And in EU, as a consumer, you can pretty much ignore most EULAs because they aren't valid if they break EU consumer protections.
Now if your interpretation is correct the idea of a meeting of minds falls completely on its face.
And, as a lot of individuals also upload their projects to GitHub, GitHub is on shaky ground there as well.
I think most EULAs have clauses like these in them but we are always told that it is because of crazy American lawyers and nothing to worry about.
If Microsoft decides to prove once and for all that we should worry about ridiculously broad claims in EULAs I think it will be hard for GitHub to continue to operate in more sane jurisdictions.
HN is not law school and you would be well-advised not to treat it as one. There's a ton of false information about the law flying around here and not nearly enough educated people or time to correct it all. If you want to know the law, go to law school, or ask a practicing lawyer.
> HN is not law school and you would be well-advised not to treat it as one. There's a ton of false information about the law flying around here and not nearly enough educated people or time to correct it all.
Since I learned the exact same thing about contracts being supposed to be a “meeting of the minds” in the first week of Contracts in law school (and much of the rest of Contracts was rules that have been developed operationalizing that principle), while I would agree with your “HN is not law school...” rant as a general rule, I don’t think its germane to the quoted statement.
This is probably an extremely stupid question as I'm neither a lawyer nor an ML dev (merely an humble backend developer), but let's say that the above situation applies and that Github has taken down Bob's repo as per Alice's DMCA request. However, let's say that in between Bob uploading the offending code and Alice submitting the DMCA request, Github used Bob's repo as part of a training set for Copilot. Now that they've complied with the takedown request, does Github have to restore Copilot to an earlier state that hadn't yet been trained by Bob's repo? Does this question even make sense since I only know the absolute barest bones of ML?
It takes some amount of time to comply with a takedown notice. For example, time passes between receiving Alice's notice and taking down Bob's repo.
I would expect Copilot's model(s) to be retrained periodically in order to remain relevant. The next retraining could exclude Alice's code. That might be a longer window than the case of the repo takedown, but as long as it doesn't take too long they might be okay?
There are incremental training approaches that evolve models over time rather than completely retraining them. In my experience, complete retraining is a far more common approach because the highly path dependent nature of incremental training can lead to outcomes that are hard to manage. For example, what if you discover bad training data like repos that collect anti-patterns? Or Alice's takedown notice? You typically want your models to be able to "unsee" things and that's hard with purely incremental training. Even when incremental approaches are used, there is often an occasional complete retraining to overcome such issues.
To be clear, I have no idea what training approach is used for Copilot.
What about all of the code that existed before Microsoft purchased them and before new licease language was introduced?
If they're taken to court and that part of the TOS is relevant to the issue, then yes, they can and will argue exactly that.
In Norway I think the rule is often "is aware of it or should have been aware of it".
> I haven't heard of Google being sued when play store cards are used by fraud victims.
Banks try to prevent cards from being abused and I guess Google try to. For example when someone tried to buy jewelry in an American store with my stolen card number the card was immediately locked.
Sometimes something slips through though and banks won't be held accountable for that.
The difference here is that there is no way GitHub cannot be aware that people upload personal projects from EU and copies of open source projects etc without agreement from the copyright holder. Besides the easily missed clause in the terms there is nothing to prevent it. Now if they'd done any reasonable effort to inform about it: a couple of blog posts over the years, a "Please note:" banner, even mentioning it in discussions here on HN before doing this that would have counted to their defense.
As far as I am aware no such thing happened.
GH's ToS don't prevent Bob uploading content Bob doesn't own. The ToS does require Bob to grant GH a licence to use any content uploaded that Bob owns. It doesn't prevent Bob uploading others' content nor does it ask Bob to grant GH licence to it.
---
If you're reading the ToS yourself, the keyword to look out for is "Your Content", which is defined in their Definitions section as such:
> “User-Generated Content” is Content, written or otherwise, created or uploaded by our Users.
> "Your Content" is Content that you create or own.
The licence grant to GH is only on "Your Content", not on "User-Generated Content" (i.e. content you upload, which may be yours or someone else's)
Which is the point of the article a bit. GitHub is likely not infringing but it’s also not absolving the end user of any infringement. Neat trick.
That being said I think the risk is minimal enough that I’d be pretty comfortable with using it.
This doesn't sound right. Alice writes code, and releases it under some restrictive license (GPL, something source-available, etc). Bob uploads it to GitHub, correctly labeled as GPL. Regardless of GitHub's TOS, Bob isn't able to give GitHub any additional rights to the code beyond what Alice gave him.
I think the later discussion about whether this falls under Fair Use is the important question.