News for hackers. Stuff that matters.
Re:GitHub Copi­lot inves­ti­ga­tion by jakelazaroff on Monday October 17, 2022 @11:35PM (#33242668)
That isn't sufficient to get you off the hook. Copyright covers derivative work, not just code that's reproduced verbatim.
Re:GitHub Copi­lot inves­ti­ga­tion by Too on Tuesday October 18, 2022 @12:40AM (#33243048)
Derivative work requires a major part of the original, before it’s considered by copyright.

A 3 line boilerplate is neither novel nor a major part of the original.

Re:GitHub Copi­lot inves­ti­ga­tion by smaudet on Tuesday October 18, 2022 @01:22AM (#33243253)
I think if copilot is heavily restricted to three line code samples, perhaps I could agree with this.

The example cited by the OP is not a three line code sample - if you've ever done matrix coding, you know that sparse matrix operations are not simple.

Sure you can reduce it to a function call, but then you have library usage instead of code theft.

I think actually perhaps this is a way copilot could ethically move forward - instead of lifting code verbatim if it merely suggested libraries and approaches "here is an example of sparse matrix filtering and some libraries which do it", that would be both useful and ethical, presuming it does not obscure the license.

Re:GitHub Copi­lot inves­ti­ga­tion by sdenton4 on Tuesday October 18, 2022 @02:07AM (#33243530)
...But the example cited by the OP isn't how anyone actually uses copilot...

From where I sit, the complainant has found an extremely convoluted (and buggy) way to copy-paste their own code and is very upset about it. By similar logic, we should restrict the use of ctrl-c and ctrl-v, because they allow very simple infringement of open source licenses. Find a sparse matrix multiplication library which uses the copied code without attribution and you can take them to court; the law is already sufficient for this.

Re:GitHub Copi­lot inves­ti­ga­tion by cornel_io on Tuesday October 18, 2022 @02:56AM (#33243883)
"Derivative work" is a very specific thing, and it's contrasted with "transformative work" in a way that matters a lot, and fair use intersects heavily with both.

Even when it comes to stuff that seems reaaaaally close to pure derivative: Googling "How long does it take to boil water?" => "If you're boiling water on the stovetop, in a standard sized saucepan, then it takes around 10 minutes for the correct temp of boiling water to be reached. In a kettle, the boiling point is reached in half this time."

That's a verbatim snippet pulled directly from https://unocasa.com/blogs/tips/how-long-to-boil-water, and yet Google exists and continues to do stuff like this under the fair use doctrine despite massive efforts to attack/monetize their service. [To be fair, Google does link results, which probably insulates them because it's less hurtful to the commercial interests of the source; that said, with open source there generally are no commercial interests to hurt (open source attribution will be a tough sell as an actual commercial interest), and that's specifically called out in the law as a factor]

Copilot is even less explicitly at risk IMO, in that it never even stores the text, nor can it reliably retrieve it. I have no idea what makes anyone think it should be more vulnerable than Google.

From the copyright.gov page on fair use (https://www.copyright.gov/fair-use/, worth reading in detail for anyone who cares about this stuff, also has links to a monumental number of cases with shockingly intelligible summaries): "Additionally, “transformative” uses are more likely to be considered fair. Transformative uses are those that add something new, with a further purpose or different character, and do not substitute for the original use of the work."

Copilot without any shadow of a doubt does add something new, with a further purpose, and does not substitute for the original use of any codebase on Github (it can't create any of the codebases in full, without manual guidance so extreme that you'd have to be using the actual original codebase as a reference, so it clearly cannot substitute for a single one of them, and that's what a lawyer will argue, likely successfully).

In the Google vs. Oracle case (see https://www.copyright.gov/fair-use/summaries/google-llc-orac...), a big piece of the fair use finding was that "its value in significant part derives from the value that those who do not hold copyrights, namely, computer programmers, invest of their own time and effort to learn." and "further[s] the development of � computer programs”. It's hard to see where Copilot wouldn't fall into that category, as well, and that's precedent on (multiple) appeal.

By my reading this should be a slam-dunk fair use ruling, unless precedent gets really upended, and Butterick is wasting a ton of time and effort for absolutely zero potential gain other than some bragging rights, but to each his own...I guess we all have to grind our axes from time to time.

Re:GitHub Copi­lot inves­ti­ga­tion by cornel_io on Tuesday October 18, 2022 @02:57AM (#33243886)
"Derivative work" is a very specific thing, and it's contrasted with "transformative work" in a way that matters a lot, and fair use intersects heavily with both.

Even when it comes to stuff that seems reaaaaally close to pure derivative: Googling "How long does it take to boil water?" => "If you're boiling water on the stovetop, in a standard sized saucepan, then it takes around 10 minutes for the correct temp of boiling water to be reached. In a kettle, the boiling point is reached in half this time."

That's a verbatim snippet pulled directly from https://unocasa.com/blogs/tips/how-long-to-boil-water, and yet Google exists and continues to do stuff like this under the fair use doctrine despite massive efforts to attack/monetize their service. [To be fair, Google does link results, which probably insulates them because it's less hurtful to the commercial interests of the source; that said, with open source there generally are no commercial interests to hurt (open source attribution will be a tough sell as an actual commercial interest), and that's specifically called out in the law as a factor]

Copilot is even less explicitly at risk IMO, in that it never even stores the text, nor can it reliably retrieve it. I have no idea what makes anyone think it should be more vulnerable than Google.

From the copyright.gov page on fair use (https://www.copyright.gov/fair-use/, worth reading in detail for anyone who cares about this stuff, also has links to a monumental number of cases with shockingly intelligible summaries): "Additionally, “transformative” uses are more likely to be considered fair. Transformative uses are those that add something new, with a further purpose or different character, and do not substitute for the original use of the work."

Copilot without any shadow of a doubt does add something new, with a further purpose, and does not substitute for the original use of any codebase on Github (it can't create any of the codebases in full, without manual guidance so extreme that you'd have to be using the actual original codebase as a reference, so it clearly cannot substitute for a single one of them, and that's what a lawyer will argue, likely successfully).

In the Google vs. Oracle case (see https://www.copyright.gov/fair-use/summaries/google-llc-orac...), a big piece of the fair use finding was that "its value in significant part derives from the value that those who do not hold copyrights, namely, computer programmers, invest of their own time and effort to learn." and "further[s] the development of computer programs”. It's hard to see where Copilot wouldn't fall into that category, as well, and that's precedent on (multiple) appeal.

By my reading this should be a slam-dunk fair use ruling, unless precedent gets really upended, and Butterick is wasting a ton of time and effort for absolutely zero potential gain other than some bragging rights, but to each his own...I guess we all have to grind our axes from time to time.

Re:GitHub Copi­lot inves­ti­ga­tion by teddyh on Tuesday October 18, 2022 @05:48AM (#33244968)
> Copilot is even less explicitly at risk IMO, in that it never even stores the text, nor can it reliably retrieve it. I have no idea what makes anyone think it should be more vulnerable than Google.

That doesn’t matter, IMHO. Once Copilot manages to copy a work, a copy has been created and copyright has been violated. If this occurence is reasonably likely, then Copilot is wittingly assisting in violating copyright.

Re:GitHub Copi­lot inves­ti­ga­tion by cornel_io on Tuesday October 18, 2022 @07:34AM (#33245746)
How likely that situation is is disputable. People have cherry picked some cases where by specifying a very particular comment you can get it to (unreliably) reproduce well-known pieces of code, sure. But that is neither the intended use of the product nor the actual way that a single person using the product really employs it, and that really, really matters. Judges are not automatons, and the fact that when and if this goes to court the developers will be able to get up and honestly say "this is a tool developed to help developers create new code that is not merely recreating the functionality of the code we trained the tool on, and all our users use it to create entirely new things" is going to matter when they argue that it is fair use/transformative work.

I do completely understand that a lot of people disagree with me morally, and think that extracting insights from scraping the public web should be illegal. You're free to have that opinion, but I'd recommend you start lobbying your congressman to change the law, because though I'm not a lawyer I hang out with a few who do copyright stuff, and I don't think the law as it stands is on your side. That said, who can say, maybe this will end up bubbling up through many layers of appeals and end up at the Supreme Court someday, this stuff is all certainly wildly outside the bounds of what anyone writing the copyright laws was thinking about back in the 70s (which I think was the latest significant iteration?) so it's fair to say it's a complete gray area.

Re:GitHub Copi­lot inves­ti­ga­tion by salawat on Tuesday October 18, 2022 @09:59AM (#33247246)
>But that is neither the intended use of the product nor the actual way that a single person using the product really employs it, and that really, really matters

And yet, someone has done so, and found that to be the case. Therefore, it falls under "normal use".

So make up your mind. Is software engineering only about assembling working programs, or assembling working programs + navigating license minutiae?

One of these, Copilot has a place in. The other it does not.

Re:GitHub Copi­lot inves­ti­ga­tion by cornel_io on Saturday October 22, 2022 @02:19AM (#33296002)
You may hope that a judge considers a really weird and cherry-picked weird edge case to be "normal use", but opposing counsel will argue the opposite, and have a lot of evidence if they actually look at real use.

"I can use a gun to shoot someone" doesn't make guns illegal, even if people do so with some regularity. "I shot someone to make the point that guns can kill people" is worth even less in the eye of the law, and that is literally what you're pointing to here.

Re:GitHub Copi­lot inves­ti­ga­tion by cornel_io on Saturday October 22, 2022 @02:22AM (#33296011)
And I don't know what you're even getting at with the "assembling working programs" vs "navigating license minutae" stuff. Copilot helps the former, and you're apparently trying to argue that it should be banned because some people are feeling angsty about the latter?
Re:GitHub Copi­lot inves­ti­ga­tion by batmanturkey on Tuesday October 18, 2022 @06:32AM (#33245283)
Google then handily provides you A LINK to the original ATTRIBUTED SOURCE.
Re:GitHub Copi­lot inves­ti­ga­tion by cornel_io on Tuesday October 18, 2022 @07:58AM (#33245935)
Yes, I mentioned that. And I think it would be great if GitHub added some sort of scan to see if it was accidentally returning some verbatim code and gave a link to the repo it came from, but the situation with Google was much more clearly harmful: by scraping and presenting verbatim quotes, they are directly siphoning web traffic away from the sites they scrape from, and many of those sites make money based on page views. That is direct economic harm, and the actual impact was significant for many companies, not merely theoretical.

With open source code, the harm is much less tangible, since negligibly few open source projects make money from people going to their GitHub pages because they're searching for code snippets (not zero, but almost). My guess is that an honest quantification would put the lost revenue due to Copilot's existence in the tens to maaaaaybe hundreds of dollars. Courts look at that type of thing, which is why I don't think this will end up being an issue, at least in the US. Europe is wild, who knows what they'll do there, and that's where activists on this topic should most wisely apply pressure, you can always convince someone in government there to throw a spear at a BigCo. You won't take them down, but you may get them to negotiate, and I don't even necessarily think that's a bad thing.

That said, even in the US, if enough people make noise then things could change, so I encourage you to speak to your congressperson (I will be as well, but arguing the other side, because I really do think this is fair use and I'd like to see it enshrined as such explicitly, because this fight is going to be extremely common over the next few decades).