The ONLY available terms are those given by the license, surely?

I can't find where in the TOS it says that you must "have all the rights [to the code]". It just says that you must not violate copyright nor other laws.[1] FOSS licenses by definition permit redistribution, so uploading to GitHub seems to be in-line with the license granted by the copyright holders.

What are the violations you mention?

> Contributors who add to existing GitHub projects are providing the same license to GitHub as the project maintainer though per the TOS.

Sure, but that's not the only way. If you contribute to a FOSS project elsewhere, those changes go under the same license of the project. Whoever you pass those changes to has liberty to redistribute per the terms of the license. The TOS is unneeded to legally redistribute FOSS-licensed projects with GitHub.

The TOS saying that you must grant GitHub these permissions is only to protect GitHub in cases where people upload projects without licenses.

[1] in addition to content restrictions, like no porn.

Uploading to GitHub is not just redistribution, it’s relicensing. Whether that is permitted depends on the license.

> If you upload Content that already comes with a license granting GitHub the permissions we need to run our Service, no additional license is required.

[1] https://docs.github.com/en/github/site-policy/github-terms-o...

Is it that widely scoped? Can't we narrow it to "A third party who finds their GPL code on Github but has not uploaded that specific code to Github themselves has a right of action limited to that specific code."

Just because I created a github account once and agreed to the TOS doesn't mean that I agree to let others upload my code to github, where would that scope end. Could someone steal code off my computer which i've never published and put it on Github and that was OK because I once signed up for a github account, clearly a contrived example but.

And here is exactly the problem.

GitHub seems to be copying copyrighted code left and right and pretend they made it!

No attribution, no license.

They are of course allowed to let their AI study the code, but as "employer" of that AI GitHub/Microsoft has a responsibility if that AI breaks copyright right and left and they as a company pretend the code is theirs to give away.

So if the user uploads the source to GitHub, they agree to the terms (which they may not actually have the rights to) but that isn't equivalent to the rights owner giving GitHub the rights to distribute the source under a different license.

The TOS can only modify those distribution terms (if it even can be found to be legally binding) if the user uploading the source is the rights owner which in so many cases is not the case.

Beyond that, that's what DMCA takedown requests are for. Github would only be an accomplice in that case, if they got a legitimate DMCA takedown request and chose to completely ignore it.

>It also does not grant GitHub the right to otherwise distribute or use Your Content

I'm curious. Copilot isn't actually part of github. It's a plugin for Visual Studio wouldn't that mean copilot is distributing code hosted on github, outside of github? You can't use copilot without visual studio.

How is this not Microsoft just parasitizing all the code hosted on github to make visual studio better? Which as far as i know, depsite being owned by Microsoft is not actually part of github.

> 'GitHub,' 'We,' and 'Us' refer to GitHub, Inc., as well as our affiliates, directors, subsidiaries, contractors, licensors, officers, agents, and employees.

Does that also include OpenAI? Does it include the Visual Studio team? All of Microsoft?

The license granted by users to Github is:

> We need the legal right to do things like host Your Content, publish it, and share it. You grant us and our legal successors the right to store, archive, parse, and display Your Content, and make incidental copies, as necessary to provide the Service, including improving the Service over time. This license includes the right to do things like copy it to our database and make backups; show it to you and other users; parse it into a search index or otherwise analyze it on our servers; share it with other users; and perform it, in case Your Content is something like music or video.

> This license does not grant GitHub the right to sell Your Content. It also does not grant GitHub the right to otherwise distribute or use Your Content outside of our provision of the Service...

IANAL, but naively, Github appears to be a code hosting platform. If they need to analyze my code to make it work with Git and with their code hosting features, that makes sense. For example, they might have a feature to prevent inadvertent commits of private keys, and would need to parse my code to do so. Maybe my code contains stuff that doesn't work with their generic private-key-finding parser, and they need to specifically run a subset of my code on their platform through their parser in a debugger to fix the feature. That's a sensible license to grant to a code hosting platform, they're not a no-knowledge encrypted storage provider.

They don't appear to be a software vendor that sells code to other private parties for use in closed-source applications. Their license appears to specifically deny them the right to sell snippets of my code to others.

I suspect, however, that this isn't a black-and-white factual issue, rather, one for a court to decide. One could probably hire an attorney to argue any possible angle on the legality of Copilot. And by a similar mechanism to the "Winner's curse", the company who developed a tool like Copilot would always have been one where their internal counsel advised them that what they were doing was totally legal.

It gets worse. To the extent that it is that straightforward, the correct takeaway is that you do not have permission to include someone else's GPLed code in your Github repository.

And that to the extent that GitHub relies on that permission in using the code that they host, they are liable for potential copyright claims from copyright owners that they have no relationship with, who never gave GitHub permission to use that code.

I therefore think that GitHub should do some careful thinking about how much they can rely on a ToS to do as they want with the copyleft code that they host. And I further think that people who host GPLed projects should ask whether GitHub is where they should be hosting those projects.

(Insert the mandatory, "I am not a lawyer and this is not legal advice.")

Or to put that differently;

Using GitHub’s built-in “Fork” feature is probably often a violation of GitHub’s terms of use.

This is a huge legal mess and its not being used to IMPROVE Github products and ops, it IS the Github product.

Tangibly, how is this AI method substantially different from non-clean-room implementations?

In terms of business use, it seems incredibly risky to me to even just *use* GitHub since their license agreement/ToS permit them to use my code to improve their tools which now apparently includes tooling where it may copy your code wholesale as someone else's suggestion.

The difference between that and having an AI do it is probably low. My gut instinct is that using an AI constitutes "access" to the AI's training corpus, so if it spits out something at least substantially similar to that corpus, then I'm infringing if I use that output. If it doesn't constitute access, then a copyright owner would have to prove "striking similarity", which would really only cover things like using Copilot to spit out fragments of old Quake code verbatim.

Clean-room is a way of arguing down the level of access that you have to something that you want to make a non-infringing copy of. It usually requires having actual attorneys review everything the clean-room engineers get to see, and stripping out the parts that are actually copyrightable. Merely training an ML system on input as a way to only have access to the uncopyrightable parts of that input probably wouldn't work.

Pretty much every Internet service is going to have similar clauses to GitHub's; because anything else would basically be a "click here to make me liable for copyright infringement" button. In fact, I wouldn't be surprised that merely running something like GitHub but without a ToS would still give you similar levels of implied license over whatever people push to your server.

The specific part of their ToS I was talking about was the (paraphrasing) [we can use your code to improve our tools and services] part.

Also, for the part about small snippets being non copyrightable. I would suggest looking at the Google/Oracle case. Google was found guilty of infringement for a very small number of lines, but the award to Oracle was IIRC rather a joke (something like one dollar, indicating it was infringing but largely irrelevant).

CoPilot is a NEW product, not an existing product (Github itself) that the ToS gives permission to improve.