GitHub Copilot and open source laundering(drewdevault.com)
drewdevault.com
GitHub Copilot and open source laundering
https://drewdevault.com/2022/06/23/Copilot-GPL-washing.html
28 comments
I think opting out would be quite hard. Due to the nature of copyleft your code can end up in a lot of random projects (which are actually complying with the license) and those projects might not opt out.
Drew, that is a great post.
I have two comments and a question.
First, my comment is that GitHub claims the right to use any public code on the Internet, not just GitHub. This means that they claim the right to mine code on Sourcehut, or in my case, on my personal Gitea instance. I'm not sure your suggestion 1 covers that. I think it should.
Second, users could fork code from Sourcehut onto GitHub, and then even if GitHub only uses code on GitHub, they could then use that code. This is, of course, a consequence of using DVCS's and can't be worked around. Your first suggestion should also address this, in my opinion, by allowing original authors to opt-out.
Third, my question: you've surely seen the licenses I have been developing against Copilot ([1]) since you've emailed me about them. Do you think the way I've approached the anti-Copilot clause is still free and open? For reference, this is the clause in all of my licenses:
> In this license, the phrase “this software” includes the source code licensed under this license. It also includes the output of any execution of any algorithm that uses all or part of this software as all or part of its input, but only if the output itself is software.
(The rest of the license then says it applies to "this software.")
[1]: https://yzena.com/licenses/
I have two comments and a question.
First, my comment is that GitHub claims the right to use any public code on the Internet, not just GitHub. This means that they claim the right to mine code on Sourcehut, or in my case, on my personal Gitea instance. I'm not sure your suggestion 1 covers that. I think it should.
Second, users could fork code from Sourcehut onto GitHub, and then even if GitHub only uses code on GitHub, they could then use that code. This is, of course, a consequence of using DVCS's and can't be worked around. Your first suggestion should also address this, in my opinion, by allowing original authors to opt-out.
Third, my question: you've surely seen the licenses I have been developing against Copilot ([1]) since you've emailed me about them. Do you think the way I've approached the anti-Copilot clause is still free and open? For reference, this is the clause in all of my licenses:
> In this license, the phrase “this software” includes the source code licensed under this license. It also includes the output of any execution of any algorithm that uses all or part of this software as all or part of its input, but only if the output itself is software.
(The rest of the license then says it applies to "this software.")
[1]: https://yzena.com/licenses/
I think that your clause is fine and does not cause these licenses to be non-free. But it is worded a little bit weirdly, by stating that the output of Copilot etc is literally "this software" rather than a "derivative work". I might suggest clarification on that part. Cheers!
That's a good suggestion. Unfortunately, "derivative work" is an established legal term, and was before the GPL, so I don't think I should use it. In fact, it should be part of my definition, now that I think about it.
However, if I can come up with some other term, then I'll definitely take your suggestion. I'll just define it to be "this software," any derivative work, or the application of an algorithm...and then make the license apply to that definition.
I hope that makes sense and is what you meant. If not, please let me know.
However, if I can come up with some other term, then I'll definitely take your suggestion. I'll just define it to be "this software," any derivative work, or the application of an algorithm...and then make the license apply to that definition.
I hope that makes sense and is what you meant. If not, please let me know.
> First, my comment is that GitHub claims the right to use any public code on the Internet, not just GitHub. This means that they claim the right to mine code on Sourcehut, or in my case, on my personal Gitea instance. I'm not sure your suggestion 1 covers that. I think it should.
People are allowed to read code on the internet and then write code themselves based on their experiences of the code that is publicly available. Why can't a software tool do the same? Everybody is being ridiculous about this.
People are allowed to read code on the internet and then write code themselves based on their experiences of the code that is publicly available. Why can't a software tool do the same? Everybody is being ridiculous about this.
No, people are not allowed to just read code on the Internet and then write code themselves. It depends on what the code is that they write and how similar it is to the code they read and how creative the original code is.
For example, I'm developing an algorithm to merge two binary files of the same type, a completely new algorithm. Say someone reads the code for that algorithm when I am done and implements the same thing using the same algorithm, but refuses to put the AGPL on it (because that will be the license). Are they infringing? Absolutely.
This has, in fact, happened with the Fast Inverse Square Root algorithm, whose code is under the GPL. Copilot reproduced it verbatim, including swearing comments. [1]
People are not being ridiculous about this because it has already happened!
EDIT: Fixed a small mistake.
[1]: https://twitter.com/mitsuhiko/status/1410886329924194309
For example, I'm developing an algorithm to merge two binary files of the same type, a completely new algorithm. Say someone reads the code for that algorithm when I am done and implements the same thing using the same algorithm, but refuses to put the AGPL on it (because that will be the license). Are they infringing? Absolutely.
This has, in fact, happened with the Fast Inverse Square Root algorithm, whose code is under the GPL. Copilot reproduced it verbatim, including swearing comments. [1]
People are not being ridiculous about this because it has already happened!
EDIT: Fixed a small mistake.
[1]: https://twitter.com/mitsuhiko/status/1410886329924194309
'Fast Inverse Square Root algorithm, which is under the GPL'
The algorithm isn't under GPL, the code is. John took the algorithm itself from code which was written earlier.
The algorithm isn't under GPL, the code is. John took the algorithm itself from code which was written earlier.
Even if I play your dumb games the tool just suggests code the user can then choose to infringe or not.
The user has no idea about the provenance of the code they receive, so they can't know it they are infringing or not. If that is the case, then suggesting that users should merely choose to not infringe is equivalent to suggesting that users should not use Copilot at all.
Another approach is to write a program, "bugify", that deliberately inserts bugs into software. Then, create many users and repositories. This would cause the dataset's value drop even lower than it currently is (the value is already low because bugs are everywhere and developers who use Copilot are even more careless than ones who type it all; it's basically a form of regurgitate-and-paste).
I wonder how many forks and github users you would habe to emulate to actually impress CoPilot and if they have a scoring system for the commited code.
I imagine that code in the nginx repository is much higher rated then my personal code that I have open sourced.
In psychology reliability and retest quality are important factors so I hope they are for something like this too.
I imagine that code in the nginx repository is much higher rated then my personal code that I have open sourced.
In psychology reliability and retest quality are important factors so I hope they are for something like this too.
Just recently I was trying to implement a feature using an extremely complicated and obscure API (some Chrome internal C++ stuff) and the only place I found a working example was inside a GitHub project which was GPL.
Obviously if I took the code and modified it to suit my purposes I would've run afoul of the GPL, but if Copilot suggests the same snippet to me it'd be fine. So there's obviously an issue here.
Obviously if I took the code and modified it to suit my purposes I would've run afoul of the GPL, but if Copilot suggests the same snippet to me it'd be fine. So there's obviously an issue here.
I think Copilot definitely is crossing some line that hasn't been defined yet, but your specific example has me thinking.
If I imagine some seasoned art expert standing next to me and giving me hints and ideas while I'm paining and he's using existing art as his examples, am I stealing the art? While Copilot recommends bits of code, it's not copying the entire project is it?
If I imagine some seasoned art expert standing next to me and giving me hints and ideas while I'm paining and he's using existing art as his examples, am I stealing the art? While Copilot recommends bits of code, it's not copying the entire project is it?
> Obviously if I took the code and modified it to suit my purposes I would've run afoul of the GPL
Do you honestly believe that? I refuse.
Do you honestly believe that? I refuse.
An interesting question would be over fair use. Generally, "transformative" works are covered under fair use. I can certainly see the argument that DL output is transformative in nature.
Not a lawyer take my comments with a grain of salt.
Not a lawyer take my comments with a grain of salt.
The US supreme court already believes it's dubious that an AI can create an original work: https://www.google.com/amp/s/www.natlawreview.com/article/pa...
Though has ruled that training AI on copyright materials is fine, as long as the defendants can claim it's a card catalog: https://towardsdatascience.com/the-most-important-supreme-co...
So it's going to be interesting to see how this is viewed by the supreme court when it gets there.
Though has ruled that training AI on copyright materials is fine, as long as the defendants can claim it's a card catalog: https://towardsdatascience.com/the-most-important-supreme-co...
So it's going to be interesting to see how this is viewed by the supreme court when it gets there.
> I can certainly see the argument that DL output is transformative in nature.
It's a thin line. Depending on how the model is trained and what size it is, it is not unreasonable to expect that it will have the ability to remember training data.
It's a thin line. Depending on how the model is trained and what size it is, it is not unreasonable to expect that it will have the ability to remember training data.
Many jurisdictions don't have a doctrine like fair use.
Is plagiarism legal if I change the variable names?
Just for clarity, note that plagiarism and copyright infringement are distinct.
If you rewrite someone’s paragraph with synonyms it’s still plagiarism but not copyright infringement especially if you don’t cite the work in question. Conversely, you could quote several paragraphs of someone else’s work in quotations with citation and it may be copyright infringement but not plagiarism.
Or at least that is how I understand it.
Or at least that is how I understand it.
Copilot can certainly produce an output which appears "transformative". It can also produce verbatim copies of licensed works. The output exists along a spectrum from probably transformative to clearly non-transformative, and it offers no tools for the user to establish the provenance of its output. Fair use is evaluated on a case-by-case basis, and this would require that each program produced by Copilot is examined to determine the depth of the transformation.
It lives by this vagueness and is abused as a tool for laundering the source code, to wash off the license terms for free software under a suitably complex and inscrutable system that establishing this provenance is not realistic, even if the output would fall on the "non-transformative" end of the scale.
I can kind of understand the argument that GitHub itself is, perhaps, not liable for this (setting aside the fact that they use Copilot in their own works, and GitHub's own software would have to be examined under this lens), but it is certainly irresponsible of them and disrespectful of the community that it owes its success to, and it seems to me that its users would definitely be at a higher legal risk.
It lives by this vagueness and is abused as a tool for laundering the source code, to wash off the license terms for free software under a suitably complex and inscrutable system that establishing this provenance is not realistic, even if the output would fall on the "non-transformative" end of the scale.
I can kind of understand the argument that GitHub itself is, perhaps, not liable for this (setting aside the fact that they use Copilot in their own works, and GitHub's own software would have to be examined under this lens), but it is certainly irresponsible of them and disrespectful of the community that it owes its success to, and it seems to me that its users would definitely be at a higher legal risk.
> I cannot speak for the rest of the community that have been hurt by this project, but for my part, I would be okay with not pursuing the answers to any of these questions with you in court if you agreed to resolve these problems now.
I mean... has anyone really been "hurt" by Copilot?
Copying from another thread... The concept of intellectual property exists to incentivize creating valuable art/literature/code. In theory at least, we agree to uphold IP laws because we recognize that more value gets created when they're a state enforced monopoly on the person who came up with that piece of art/literature/code.
But we also recognize that sometimes these laws go too far; eg that there are patent trolls and corporations fighting public domain and game publishers going after anyone who makes a let's-play of their video.
In those case, it's reasonable to think the world would be better off if we all shrugged and told the IP holders "too bad, someone else is going to create value off your work and you're not going to get a cent from it, we just think it's not worth building and maintaining a nightmare bureaucracy just so you can tax them".
And from that point of view... Copilot is fine? It's not like the people posting code on Github or StackOverflow were thinking "I'm only doing this because I know a future AI 10 years from now won't scrap the code I wrote to train a neural network to create a code completion engine". Yeah, yeah, this breaks the spirit of the GPL and Stallman's vision, etc, etc.
But... I mean, at some point, you got to stop debating semantics and wonder what we're coding for. What Microsoft has created is a tool that can collectively save developers billions of man-hours. It's a net good for humanity. As far as I'm concerned, the fact that this net good was developed is infinitely more important than the fact that Microsoft didn't pay royalties to a nebulous amount of developers who wouldn't have noticed anything if Microsoft hadn't developed Copilot.
tldr MIT license is great, piracy is great, fanfiction is great, screw the very concept of intellectual property.
I mean... has anyone really been "hurt" by Copilot?
Copying from another thread... The concept of intellectual property exists to incentivize creating valuable art/literature/code. In theory at least, we agree to uphold IP laws because we recognize that more value gets created when they're a state enforced monopoly on the person who came up with that piece of art/literature/code.
But we also recognize that sometimes these laws go too far; eg that there are patent trolls and corporations fighting public domain and game publishers going after anyone who makes a let's-play of their video.
In those case, it's reasonable to think the world would be better off if we all shrugged and told the IP holders "too bad, someone else is going to create value off your work and you're not going to get a cent from it, we just think it's not worth building and maintaining a nightmare bureaucracy just so you can tax them".
And from that point of view... Copilot is fine? It's not like the people posting code on Github or StackOverflow were thinking "I'm only doing this because I know a future AI 10 years from now won't scrap the code I wrote to train a neural network to create a code completion engine". Yeah, yeah, this breaks the spirit of the GPL and Stallman's vision, etc, etc.
But... I mean, at some point, you got to stop debating semantics and wonder what we're coding for. What Microsoft has created is a tool that can collectively save developers billions of man-hours. It's a net good for humanity. As far as I'm concerned, the fact that this net good was developed is infinitely more important than the fact that Microsoft didn't pay royalties to a nebulous amount of developers who wouldn't have noticed anything if Microsoft hadn't developed Copilot.
tldr MIT license is great, piracy is great, fanfiction is great, screw the very concept of intellectual property.
I actually agree, but this is a pretty deep philosophical issue that requires several more blog posts to fully unpack - blog posts I will write.
Essentially, I agree that the very idea of intellectual property is invalid, and my end-game would be to have it overturned entirely, copyright and patents alike banished from this earth. However, a practical view must acknowledge that we live in a world where IP is normalized in the view of the public and in the view of the law.
I would ordinarily "walk the walk" here and act as if the world operated according to my moral lens, i.e. not bugging people about compliance with software licenses. In this case, though, that would be counter-productive. The issue is that there is an asymmetry between the software producer and consumer. I believe that the user has a right to the source code for all software they use (praxis: reverse engineering is good even when it's illegal). However, under the current copyright regime, the producer can withhold their source code. If I publish open source software without concern for copyright (e.g. WTFPL), this allows commercial entities to take my code, but does not allow me to take theirs, so there is a power imbalance that works against my interests.
So, free software licenses are necessary and important. In an ideal world, without copyright, I would be totally fine with GitHub Copilot - because I would also have access to its source code, and the model, and would be able to modify, repurpose, or sell it myself. But we don't live in that world, unfortunately, which allows GitHub to exploit the power imbalance by ingesting free software into a commercial product that they have the sole right to monetize and dictate terms of use for. It's this exact imbalance that the GPL family of licenses were written to address, and it's a spit in their face to pretend that they don't apply, especially from an organization that damn well ought to know better.
Essentially, I agree that the very idea of intellectual property is invalid, and my end-game would be to have it overturned entirely, copyright and patents alike banished from this earth. However, a practical view must acknowledge that we live in a world where IP is normalized in the view of the public and in the view of the law.
I would ordinarily "walk the walk" here and act as if the world operated according to my moral lens, i.e. not bugging people about compliance with software licenses. In this case, though, that would be counter-productive. The issue is that there is an asymmetry between the software producer and consumer. I believe that the user has a right to the source code for all software they use (praxis: reverse engineering is good even when it's illegal). However, under the current copyright regime, the producer can withhold their source code. If I publish open source software without concern for copyright (e.g. WTFPL), this allows commercial entities to take my code, but does not allow me to take theirs, so there is a power imbalance that works against my interests.
So, free software licenses are necessary and important. In an ideal world, without copyright, I would be totally fine with GitHub Copilot - because I would also have access to its source code, and the model, and would be able to modify, repurpose, or sell it myself. But we don't live in that world, unfortunately, which allows GitHub to exploit the power imbalance by ingesting free software into a commercial product that they have the sole right to monetize and dictate terms of use for. It's this exact imbalance that the GPL family of licenses were written to address, and it's a spit in their face to pretend that they don't apply, especially from an organization that damn well ought to know better.
You're arguing for one-sided disarmament before the battle has been won. It may be true that there are other, better alternatives to copyright/IP. And open source licenses do amount to turning "strict IP" against itself, in a way. But they do so in a way that still follows the rules of copyright. Copilot is now trying to turn open source licensing against itself, without following those rules: to have its cake and eat it too.
> Allow GitHub users and repositories to opt-out of being incorporated into the model. Better, allow them to opt-in. Do not tie this flag into unrelated projects like Software Heritage and the Internet Archive.
> Track the software licenses which are incorporated into the model and inform users of their obligations with respect to those licenses.
> Remove copyleft code from the model entirely, unless you want to make the model and its support code free software as well.
About the last point: Many of the larger corporations avoid copyleft code entirely or only use it in ways that avoids the viral nature of them. So I have to assume that Copilot would also be avoided for the same reasons by the same corporations until they can opt out.
Free software is already being exploited and violated in various ways by various actors and Copilot seems to be a tool that makes this even easier. I think it will be interesting to see where this issue goes.