tweaks it to not be in violation.

Re: Copilot regurgitating Quake code, including sweary comments

#434

Post by whimsicalism » Fri, Jul 02, 2021, 6:33 PM UTC

abeppu wrote: post #417

I may be over-reading, but I think this kind of example not only demonstrates the pragmatic legal issues, but also the fundamental weaknesses of a solely text-oriented approach to suggesting code. It doesn't really seem to have a representation of the problem being solved, or the relationship between things it generates and such a goal. This is not surprising in a tool which claims to work at least a little for almos…

> fundamental weaknesses of a solely text-oriented approach to suggesting code.

I don't think it is clear that such "fundamental weaknesses" exist. A text-based approach can get you incredibly far.

Re: Copilot regurgitating Quake code, including sweary comments

#435

Post by SahAssar » Fri, Jul 02, 2021, 6:33 PM UTC

pydry wrote: post #408

throwaway2037 wrote: post #387

Earlier quoted context omitted.

Quoted post unavailable.

Changing master to main was something Github did when they were taking heat for their contract with ICE. It was a nice bit of misdirection that cost them nothing, achieved nothing and garnered praise in some quarters. ICE, of course, runs an actual concentration camp which has a slightly more troublesome history than the word master. Language policing is to racism what recycling is to global warming - an attempt to s…

I get what you mean, but in a discussion about semantics it might be unhelpful to dilute the term "concentration camp", especially if prefixed with "actual" in italics. That is unless you actually mean that ICE camps serve the same purpose and are equivalent to nazi concentration camps.

Re: Copilot regurgitating Quake code, including sweary comments

#436

Post by NavinF » Fri, Jul 02, 2021, 6:33 PM UTC

Anon1096 wrote: post #49

klohto wrote: post #14

I’m really dumbfounded by the Copilot team decision to not exclude GPL licensed code. Why was this direction chosen? Is the inclusion of GPL really worth the risk and potential Google v. Oracle lawsuit? I’d like to know the reasoning.

Why would excluding GPL'd code be enough to not violate licenses? I don't understand why people think MIT or other licenses are free for alls to take code as they wish. The MIT license includes an attribution clause. And, as the linked video shows, Copilot is more than happy to take its code and put your pet license and copyright notice on instead. Isn't that equally as infringing as stealing GPL code? The idea of mi…

Has anyone ever been sued IRL for using MIT/Apache/... code? Or are we stuck in imaginary land where this is something to be worried about?

Btw the GPLv2 death penalty is rather unique and I don't think anyone will deny that including GPL code in proprietary code is a hell of a lot worse in every way (liability, ethically, etc) than including permissively licenced code and forgetting to attribute it

Re: Copilot regurgitating Quake code, including sweary comments

#437

Post by samtheprogram » Fri, Jul 02, 2021, 6:35 PM UTC

fragmede wrote: post #420

eganist wrote: post #384

Earlier quoted context omitted.

Adding to this: I run product security for a large enterprise, and I've already gotten the ball rolling on prohibiting copilot for all the reasons above. It's too big a risk. I'd be shocked if GitHub could remedy the negative impressions minted in the last day or so. Even with other compensating controls around open source management, this flies right under the radar with a c130's worth of adverse consequences.

Do you also block stack overflow and give guidance to never copy code from that website or elsewhere on the Internet? I'm legitimately curious - my org internally officially denounces the copying of stack overflow snippets. Thankfully for my role it's moot as I mostly work with an internal non-public language, for better or worse, and I have no idea how well that's followed elsewhere in the wider company.

Anything posted to Stack Overflow has a specific (Creative Commons IIRC) license associated with it. The same is not true of GitHub Copilot, and in fact their FAQ doesn’t specify a license at all, probably because they are technically unable to since it is trained on a wide variety of code from differing licenses (and code not written by a human is currently a grey area for copyright). The FAQ simply says to use it at your own risk.

Re: Copilot regurgitating Quake code, including sweary comments

#438

Post by sktrdie » Fri, Jul 02, 2021, 6:37 PM UTC

I'm going to go against the flow here and say that worrying about this is similar to worrying about the license we give to snippets of code we copy-paste from other licensed code.

The reality is that we never attribute the original source because we copy-paste it, change it up a bit, and make it our own. Literally everybody does this.

I still care about licensing and proper attribution but the reality is that a snippet of code is not something so easy to attribute. Should we attribute all kinds of ideas, even the very small ones? How quickly is an idea copied, altered & reused? Can we attributes all the thoughts humans have?

Re: Copilot regurgitating Quake code, including sweary comments

#439

Post by bestcoder69 » Fri, Jul 02, 2021, 6:38 PM UTC

username90 wrote: post #406

throwaway2037 wrote: post #387

Earlier quoted context omitted.

Quoted post unavailable.

> For co-workers not familiar with the history of slavery in the United States, there is always a pause, and then some confusion about the changes. After explaining the historical context, 99% of people reply: "Oh, I understand. Thank you to explain." Most people answer like this when they realize you are an unreasonable person who refuse to listen. Happens all the time, like "Oh, I understand (you are one of those).…

By rolling your eyes you accept my terms and conditions.

Re: Copilot regurgitating Quake code, including sweary comments

#440

Post by pydry » Fri, Jul 02, 2021, 6:38 PM UTC

SahAssar wrote: post #435

pydry wrote: post #408

Earlier quoted context omitted.

Changing master to main was something Github did when they were taking heat for their contract with ICE. It was a nice bit of misdirection that cost them nothing, achieved nothing and garnered praise in some quarters. ICE, of course, runs an actual concentration camp which has a slightly more troublesome history than the word master. Language policing is to racism what recycling is to global warming - an attempt to s…

I get what you mean, but in a discussion about semantics it might be unhelpful to dilute the term "concentration camp", especially if prefixed with "actual" in italics. That is unless you actually mean that ICE camps serve the same purpose and are equivalent to nazi concentration camps.

The Nazis ran what would more accurately be termed extermination camps.

Though what they did certainly bore a strong resemblance to the Boer war concentration camps/manzanar,etc. whose purpose was to "concentrate" people into one place rather than industrially slaughter them.