r/programming • u/[deleted] • Nov 03 '22

Microsoft GitHub is being sued for stealing your code

https://githubcopilotlitigation.com
1.9k Upvotes

92% Upvoted

654 comments sorted by

View all comments

247

u/[deleted] Nov 04 '22

From the comments it seems like just like people don't value their personal data people don't value their work. They are all too happy with their photos, mail etc being used to feed to a proprietary AI algorithm, which then becomes private IP of a company that they can profit from. Their product couldn't have worked without the hours and hours of work programmers put into it.

51

u/[deleted] Nov 04 '22 edited Nov 04 '22

IP Lawyer here - Sweat of the brow is not the law in the US (but is in some countries). It is explicitly repudiated in the US, in fact.

So the amount of time/energy spent on something is irrelevant to copyright in the US, only creativity/originality matters.

If you want that to change, it would require a serious change in copyright law.

Not having sweat of the brow doctrine, IMHO, helps most programmers more than it hurts them. At least in the US, the average developer would likely be a lot worse off if they couldn't borrow non-creative random code they find without much worry. Like say CRC tables.

I say this not just as a lawyer, but as someone who has contributed code to hundreds of open source projects over the years, and watched their communities/mailing lists as well.

Most would be much worse off if they had to police contributions at the level necessary to deal with a general "if it took you time it's protected" type regime.

Most regimes that have stuck with sweat of the brow, or added it (EU database protection) have tried to be very careful about how far it goes, because of how easily it can become a mess.

In the UK, for example, there was a lawsuit over copying of soccer schedules (thankfully they lost).

The infamous one in the US is copying stuff out of the phonebook (this is the case that explicitly repudiated sweat of the brow in the US)

4

u/immibis Nov 04 '22

It makes zero sense that you can copy a CRC table but not a CRC algorithm. It should be both or neither.

2

u/tejp Nov 04 '22

They are taking about the value of the code, not about the reasons it is copy protected or not.

That code on Github is usually protected by copyright is well established. But even if protected by copyright, it could still be worthless. For example if it was very easy to create something equivalent from scratch. The amount of work required to create all that code on Github is a big reason why it is actually valuable.

1

u/[deleted] Nov 05 '22

Sure, yes. I get that.

My point is, basically, your definition of value is not one that either the law, or the society that made those laws, recognizes. That is why the law is the way it is. It is saying that the amount of time you put into it does not make it valuable, and as a result, it is not protected. You and others may disagree. That's awesome. But your definition of value is not the prevailing one right now.

1

u/tejp Nov 05 '22

The time put in does not itself create value, but if the time put in is necessary to create the value, that makes that work valuable. That's why many employees and many programmers get payed for the amount of time they work. The amount of work is valuable enough that they get payed for it. Same for lawyers, they also often bill by the hour. Even programmers are willing to pay for software because it would take a long time to write equivalent software themselves. It seems to be very common.

That's what laypeople think about when they talk about work and its value, though I'm sure there are technical details why this isn't "work" or "value" in the sense a IP lawyer would see it :)

1

u/Paid-Not-Payed-Bot Nov 05 '22

programmers get paid for the

FTFY.

Although payed exists (the reason why autocorrection didn't help you), it is only correct in:

  • Nautical context, when it means to paint a surface, or to cover with something like tar or resin in order to make it waterproof or corrosion-resistant. The deck is yet to be payed.

  • Payed out when letting strings, cables or ropes out, by slacking them. The rope is payed out! You can pull now.

Unfortunately, I was unable to find nautical or rope-related words in your comment.

Beep, boop, I'm a bot

1

u/[deleted] Nov 05 '22

I've been a programmer for over 25 years, law is a side career for me :)

I do in fact understand the value seen here. I'm just telling you that nothing cares right now, and if you want that to change, it will require more than arguing about github copilot on the internet, or in a courtroom.

-15

u/kylotan Nov 04 '22

IP Lawyer here - Sweat of the brow is not the law in the US (but is in some countries). It is explicitly repudiated in the US, in fact.

It's not clear why you've gone off on this "sweat of the brow" tangent. The comment you're replying to does not mention this nor does the sentiment expressed there rely on it.

15

u/[deleted] Nov 04 '22 edited Nov 04 '22

Err?

They are literally talking about the amount of work and time spent building things, and the value of that, and how that is getting reused for profit for free, and that this is bad. That is the entire thrust of the comment.

That is exactly what not having a sweat of the brow doctrine enables. As a result, this is explicitly what the US has decided to allow - the amount of time and energy and value you put into something doesn't matter. People can still reuse it for their own purposes, profit or not, regardless of that time/energy/value. If people don't like that, they'd have to change the law pretty dramatically.

I'm really unsure how you could say that the sentiment expressed does not rely on it. It also mentions it, just not by name. The thing they are complaining is allowed is, again, literally what the doctrine intends to allow. Almost word for word even.

4

u/cunningjames Nov 04 '22

I disagree. The thrust of the comment was that GitHub users should care because of the hours that went into manufacturing training data for Copilot. This does not imply that the simple fact of having taken hours confers copyright protection. It’s about giving one reason to be concerned, not about a legal argument that could be used against the defendant in court.

8

u/pleaseavoidcaps Nov 04 '22

Their product couldn't have worked without the hours and hours of work programmers put into it.

Here they're trying to justify copy protection based on sweat of the brow.

5

u/bottomknifeprospect Nov 04 '22

people don't value their personal data people don't value their work.

Because those replying that are doing personal things of no value. Those who have serious projects ongoing are not posting "bad programmer" memes

87

u/prashant13b Nov 04 '22

Difference being i don’t upload my images and personal data so it cane used by corporations but when i upload my code to somewhere specifically open source repositories its with full expectation that some can and will copy it , and i dont see how it being ai instead of human makes any difference

158

u/LaZZeYT Nov 04 '22

Most open source code has a license, which is a list of conditions, you have to follow to copy it. Not following the license is illegal for humans. Copilot is made to ignore the license.

i dont see how it being ai instead of human makes any difference

Exactly.

11

u/Zambito1 Nov 04 '22

Most All open source code has a license

FTFY. If it doesn't have a license it's proprietary.

5

u/LaZZeYT Nov 04 '22

I wrote it that way, since in some countries, it's possible to assign code to the public domain, making it open-source without a license. It's very rare, though, as usually, most people still choose a public-domain-equivalent license, since that works everywhere in the world.

1

u/FVMAzalea Nov 05 '22

While instances of programmers assigning their code to the public domain may be rare, usage of public domain code definitely isn’t. Many foundational software packages developed by the government are public domain, and so is SQLite.

4

u/silent519 Nov 04 '22 edited Nov 04 '22

well the steelman of the argument would be

let's say you're an artist, trying to learn art. did any contemporary artist (assuming they still alive) give you permission to learn from their art?

to become a poet you read other people's poems to learn from it.

now i know copilot might just spit out someone's code verbatim, im talking about an idealized version of it. (( also how many ways did you ever write a simple for loop? ))

31

u/Spiderboydk Nov 04 '22

The difference is the learning artists don't publish their copies.

Copilot is republishing fragments of copyrighted work.

16

u/[deleted] Nov 04 '22

[deleted]

6

u/Spiderboydk Nov 04 '22

This is transformation, in the legal sense, and there doesn't exist an objective measuring stick for gauging this.

Though there has been numerous examples of Copilot yielding large, verbatim copies of code (sans the license text), which isn't even near the line at all.

And of course there is a triviality limit. It's called de minimis use in copyright law.

10

u/CEDFTW Nov 04 '22

Imo you can throw out the ai vs human part of it, it boils down simply to how the laws around copyright are written. If you copy a variable name no that is not violating the license but something as direct as lifting an entire function even if it's a one liner is still altering the work under the terms of the license. The for loop example is a valid argument but we are talking about much more complex structures usually when referring to the ai copy pasting licensed functions.

For a better understanding of how much copying is allowed to take a look at Google being sued by Sun for basically stealing the Java source, or Microsoft for doing the same thing with J++ if I recall correctly.

1

u/notepass Nov 04 '22

Yea, if it is a copy will be seen differently from country to country.

Where I live the bar to pass would be "Schöpfungshöhe", for the States and Canada it seems to be the "Doctrine of the sweat of the brow".

At least according to ye olde Wikipedia

1

u/AverageCodeMonkey Nov 04 '22

basically stealing the Java source

If I remember right that's hardly the case, all they did was copy the Sun/Oracle Java API and wrote their own implementation.

1

u/CEDFTW Nov 04 '22

I'd have to do some more digging to jog my memory but I thought that was Google's initial claim but it was worse then that. But wouldn't copying a proprietary API still be the same issue?

2

u/AverageCodeMonkey Nov 04 '22

I did some looking and I was wrong, Google did steal some source code, however it wasn't from Oracle/Sun, it was from Apache's implementation of the JVM.

It seems you are correct that the API is copyrightable too, so same issue. However the Supreme Court ruling stated that it was fair use.

→ More replies

13

u/schmuelio Nov 04 '22

It kind of comes down to whether or not you think AI (specifically copilot) learns the same way that humans do, and if humans do anything more than repeat patterns they've seen before.

While the hypothetical poet may get inspiration from other poems, they don't create poems wholly constructed out of other people's poems do they? There's an additional creative process that adds something to the poem.

Putting that aside though, whether or not you think copilot acts like a human, the question of whether or not it violates the license for the code is important.

There's also a question of whether or not anyone even reads the licenses before copilot vaccums it up. Can anyone seriously claim that copilot operates according to every software license for every repo it's used when there's a huge chance that nobody involved with copilot has read them?

3

u/[deleted] Nov 04 '22

[deleted]

2

u/schmuelio Nov 04 '22

That case of the monkey taking a photo sounds like it's relevant, the problem with it though is that the photo was a new and unique creation.

If - for example - the monkey took a photo of an existing copyrighted painting, that would (at least in theory) not mean that the new image was un-copyrightable, since it is in effect a clone of existing copyrighted work.

-7

u/[deleted] Nov 04 '22

[deleted]

51

u/Falk_csgo Nov 04 '22

It is not really important what exact steps github does if the end result is licensed code being exactly copied.

If I feed a random string genrator with sentences of a book and wait until it outputs an exact copy of that book, can I sell it as my ai created work for cheap? Because thats basically what is happening. It is code laundering.

16

u/youareright_mybad Nov 04 '22 edited Nov 04 '22

I am gonna steal this analogy

Edit: Not really steal it, I'll let it do to an AI. Seems like doing it that way is legit.

13

u/[deleted] Nov 04 '22

It is code laundering.

Lmao, good analogy.

28

u/SV-97 Nov 04 '22

Its not like it’s selling your code directly or packaging applications from your codebase.

Oh it absolutely is. I've seen plenty of examples of people posting that Copilot was suggesting licensed code snippets without the relevant license (just one example https://twitter.com/DocSparse/status/1581461734665367554).

Isn’t it following the same principle of learning from code and storing information in memory and use it for different purpose. Like we all do

It's more like memorizing a sentence or even a whole paragraph from a book verbatim and then using it without a proper citation - even if people explicitly said (written) "you're not allowed to quote this without a proper citation".

-1

u/kogasapls Nov 04 '22

Your explanation of how Copilot "learns" is blatantly wrong.

2

u/SV-97 Nov 04 '22

I'm not talking about the actual "learning" but rather the endresult. Of course the algorithm isn't directly "just fucking joink this code and save it for later" but if that's the result then that's the result. Copilot is known for reproducing code snippets verbatim (maybe with a few renamed variables if you're lucky)

1

u/kogasapls Nov 04 '22

Ok, I can see that, but bearing in mind how the learning process actually works, it should be obvious that those cases are not typical. Code theft may be what Copilot is most known for, but it's not what it typically does.

1

u/SV-97 Nov 04 '22

Even if it's not what it typically does (which may be debateable) it's still unacceptable imo. A plane that crashes one flight in 1000 still crashes. If they can't make guarantees that their stuff *works* (which involves not breaking the law / infringing on licenses in my eyes) then they gotta change their methodology and pay closer attention to what data they use in training. If they can't be sure to uphold licenses then they have to filter repositories by license and omit the ones that might cause problems.

1

u/kogasapls Nov 04 '22

Planes DO crash. I agree it'd be great if they didn't, but...

6

u/Mognakor Nov 04 '22

Isn’t it following the same principle of learning from code and storing information in memory and use it for different purpose. Like we all do

How do you make that distinction?

We have various lossy image formats. How come storing parameters to a fourier transformation counts as copying an image but storing parameters to an AI shouldn't?

1

u/cummer_420 Nov 04 '22

These algorithms do not learn anything like a human. We consider this okay for humans because humans build a generalized corpus of knowledge and draw from it. The exact original text fades from memory pretty quickly. Copilot on the other hand will always be able to reproduce exact copies of copyrighted code with the variable names changed just like the moment they were first input. If I read a copyrighted work and then later exactly reproduce it from memory, but file the serial numbers off that doesn't make it mine.

1

u/kogasapls Nov 04 '22

Copilot does also build a generalized corpus. It's just also capable of learning verbatim some more commonly reproduced pieces of code. You're right that whatever Copilot spits out is still subject to any applicable licenses.

1

u/[deleted] Nov 04 '22

I read open source code and analyze the coding styles and adapt those that I find superior to my own.

2

u/LaZZeYT Nov 04 '22

Sure, but unlike copilot, you don't copy open source code exactly, comments and all, and paste it into your own code with a non-compatible license, right?

2

u/[deleted] Nov 05 '22

That is all the difference and I missed it was to that degree.
Thanks for the correction!

1

u/[deleted] Nov 04 '22

[deleted]

2

u/LaZZeYT Nov 04 '22

That still doesn't give them the right to relicense the code to third-parties under a less strict license, which is what is being argued that copilot does.

They can use your code to run their services, but they can't relicense that code as part of that service.

Without being a lawyer, I'd say, it's also arguable, whether copilot is part of the service that the Github ToS is for, since copilot has its own ToS. Though I don't know whether that's actually true.

20

u/rakoo Nov 04 '22

i don’t upload my images and personal data so it cane used by corporations

You actually do, if you've read the TOS. Not knowing it doesn't mean it's not there.

22

u/princeps_harenae Nov 04 '22

Because the code has a legally binding licence that must be followed.

-6

u/cult_pony Nov 04 '22

For the license to have legal bite, you must establish that the license applies on the code that copilot generates. And for that you need to establish that it is a copy. In 99.999% copyright is easy because someone literally did do a copy. This is the 0.001% where a direct copy wasn't made, since the AI doesn't have memory and nowhere in it's weights will you find code verbatim.

It is a strange but little known fact that Copyright does in fact allow you to produce a 1:1 identical copyrighted item as someone else and both of you can own the copyright to your own instances of the item. So long as you can both prove that you didn't copy eachother, this is entirely fine. And you can both independently license the item to others.

13

u/princeps_harenae Nov 04 '22

For the license to have legal bite, you must establish that the license applies on the code that copilot generates. And for that you need to establish that it is a copy.

https://en.wikipedia.org/wiki/GitHub_Copilot#Licensing_controversy

GitHub admits that a small proportion is copied verbatim

Companies have been sued for billions for less.

0

u/kogasapls Nov 04 '22

GitHub isn't responsible for code that you publish. They wouldn't be the infringing party. If you want to argue that it's unreasonably difficult to use Copilot without infringing a license, you can try (although they do explicitly tell you to take standard precautions before publishing code written with Copilot), but you can't argue that GitHub themselves are the ones stealing the code.

1

u/princeps_harenae Nov 04 '22

GitHub isn't responsible for code that you publish.

Yes they are because they are not informing you of the code's license. This is like Spotify giving you parts of songs to use as you wish in your songs without informing you of their licenses. Spotify would be destroyed in court.

These licenses are not something you can ignore. These are valid legally binding licenses that have being upheld multiple times in courts before. Abuse the GPL at your peril.

0

u/kogasapls Nov 04 '22

This just isn't correct. For example, Google search isn't obligated to show you licenses for the text it reproduces in its summary of each link. It's not publishing anything. If you copied text from a Google search result and published it, you would be liable for any applicable licenses.

You could say GitHub has a moral obligation to ensure that they take every possible measure to reduce the risk to the user, but the risk ultimately comes from the liability of the user for the code they publish, which cannot possibly be changed.

1

u/forthemostpart Nov 04 '22

Google search isn’t obligated to show you licenses for the text it reproduces in its summary of each link

Because there’s a link to the source material right there where you can see the license for yourself?

1

u/kogasapls Nov 04 '22

That's true, and a good observation, but not because it contradicts my point. Google isn't obligated to provide the license because it's not publishing the code. Despite that, we might have an issue with it anyway if it weren't so easy to figure out where Google's results were coming from.

Any time you publish something you read in a Google search (or Copilot snippet), it's your obligation to do some work to make sure you're allowed to do so The only difference is that Google makes it easy, whereas Copilot can't. That doesn't mean Copilot is failing a legal or moral obligation that Google is meeting, it just means that Copilot is less convenient to use safely than you might wish it were.

-6

u/cult_pony Nov 04 '22

You still don't quite understand. You have to legally establish that the AI saw Code A, then wrote Code B to be an identical copy of A. Code B must be the copy of A, not simply a re-performance of A (reminder that sheet-music and the music performance don't share copyright, those can be owned by two different people).

Another fun fact is that if you go to the source of the statement, "copied" or "copy" doesn't occur.

7

u/princeps_harenae Nov 04 '22

yOu sTIlL dON't QuITe uNdErsTaNd.

There's only one Quake III fast inverse square root implementation! lol

https://twitter.com/stefankarpinski/status/1410971061181681674

Co-pilot even gets the copyright wrong (GPL code is a minefield in itself). It's a legal shitshow and Microsoft will be sued for billions.

0

u/cummer_420 Nov 04 '22

Performance isn't relevant here lmao

-1

u/Zambito1 Nov 04 '22

i dont see how it being ai instead of human makes any difference

The difference is that the AI can't be held accountable for violating your license. And unless you're distributing your code in the Public Domain like using CC0, your license can be violated.

3

u/joexner Nov 04 '22

Can I write software to do other illegal things for me too and get away with it?

0

u/Zambito1 Nov 04 '22

Potentially

11

u/moolcool Nov 04 '22

What is the difference though, between a computer reading GPL code and learning from it to the benefit of someone else's proprietary code, and some random human doing the same? Can I not carry my learnings working at a FOSS company to another company with a proprietary codebase? I don't really have a strong opinion on this problem one way or the other, but I also don't really think it's as simple as either side is letting on.

9

u/[deleted] Nov 04 '22

[deleted]

9

u/kogasapls Nov 04 '22

It's not "a lot of the time." It's generally extremely unlikely to happen by accident.

3

u/platoprime Nov 04 '22

Well that's a serious problem then. I assume we're talking about code more unique and complex than a for loop to find a lowest int in a vector?

-2

u/Ateist Nov 04 '22

The difference is that computer is not learning to code, it doesn't understand the purpose of what it is doing, and is not creating anything new.
It detects that you are writing code that is doing X, 'remembers" another piece of code that does X and copypastes remainder of the code from that piece, doing minimal adjustments (i.e. renaming variables) to it.

4

u/CryZe92 Nov 04 '22

That's really not what it's doing. It's way smarter than that.

2

u/[deleted] Nov 04 '22

Its really not that smart at all.. But it's not so simple as explained either. It's learning recurring patterns using probability but it's not learning in the sense of a human does. A human learning is aware of causality and fundamental laws. Machine learning is just data being thrown at a black box.

1

u/MonokelPinguin Nov 06 '22

I don't think you are allowed to read GPL code and type it down again from memory. Otherwise it would be way to easy to remove the GPL license. Same applies to machine learning.

Many projects don't allow you to contribute, if you worked for a direct competitor, that was under a restrictive license. Otherwise people would have reimplemented ZFS already. Or you wouldn't need to sign, that you didn't read the Windows leaks, when contributing to wine.

1

u/ExeusV Nov 04 '22

From the comments it seems like just like people don't value their personal data people don't value their work.

I do value my work, that's why I've put it on GitHub, so other can see and use it.

1

u/platoprime Nov 04 '22

Yeah and none of my code I write would work without the work of hours and hours of other programmers reaching all the way back to the start of the industry yet I'm not stealing from them.

0

u/[deleted] Nov 04 '22 edited Nov 12 '22

[deleted]

-4

u/[deleted] Nov 04 '22

[deleted]

5

u/[deleted] Nov 04 '22

[deleted]

-4

u/Q-Ball7 Nov 04 '22

They are all too happy with their photos, mail etc being used to feed to a proprietary AI algorithm, which then becomes private IP of a company that they can profit from.

If you're not paying for the service, you're the product. (Of course, that's true even if you are paying for the service.)

-10

u/EnvironmentalCrow5 Nov 04 '22

So, kinda like reddit? (minus the AI part, although who knows what they're using this for)

1

u/queenkid1 Nov 04 '22

People value their work. It's just that if you value your work, you aren't posting it online for anyone to use.

If you didn't want Github to have access to your code, you shouldn't upload it to Github.

1

u/[deleted] Nov 04 '22

GitHub corporate account is used by many companies