LWN: Comments on "GitHub is my copilot"

GitHub is my copilot

nim-nim — Tue, 03 Aug 2021 09:34:09 +0000

> For end users there are arguably more annoying and immediate aspects of proprietary software, which don't depend on copyright law: Binary-only distribution, closed protocols, device lock ("tivoization"), etc.

All those depend on copyright law one way or another, without copyright anyone could remove the anti-features and share the result.

However, Android and the rise of cloud services showed that openness is not sufficient in itself. Unless you make sharing of changes mandatory a sufficiently rich actor can take over any mature open source codebase, by adding just enough closed changes other variants become uncompelling to work on.

Mandatory opening and sharing of changes is the only thing that enables Joe Nobody to work on a shared codebase at the same level as big corporations.

Corporate devs are not smarter or more motivated, corporations can just afford to out-spend individuals long enough for them to give up (in other economic domains that is called dumping).

GitHub is my copilot

mrugiero — Fri, 30 Jul 2021 01:24:41 +0000

The paranoia is about that code being used in unintended way, i.e. proprietary code when you wanted it to remain free, which is why you would use the GPL. Not all libre code is liberal code.

NOTE I do not agree with the paranoia in terms of being copyright infringements, but thinking about it does make sense because of that.

GitHub is my copilot

mrugiero — Fri, 30 Jul 2021 01:19:03 +0000

You can go a lot further back even, Doom had a similar story, besides the fact much later the engine became open source. Final Doom is made up of mods id commercialized, if memory serves.

Derived works

mrugiero — Fri, 30 Jul 2021 01:09:23 +0000

And that's why libraries tend to use LGPL, because you don't need to read the code to be using it, and nobody will use it in a non-GPL project if they can't be sure it won't count as derivative.

GitHub is my copilot

mrugiero — Fri, 30 Jul 2021 01:04:02 +0000

Wait, you guys have documentation?

GitHub is my copilot

mrugiero — Thu, 29 Jul 2021 19:23:22 +0000

Wouldn't NDAs only enter the scene when, you know, the actors signed one? Does MSFT sign NDAs with people using their services?
I may not have the right, as an employee, to disclose a given fact about the company, but unless my employer made GH sign one I believe only copyright counts. I, the employer, either authorized that disclosure to GH or an employee is getting sued.

GitHub is my copilot

mrugiero — Thu, 29 Jul 2021 19:18:30 +0000

Nobody argues that's what they intend to do, but that it's a consequence of what they did. Two very different statements that happen to share the same output.

GitHub is my copilot

pabs — Tue, 27 Jul 2021 01:41:13 +0000

I definitely don't have computing resources required for that, nor the economic resources required to acquire them.

GitHub is my copilot

geert — Mon, 26 Jul 2021 15:16:49 +0000

"The license of this proposed code is incompatible with the license of the existing code on lines 25-37 and 1547-1803. Please make a choice:
[A] Drop proposed code.
[B] Drop existing code."

GitHub is my copilot

immibis — Mon, 26 Jul 2021 13:33:35 +0000

That's not how ML works.

GitHub is my copilot

immibis — Mon, 26 Jul 2021 13:23:50 +0000

What if you had the model they trained? I don't know about Copilot, but I believe the largest GPT-3 model is in the 250GB-1TB range (depending on what level of precision they used). Sure, you'd have a hard time fitting it in RAM, but it's not *impossible* to run yourself.

GitHub is my copilot

taterbase — Mon, 26 Jul 2021 06:41:54 +0000

I can't help but think of Kurt Vonnegut's luddite novel Player Piano. In the first chapter the main character reminisces about a machine operator named Rudy. He's the best machinist in the plant and the two managers hook him up to a machine that records his movements. Once recorded, Rudy and the rest of the machinists are replaced by machines that essentially repeat this action; over and over again. Optimization is made easy by adding more horsepower they're able to make production faster... but the machine is only able to replicate what it knows, never improvising. Rudy is proud of his contribution but ultimately relegated to an unfulfilling life where he's no longer needed. He along with the rest of the engineers in the town.

GitHub is my copilot

pjones — Fri, 23 Jul 2021 15:27:17 +0000

What they need to do is keep the training data, and make it automatically trace the data path that code took through the model, so when it adds some code in the middle of your program, it silently also adds the copyright and license terms for the code it's regurgitating at the top of the file.

This will definitely go well.

It's not just the GPL or protective licenses

david.a.wheeler — Thu, 22 Jul 2021 20:04:59 +0000

There seems to be a lot of discussion about this being applied to software released under the GPL, and sometimes the LGPL or protective licenses.

I think that's misguided. Practically *ALL* open source software licenses have attribution requirements, and other requirements, that are *also* not being met by what's being done by this service.

Is it legal? I have no idea. I think this is really untested ground. There are several ways to look at this:

* Maybe this is "de minimus" use or otherwise fair use, in which case it's fine.

* Maybe this is more like a human learning from existing code; humans can write code after reading code (indeed, how else could humans learn?).

* Maybe this is more like creating a derivative work, in which case this is dubious from a copyright perspective.

I'm not a lawyer. I predict that if this starts becoming useful, a lot of lawyers *will* look at this :-).

I have removed all my GitHub repos

kpfleming — Thu, 22 Jul 2021 11:29:14 +0000

How could controlling access to a server that you run be 'illegal'? There is no legal requirement to offer services to any specific person or entity from a server that you run.

GitHub is my copilot

rgmoore — Thu, 22 Jul 2021 04:42:11 +0000

It's not obvious that paying off patent trolls is the right business move for a big company like Microsoft. It would probably be the right move if there were only one patent troll out there, but if there are a lot of them- and there are- they'll wind up paying again and again. It might be cheaper in the long run to spend the money on lawyers and make an example of the first few who try it. Sending the message that suing your company will just result in massive legal bills and an invalidated patent should discourage other trolls who are thinking about suing you, resulting in less spending overall.

GitHub is my copilot

dskoll — Wed, 21 Jul 2021 14:15:33 +0000

Suing TinyStartup is hard work for pretty much no return. Suing Microsoft is like buying a lottery ticket. You're very, very likely to lose, but if you win, it'll be fantastic. Also, most patent infringement defendants end up settling, and MSFT's threshold for settling is higher than a smaller company's would be. Unless MSFT sees the patent or the troll as an existential threat, it'll probably make the correct business decision and just pay to make the problem go away.

I have removed all my GitHub repos

jbicha — Mon, 19 Jul 2021 21:53:34 +0000

They probably already fed all your repos into copilot before you removed them.

GitHub is my copilot

NYKevin — Mon, 19 Jul 2021 20:48:02 +0000

Well, it depends on how you look at copyright.

As it is described in the US Constitution, for example, copyright is a subsidy ("to promote the progress of science and the useful arts"). It has nothing to do with morality and is purely an economic scheme to incentivize people to create more stuff. This is why copyright originally had a relatively short term of 14 years with an optional 14 year extension. This is also why copyright explicitly does not protect ideas, concepts, etc. Countries other than the US have a separate scheme of "moral rights" which vest permanently in the author, cannot be sold, transferred, or renounced, and are more limited in scope than standard copyright (generally having to do with attribution, mutilation of the work, etc.). Perhaps the US should borrow this idea.

Corporate interests have, in recent years, found it more useful to characterize copyright as a form of property, giving us laws like the Copyright Term Extension Act of 1998. Perhaps you agree with that characterization, but it is instructive to look at the consequences which it has wrought before you assume that your characterization is the only correct one.

GitHub is my copilot

rgmoore — Mon, 19 Jul 2021 16:50:10 +0000

If you suffer no economic harm from someone's "infringement," then you should not have a claim against them, plain and simple.

I strongly disagree. There should be a moral presumption against people taking others work, even if they aren't trying to exploit it commercially. As an example, I am an amateur photographer. I like to share my photographs with friends and family and sometimes the whole world, but I have never tried to sell my photos. That shouldn't mean that anyone who sees them should be able to use them however they like without asking my permission. If copyright law is limited to economic losses, it means amateurs like me have no right to prevent others from using our work in ways we don't approve of.

GitHub is my copilot

dskoll — Mon, 19 Jul 2021 16:24:29 +0000

I did read the patent. But again, even garbage patents can be expensive to fight and invalidate. I doubt Microsoft has the appetite for taking on that potential liability by offering indemnification against patent infringement for Copilot output.

GitHub is my copilot

dskoll — Mon, 19 Jul 2021 16:23:01 +0000

Again, you are missing the point. Whether or not a patent will stand, there is no way Microsoft would even entertain the potential liability of offering indemnification against patent infringement for Copilot output.

Whether or not a patent is garbage is not relevant in Microsoft's calculation. The only relevant number is the potential financial harm Microsoft could suffer by offering indemnity.

GitHub is my copilot

NYKevin — Mon, 19 Jul 2021 14:55:16 +0000

The thing you have to bear in mind is that courts tend to focus on money damages as the default means of making someone whole. Injunctions are dispreferred unless they are the only way to protect the plaintiff from some "irreparable harm." So under the current system, it's easy to sue for statutory damages, but hard to sue for GPL compliance. The most straightforward way to force GPL compliance is to essentially threaten the defendant with money damages and demand that they comply in a settlement agreement. But plenty of defendants will just blow you off and assume that you won't actually litigate.

OTOH, money damages are perfect for the proprietary software crowd because they become the profit that the company was trying to make in the first place.

Side note:

> WikiPedia

They stopped using CamelCase links in 2002. Why do people still write their name like this?

How would this work for books?

khim — Mon, 19 Jul 2021 09:37:20 +0000

It returned the crown in 18th season and got neural networks in 19th.

I think “neural network revolution” is similar to “demise of assembler” in the end of last century.

Hand-written assembler was still worse then what high-level languages produced, but development time was so drastically different that it was impossible for assembler developers to deliver anything fast enough for it to be competitive.

Stockfish uses ƎUИИ to deal with some fringe cases where they just don't have time to fine-tune the algorithm.

The fate of the computer chess (and the world, arguably) depends on whether chip developers would be able to develop massive 3D chips (with thousands and later, maybe even millions, of layers… Moore's law turned 90 degrees, in a sense). For now this is only used for flash (but memories always used new technologies first because they need a lot of transistors but have very simple structure), but if active components will follow then it would be demise of modern computing parading and rise of neural networks.

This is because of power consumption: you couldn't put mullion cores into one chip while keeping them at gigahertz range, the whole thing would consume so much power it would be impossible to cool it (even if you find a way to supply all that power). Modern programming techniques couldn't work in trillions of 1MHz cores — but neural networks can.

Whether this would be enough to create strong AI or not… nobody knows.

GitHub is my copilot

anselm — Mon, 19 Jul 2021 09:22:48 +0000

So one free advice for patent trolls: don't send your "kind" snail mail letters to huge American companies before tiny Norwegian startups. You might get crushed before the letter reaches Norway.

The usual strategy if you're a patent troll is to go after some small companies first, because they can't afford a protracted legal battle and are likely to cave or settle quickly. You won't get a lot of money out of them but these wins give you street cred to go after the bigger fish later.

Perhaps in your case the patent troll didn't realise that snail mail from the US (I presume) to Norway takes a while to arrive, and assumed the business with you would be done and dusted before they'd call out Amazon? Just a thought.

How would this work for books?

sandsmark — Mon, 19 Jul 2021 09:00:56 +0000

> Actually Stockfish only lost to Leela Chess Zero once. Otherwise it keeps rank #1 pretty robustly.

Hasn't Stockfish merged a neural net evaluator? Or was that after the tournament?

GitHub is my copilot

sandsmark — Mon, 19 Jul 2021 08:55:52 +0000

> And actually, claiming patent damages against Tiny Startup is basically bad business. You'll get some loose change.
> And claiming patent damages against Microsoft is inviting the butcher to kill the goose that lays the golden eggs.

Our tiny startup received a patent troll mail a couple of years ago, which felt kind of validating for me at least. :-)

Unfortunately for them they sent apparently letters to Amazon as well (some overlap with Amazon's hardware stuff and ours), who swiftly crushed them in court and got the relevant patents invalidated.

So one free advice for patent trolls: don't send your "kind" snail mail letters to huge American companies before tiny Norwegian startups. You might get crushed before the letter reaches Norway.

GitHub is my copilot

sandsmark — Mon, 19 Jul 2021 08:47:35 +0000

> You mean like this patent?

I'm hungover and not in the mood to read patents, but something that most people seem to miss (and is fairly important with patents) is that the abstract is completely irrelevant.

What matters are the claims, and most importantly the independent claims (those that don't reference other claims). If you don't infringe on any part of an independent claim it does not apply, and it also invalidates all the dependent claims.

So while I haven't read that patent, usually when people point to what looks like absurd patents they tend to be useless (except for generating media hype and stock price for whomever got it).

How would this work for books?

gfernandes — Mon, 19 Jul 2021 06:14:48 +0000

You simply unpacked the nutshell.

GitHub is my copilot

gfernandes — Mon, 19 Jul 2021 06:11:17 +0000

And actually, claiming patent damages against Tiny Startup is basically bad business. You'll get some loose change.

And claiming patent damages against Microsoft is inviting the butcher to kill the goose that lays the golden eggs.

Take your pick.

GitHub is my copilot

gfernandes — Mon, 19 Jul 2021 06:09:05 +0000

That fact that a patent is awarded is in no way an indication that it will stand. This has been proven many times before.

GitHub is my copilot

pabs — Mon, 19 Jul 2021 02:08:56 +0000

> If you suffer no economic harm from someone's "infringement," then you should not have a claim against them, plain and simple.

There is usually zero economic harm from GPL violations (at least easily demonstrable to the copyright holder), so I think I'm going to have to disagree with you here.

> Or at most, you should have a claim to nominal damages and equitable enforcement of the license (i.e. an injunction), not statutory damages of hundreds of thousands of dollars.

An injunction against GPL violations seems good but I don't think nominal damages are appropriate based on what I read on WikiPedia, instead it should be restitutionary/disgorgement damages (where they pay back their ill-gotten gains), or possibly punitive damages or both, or something like paying for consultancy to help them come back into GPL compliance, or paying legal costs for bringing a suit against whoever they received the violating software from.

https://en.wikipedia.org/wiki/Damages#Nominal_damages

How would this work for books?

Cyberax — Mon, 19 Jul 2021 01:31:32 +0000

I was thinking about https://en.wikipedia.org/wiki/AlphaZero at least during its unveiling.

Though to be fair it didn't participate in regular computer chess tournaments and Stockfish got better.

How would this work for books?

NYKevin — Mon, 19 Jul 2021 00:18:38 +0000

> OK, a bit off topic now, but I'm sure you'd agree that there is a difference between human _intelligence_, and a glorified and somewhat biased search algorithm backed by a humongous database of alternatives to choose from, given a few characteristics to influence that choice.

I am not sure I agree with that.

A classical chess engine is essentially made up of three parts:

1. An opening book that describes standard lines in opening theory.
2. A tree search (minimax) algorithm for the midgame. This also requires the use of a heuristic evaluation function to cut off searching before it gets too deep. In modern engines, this evaluation function is "smart" and considers the relative positions of the pieces and pawns as well as their material values.
3. An endgame tablebase that gives you the exact lines to play in any position where N or fewer pieces are on the board. For modern engines, N=7 is generally the limit (at least for publicly-available datasets, anyway), but in Kasparov's day, N would have been much smaller.

High-level chess players will absolutely memorize the same information as is present in an opening book, although perhaps not to the same depth as the engine does. Similarly, human players do imagine future lines and evaluate their endpoints based on heuristics, using a process that is conceptually similar to minimax with aggressive pruning. Finally, the best human players spend a lot of time learning their endgames. They don't memorize an entire tablebase, of course, but they learn the patterns, and so this can be characterized as a particularly smart compression algorithm (i.e. I don't need to memorize hundreds of minor translations or rotations of the same basic mating pattern).

GitHub is my copilot

NYKevin — Mon, 19 Jul 2021 00:03:15 +0000

> In my experience, game modders usually rely on exemptions that don't actually exist either in law or in the game's EULA (for example "it's non-commercial, so it's fine"), and the game's copyright holder turns a blind eye to it because they recognise the value of mods in popularizing their games.

This greatly depends on the game. Skyrim, for example, is explicitly designed to encourage modding, with an EULA that specifically permits it. In recent years, Bethesda has even been selling mods for real money (with the modder taking a cut).

> Perhaps copyright law should behave more like game modders think it does, and less like the overreaching reality, but that seems unlikely to happen while changes to it are primarily driven by the same few entertainment cartels.

And... that's where the analogy falls apart. In my experience, Skyrim modders are some of the most unreasonable people on the internet. Behaviors I have seen:

* Uploading a mod, free for anyone to download, and then characterizing mirrors of that mod as "piracy."
* Characterizing attempts to fix or improve another mod as "piracy," even when the original mod is obviously broken. In one case, I believe a user threatened to contact law enforcement over this sort of thing.
* Requiring logins to download an otherwise free mod. Using this to try and prevent specific individuals from downloading specific mods (which are otherwise free for everyone).
* A modding tool that checks to see if you have installed certain applications which the author disapproves of. This check is not disclosed anywhere in the documentation, and the software refuses to run with a mysterious error message if it finds those applications.
* Characterizing direct downloads (where you don't look at their fancy web page first) as "piracy" or otherwise problematic.
* Removing mods for petty or ridiculous reasons.
* Insisting that people who are good at modding are always right, and anyone who disagrees with them, about anything, must be wrong.
* Miscellaneous internet toxicity.

Technically, most of these things are (to some extent) supported by existing copyright law. But IMHO that's because copyright law is ridiculous, not because the modders are right. If you suffer no economic harm from someone's "infringement," then you should not have a claim against them, plain and simple. Or at most, you should have a claim to nominal damages and equitable enforcement of the license (i.e. an injunction), not statutory damages of hundreds of thousands of dollars.

How would this work for books?

khim — Sun, 18 Jul 2021 23:50:58 +0000

> Modern neural-net chess programs beat classic algorithms. And it's not even close.

Actually Stockfish only lost to Leela Chess Zero once. Otherwise it keeps rank #1 pretty robustly.

Of course the fact that relatively-simple (and resource hungry since modern CPU is not well-designed to support neural networks) pattern-recognizing program beats literally everything else and only the top engine based literally on everything humanity discovered about chess in hundreds of years can hold it's own is still amazing.

GitHub is my copilot

khim — Sun, 18 Jul 2021 23:38:16 +0000

It's funny how everyone immediately started talking about copyrights and patents while forgetting the elephant in the room: NDAs.

One may argue if 3 lines of code copied verbatim constitute a copyright violation or not and whether 10 lines of code may be complicated enough to be a patent violation.

But even a single line of code accidentally copied from input to output can reveal something which Microsoft (or any other company) considers a secret.

Public repositories (on GitHub or elsewhere) don't have that problem because they are, you know, public.

If something is already on GitHub (and stored in The Arctic Code Vault in the hope that it would be discoverable there 500 years from now) then it's, generally, assumed that cat is out of the bag and even if some NDA was actually violated it's too late to demand that secret should stay secret.

GitHub is my copilot

gerdesj — Sun, 18 Jul 2021 22:19:43 +0000

I've thought quite long and hard about this. To spare everyone my deliberations, I tend my conclusion:

Copilot should not be a chargeable service as-is. It should simply be part of bog standard Github. We stash our code there and GH gets to monetise their usual enterprise services and launder data etc. We all get Copilot in return. If it is trained only on commons code and lacks the ability to derive an innovation itself then surely its output is commons too.

Otherwise, I suggest that GH only trains George on "enterprise" accounts and provides only those accounts the fruits of their labours.

Perhaps there could be two Copilots: one for commons code and one for enterprise code.

Yes, my tongue is nearly poking out of my cheek.

GitHub is my copilot

dskoll — Sun, 18 Jul 2021 13:40:07 +0000

You mean like this patent?

My point is there's no way GitHub would indemnify users of Copilot code against patent infringement, because that's an expensive minefield. It would also encourage patent trolls... would you prefer to claim patent infringement damages against TinyStartup, or MIcrosoft?

GitHub is my copilot

smcv — Sun, 18 Jul 2021 09:50:39 +0000

> See e.g. how game modders work, where everyone has their own copy of the game

I suspect most game mods have to contain enough copied or modified from the original game that the copyright holder of the original game could shut them down as copyright-infringing, if they wanted to. In my experience, game modders usually rely on exemptions that don't actually exist either in law or in the game's EULA (for example "it's non-commercial, so it's fine"), and the game's copyright holder turns a blind eye to it because they recognise the value of mods in popularizing their games.

Perhaps copyright law should behave more like game modders think it does, and less like the overreaching reality, but that seems unlikely to happen while changes to it are primarily driven by the same few entertainment cartels.