Software Freedom Conservancy Quits GitHub (theregister.com) 45
An anonymous reader quotes a report from The Register: The Software Freedom Conservancy (SFC), a non-profit focused on free and open source software (FOSS), said it has stopped using Microsoft's GitHub for project hosting -- and is urging other software developers to do the same. In a blog post on Thursday, Denver Gingerich, SFC FOSS license compliance engineer, and Bradley M. Kuhn, SFC policy fellow, said GitHub has over the past decade come to play a dominant role in FOSS development by building an interface and social features around Git, the widely used open source version control software. In so doing, they claim, the company has convinced FOSS developers to contribute to the development of a proprietary service that exploits FOSS. "We are ending all our own uses of GitHub, and announcing a long-term plan to assist FOSS projects to migrate away from GitHub," said Gingerich and Kuhn.
The SFC mostly uses self-hosted Git repositories, they say, but the organization did use GitHub to mirror its repos. The SFC has added a Give Up on GitHub section to its website and is asking FOSS developers to voluntarily switch to a different code hosting service. "While we will not mandate our existing member projects to move at this time, we will no longer accept new member projects that do not have a long-term plan to migrate away from GitHub," said Gingerich and Kuhn. "We will provide resources to support any of our member projects that choose to migrate, and help them however we can."
For the SFC, the break with GitHub was precipitated by the general availability of GitHub Copilot, an AI coding assistant tool. GitHub's decision to release a for-profit product derived from FOSS code, the SFC said, is "too much to bear." Copilot, based on OpenAI's Codex, suggests code and functions to developers as they're working. It's able to do so because it was trained "on natural language text and source code from publicly available sources, including code in public repositories on GitHub," according to GitHub. Gingerich and Kuhn see that as a problem because Microsoft and GitHub have failed to provide answers about the copyright ramifications of training its AI system on public code, about why Copilot was trained on FOSS code but not copyrighted Windows code, and whether the company can specify all the software licenses and copyright holders attached to code used in the training data set. "We don't believe Amazon, Atlassian, GitLab, or any other for-profit hoster are perfect actors," said Gingerich and Kuhn. "However, a relative comparison of GitHub's behavior to those of its peers shows that GitHub's behavior is much worse. GitHub also has a record of ignoring, dismissing and/or belittling community complaints on so many issues, that we must urge all FOSS developers to leave GitHub as soon as they can."
The SFC mostly uses self-hosted Git repositories, they say, but the organization did use GitHub to mirror its repos. The SFC has added a Give Up on GitHub section to its website and is asking FOSS developers to voluntarily switch to a different code hosting service. "While we will not mandate our existing member projects to move at this time, we will no longer accept new member projects that do not have a long-term plan to migrate away from GitHub," said Gingerich and Kuhn. "We will provide resources to support any of our member projects that choose to migrate, and help them however we can."
For the SFC, the break with GitHub was precipitated by the general availability of GitHub Copilot, an AI coding assistant tool. GitHub's decision to release a for-profit product derived from FOSS code, the SFC said, is "too much to bear." Copilot, based on OpenAI's Codex, suggests code and functions to developers as they're working. It's able to do so because it was trained "on natural language text and source code from publicly available sources, including code in public repositories on GitHub," according to GitHub. Gingerich and Kuhn see that as a problem because Microsoft and GitHub have failed to provide answers about the copyright ramifications of training its AI system on public code, about why Copilot was trained on FOSS code but not copyrighted Windows code, and whether the company can specify all the software licenses and copyright holders attached to code used in the training data set. "We don't believe Amazon, Atlassian, GitLab, or any other for-profit hoster are perfect actors," said Gingerich and Kuhn. "However, a relative comparison of GitHub's behavior to those of its peers shows that GitHub's behavior is much worse. GitHub also has a record of ignoring, dismissing and/or belittling community complaints on so many issues, that we must urge all FOSS developers to leave GitHub as soon as they can."
Obligatory Sourceforge plug: (Score:5, Insightful)
Sourceforge (a slashdot sister company) is waiting for you with open arms.
After the Dice fiasco, the new owners have tried to make ammends.
https://sourceforge.net/p/forg... [sourceforge.net]
Disclaimer: I am in NO WAY affiliated to Slashdot, Github or any related company
Re: (Score:2)
Nah.
Re: Obligatory Sourceforge plug: (Score:2)
I've been around here long enough to remember the /. articles about free software organizations urging projects to move away from Sourceforge.
Re:Obligatory Sourceforge plug: (Score:4, Interesting)
Isn't that the site with bundled garbage in every installer?
Yeah no thanks. I don't know what it's like now since I just stay away from that site, but there is no reason to even chance choosing it.
Re: Obligatory Sourceforge plug: (Score:2)
Re: (Score:2, Troll)
After the Dice fiasco, the new owners have tried to make ammends.
If they've done as good a job with Sourceforge as they've done with Slashdot, it'll fuck your mom in front of you.
Re: (Score:2)
I've thoght about using sourceforge just because they are happy to host project mail lists which could be very convenient.
Re: (Score:1)
Got my first trojan from sf. Never been back.
Legally in the clear for now (Score:3)
Re: (Score:2)
Just don't use it. It's not like there aren't other alternatives out there. The FOSS community have a right to be concerned and while the geek in me would say "hey, this sounds like a good feature" looking at it from another perspective it could be considered a land grab.
Re: (Score:2)
We flatter ourselves by saying that we create a original code every time we try something. We don't. We create things based on what we've seen before, examples we've studied, code we've debugged and from logical descriptions Which means we are copying somebody else's work either intentionally or unintentionally.
I argue that an AI tool
Re: (Score:2)
Re:Legally in the clear for now (Score:5, Insightful)
There's a big difference. Facebook and Google do data-mining on data that they own. Github does not own the repositories uploaded to it -- the uploaders do, and often they just mirror other people's code on their accounts.
You are legally allowed to train an AI model on public data, but Open Source is not Public Domain.
Copilot is trained on code that is under copyright, under various licenses where the weakest require at least attribution of the original authors. But copilot has stripped away any copyright or attribution from the training set.
First, the very nature of the service, and second, special code within Copilot, is making identification of the original code hard: When nobody can prove that they are the plaintiffs in any specific case, then they can't sue, and Microsoft is taking advantage of that.
Re: Legally in the clear for now (Score:1)
Re:Legally in the clear for now (Score:5, Informative)
maybe this would become the focus of some future GPL v4?
There is probably No term they are capable of adding that would address this, because the GPL cannot restrict usage that is not reliant on having a license. Unless the FSF is willing to add a "Non-Disclosure Agreement (NDA)" to the GPL prohibiting the public redistribution of GPL-covered code to recipients who have not agreed to Bind themselves to the GPL with respect to the covered software.
The problem for the OSS developer is they are Publishing their code - it is possible for Github people to download the code they can find Anywhere on the internet and decline to agree to the GPL (Not putting your code on Githbub does Not protect you. If your code is publicly available, they
can download it and use it internally.).
Training their AI model with your code does not require a license. It is fine that they legally possess a copy of your code with no license, they can train their model with it.. They have not had to agree to the GPL in order to legally do so, therefore, no term in the GPL. can prevent this use.
Finally, individual code Output of their tool is likely to most of the time be legally Fair use and Not a derivative work of the code their system was trained with - mainly because the CoPilot tool is producing very small sections of code focused to a task set by the user: assuming their training set is large enough - it is likely CoPilot can produce autocomp snippets which are small and unimportant enough regarding the original works as a whole To not reach the threshold necessary to be considered an appropriation of another work, And furthermore... if they do, it is likely it will have a different purpose and be sufficiently transformative that it ends up being fair use.
Requisite Reference (Score:2)
"I'm gonna build my own (fill in the blank) with blackjack and hookers" - Bender Rodriguez [youtube.com]
Courtesy of Microsoft (Score:5, Insightful)
Re: (Score:1)
Absolutely correct. Very sad that you've been modded down for understanding the situation better than most Slashdolts. I left GitHub for GitLab the moment the acquisition was announced. No regrets.
What ramifications??? (Score:5, Interesting)
Microsoft and GitHub have failed to provide answers about the copyright ramifications of training its AI system on public code
Read that statement again. If there are ramifications about learning to code from PUBLIC code, do any "legal" programmers even exist? I've looked at repos, I've looked at code snippets. How is it any different, legally or otherwise, if an AI I'm training is reading there same code I could have some developer from India reference to figure out how to do something?
If-else isn't "understanding" (Score:4, Insightful)
If you copy-paste functions from open source licensed code, you need to follow the license. That's true whether you use a mouse to do or you use a decision tree.
The decision tree method is called "AI". It's a common type of AI, which consists of essentially building a bunch of "if-else" statements. Like this:
If programmer types "Call-Api" {
paste-from("Apache")
}
You can certainly gain understanding of programming beta practices by reading other people's code, and then use that understanding to write your own original software. A computer program can NOT gain an understanding of programming best practices. It can only do more or less complex versions of copy-paste.
Re:If-else isn't "understanding" (Score:5, Interesting)
This makes claims that sound scientific-y, but how exactly can you test the statement that "A computer program can NOT gain an understanding of programming best practices." You would need to make a distinction between the statistical process a ML algorithm performs and what a brain does, but we don't really understand what a brain does. ML algorithms are not "complex versions of copy-paste" any more than our own intelligence is. To say such suggests you don't have a good intuition about what ML algorithms are actually doing.
You can't copyright ideas. You can copyright tangible forms of expression. If I write an algorithm that synthesizes a bunch of different ideas to create something newwell that's what creative people do and we value it.
Re: (Score:2)
Now all you need to do is convince the UK of that. [bbc.com]
Re: (Score:2)
You can't copyright ideas. You can copyright tangible forms of expression.
Also it's... You can copyright ORIGINAL tangible forms of expression.
Software programs contain a lot of code, And a lot of code within a software project is not an original form of expression.
Take for example, the factorial function.. there are Only so many common ways to calculate factorial, and it is very likely that for any code you can think of to do it: exactly that code has almost certainly been already written before by so
Re: (Score:2)
> can NOT gain an understanding of programming best practices." You would need to make a distinction between the statistical process a ML algorithm performs and what a brain does, but we don't really understand what a brain does.
We know enough about the brain to know it's not sure as hell friggin linear regression! Heck, we're nearly as likely to use the *least* significant factor. Every day someone posts right here on Slashdot positing that A was caused by B, where A happened BEFORE B.
Maybe it's Bayes
Re: (Score:2)
If you copy-paste functions from open source licensed code, you need to follow the license. That's true whether you use a mouse to do or you use a decision tree.
This is not necessarily true legally; it depends upon whether whatever you actually pasted is important enough and large enough to be considered an appropriation of others' work. The best advise of course is to Always attribute your copy+paste with its source, Because these issues are not very fun to deal with for programmers - it is better
Re: (Score:2)
> main() { printf("Hello, slashdot\n"); }
> If I post a larger program containing this main function
If you post a larger program containing that main function, you wrote mostly dead code, code that will never run.
Re: (Score:2)
If you post a larger program containing that main function, you wrote mostly dead code, code that will never run ..
Not necessarily true - you don't have enough information to determine that it will be dead code.
A compiled object can ofcourse export multiple functions, and we can link with -nostartfiles and set the program entrypoint to a _start function that begins execution somewhere else, so the main() function is not the entrypoint.
In fact, we can have a compilation process that creates multiple diffe
Re: (Score:1)
If you copy-paste functions from open source licensed code, you need to follow the license.
And what if you are not copy-pasting code, but learning approaches and making use of that knowledge later?
Which is exactly what AI is doing. It's looking at a whole bunch of different code, and seeing common approaches that lots of people use. It's not copying any one codebase.
Magnets do not learn, don't have knowledge (Score:2)
> but learning approaches and making use of that knowledge
Hard drives have bits, copied from here to there. They do not have knowledge and do not make use of their insights. They are not humans or animals. They are magnets, or transistors (tiny relays).
It's literally precisely the same as connecting a bunch of household light switches together. A switch doesn't gain understanding. It simply gets flipped on or off. The connected wire copies that in or off state to the other side of the room. It do
Re: (Score:1)
Hard drives have bits, copied from here to there.
Human brains are no different, storing information they learned and retrieving it later, combining many items from pact memories.
Humans are just machines also, just more complex and general purpose. There lies your fundamental misunderstanding.
It's literally precisely the same as connecting a bunch of household light switches together.
You mean like... neurons.
Re: (Score:2)
Software development is not the same as coding. Anyone can code, soon an AI near you will even be able to do it.
Re: (Score:3)
I'm not entirely sure what the compliant is, but GPL isn't public domain. If the AI only knows GPL code, and what it suggests, if copy/paste effectively from GPL, then the user's code should correctly attribute the origins.
Re: (Score:3)
Microsoft and GitHub have failed to provide answers about the copyright ramifications of training its AI system on public code
Read that statement again. If there are ramifications about learning to code from PUBLIC code, do any "legal" programmers even exist? I've looked at repos, I've looked at code snippets. How is it any different, legally or otherwise, if an AI I'm training is reading there same code I could have some developer from India reference to figure out how to do something?
Freedom to study the code and learn from it is one of the four essential freedoms of free software. Nowhere does it say that the "studying" can only be done by humans, not AI.
Re: (Score:3)
Did you know if you copy and paste stackoverflow code then you are committing license violations? Stackoverflow uses creative commons licensing and requires attribution. But does anyone do it? No. Copyright is dead unless you have tons of money and can setup traps to catch people dead to rights. This is why copilot is taking off. Within Microsoft internally, folks move from the AKS team to Windows development teams and no one blinks an eye. Gone are the days when you had to separate your dev teams accor
Re: (Score:2)
long-term plan (Score:2)
... we will no longer accept new member projects that do not have a long-term plan to migrate away from GitHub.
but ... i don't have such a plan, because i am not using GitHub ... and never have.
An alternative religion for the modern world (Score:1)
Decentralized hub for Git (Score:2)
What are the alternatives for Free git hosting? The benefit of GutHub is that it's centralized -- obviously ironic given Git. Would a non-profit hub for Git be burdensome because of bandwidth? Storage? Who is working on a decentralized hub for Git repos?
Re: (Score:2)
We need federation and a search engine. Gitlab does some federation. Not sure how easy it is to tag or reference a resources on another server.
#1334@example.com/foo/bar would be OK. @johngalt@example.com is good enough too.
Linux (Score:2)
I would love to see Linux move away from github (they are on it right?). But due to its slow on-going corporate take over, I doubt it will move.
But for my things, I have been considering moving somewhere and will do the on a rainy weekend.