Open source body quits GitHub, urges you to do the same The Software Freedom Conservancy (SFC), a non-profit focused on free and open source software (FOSS), said it has stopped using Microsoft's GitHub for project hosting – and is urging other software developers to do the same. In a blog post on Thursday, Denver Gingerich, SFC FOSS license compliance engineer, and Bradley M. Kuhn …
-> GitHub's decision to release a for-profit product derived from FOSS code, the SFC said, is "too much to bear."
One of SFC's sponsors is RedHat. What do they do again? So according to SFC you can't use FOSS code to make a for-profit product? What are people supposed to live on, earth worms?
Purchase close source projects and change the license to open source. Create the own open source projects. Maintain open source projects with a professional level of quality assurance. Distribute open source software in accordance with the licenses. Offer subscription based customer support.
They do not take software from multiple sources with different copyright owners and licenses, remove the attribution and licenses, chew what is left together and sell the result as if it were not the creation of others and mostly likely stand back and laugh when the recipients get into legal trouble for distributing the resulting code.
Yes, and they are well within their rights to do that as they adhere to the respective license terms and maintain attribution where required. They contribute plenty of code back too. It's a two-way street. There's nothing wrong with any of that.
The issue with GitHub isn't so much profit in itself, it's the fact they are taking code, digesting and regurgitating it to others without attribution or following the terms of the licenses the original code was licensed under. That is in pretty stark contrast to Red Hat.
-> Yes, and they are well within their rights to do
Right. So why is the SFC complaining about companies making profit from selling software? PLEASE don't make the pointless distinction between software and software support. You don't buy Windows, you buy a Windows licence.
-> The issue with GitHub isn't so much profit in itself
That is not how the SFC words it. Let me quote from SFC's web site: Launching a for-profit product that disrespects the FOSS community. The SFC does not like companies making profits.Now, please go and read the SFC's own article on this and then you will be better informed. They are a pressure group which is trying to form a posse to get what they want. I shall continue to use Github as it suits me.
> Right. So why is the SFC complaining about companies making profit from selling software?
They are not.
> That is not how the SFC words it. Let me quote from SFC's web site: Launching a for-profit product that disrespects the FOSS community.
How about we quote the entire sentence:
> Launching a for-profit product that disrespects the FOSS community in the way Copilot does simply makes the weight of GitHub's bad behavior too much to bear.
That is, they are here specifically complaining about the specific way that the for-profit product Copilot disrespects the FOSS community.
> I shall continue to use Github as it suits me.
And you are free to do that. But understand that by doing so you may well be having your copyrights and licensing infringed by GitHub and Microsoft.
Cherry picking quotes is basically VoT's MO.
Just as he's ignored snippets like
> Microsoft and GitHub have been ignoring these license requirements for more than a year. Their only defense of these actions was a tweet by their former CEO, in which he falsely claims that unsettled law on this topic is actually settled. In addition to the legal issues, the ethical implications of GitHub's choice to use copylefted code in the service of creating proprietary software are grave.
That's essentially what a plumber does. You scored a free toilet, and want it installed in your home ,built by someone else. So the plumber comes and does that for a fee. if the toilet develops a problem the same plumber will come and fix it , for a fee. Why ? because you can't deal with your own sh..
Red Hat pays the salaries of many of the developers that work on many of the open source projects they sell support for, including Linux (several Kernel developers are RH employees, as well as many tools developers), JBoss, Quarkus, 3Scale, Kafka, Camel and many others.
If you want to feed your family while writing open-source software, Red Hat are one of the best companies to help you do that.
"One of SFC's sponsors is RedHat. What do they do again?"
They
(a) publish the source for their distro, including their own contributions to that code, under FOSS terms and
(b) they sell a supported binary version of that distro. If you buy their binary version you are essentially buying support.
Is that sufficiently clear?
If you don't need their support then without paying them a penny you can use the Alma or Rocky distros which are built from the RHEL distro's source. You can even use the Alma & Rocky versions with 3rd party paid support.
I thought somebody gullible would chime in with "buying support". It has always been a pointless distinction, because that support is for their product only. Try ringing up Red Hat and saying "Hi, I would like Red Hat without systemd". I can hear the laughing from here.
Go to the Red Hat download page today, right this minute. What do you see? "Product Trial". Congratulations, gullible people. You have a paid for product.
RedHat is a for profit company. In addition to their own code, they take code given by other people, package it up, and sell "support" for it. In doing this they have become the "standard" Linux distro. A fool and his money are soon parted.
And enough of your FOSS terms. If I publish code under a BSD licence, end users do not have to publish their changes. Please do not conflate FOSS with GPL.
As I want a Linux system without systemd I do not choose RHEL. There are other distros with other characteristics. Thank goodness for all that effort that goes into producing different distros which is not, despite views to the contrary, wasted.
And yes, I do understand the difference between GPL & BSD (although I may have to check on the multitude of other licences in the spaces between, nor do I conflate FOSS with GPL. Actually I read FOSS as Free and Open Source Software regarding the "and" as a union operator, not an intersect.
The full sentence from the blog post is: "Launching a for-profit product that disrespects the FOSS community in the way Copilot does simply makes the weight of GitHub's bad behavior too much to bear."
So it's more the *nature* of the for-profit product, not for-profit per se.
I actually was looking for a place to host a (personal, FLOSS, but largely irrelevant) project, just after MS acquired GitHub. I did not pick GitHub. It did not really matter much, since the project is not used by more than a handful of people, but I am sort of allergic to MS' behaviour.
I have (had...) two other colleagues accessing this repo. I would have hosted it on my university's server, but that was a bit of a hassle (and I could not use it any longer, no longer time storage etc. - you leave, you loose it - most of it, access for sure).
If it were more relevant I would actually do that. Or actually I would now host it myself. DynDNS...
Open source continues to miss the point. Make sure to keep on using licenses that everyone's freedoms in perpetuity. Alphabet has a handy list if you're unsure what to pick.
Top of that handy list was AGPL. One of the limitations of GPL is it does not address Googlization: taking GPL software, adapting it, renting it out as a cloud service and not distributing the source code for the adaptations. Googlization is legal for GPL code because Google does not distribute binary version of GPL software. That may not represent the copyright holder's intent because the license may have been selected before Googlization started.
The AGPL fixes this loop-hole. AGPL software is intended to be run as a service. It includes the ability for users of the service to download the source code. The service provider may not remove this ability from AGPL software and if they choose to provide modified AGPL software as a service, the modifications must be made available to clients.
Google rejects the AGPL not for legal reasons. They could legally use AGPL software and charge for it as a service - if they do so in accordance with the license. They reject AGPL for financial reasons: they would not be able to lock users into a monopolistic relationship with services based on secret modifications to GPL code.
Not really, BSD expects attribution doesn't it? MS ain't complying with that either.
Also AGPL is designed to disallow making free code become non-free. BSD explicitly allows that. which license is superior depends on which of those you value.
I think that's both a misinterpretation of liberal software licences and what the tool does. I've not looked at CoPilot and, thus, not at its licence or copyright, but BSD/MIT and other licences are very much about letting people look at the code and use bits of it without any kind of restriction. It's a bit like a lecturer asserting copyright over a CS class when covering memory management, or loops, etc.
In fact the BSD court case was mainly about this with AT&T asserting copyright infringement only to be found to be guilty of it itself.
Copyright in liberal licensing only really comes into play when entire libraries or applications are used, ie. not Oracle's API assertion. But it would be a different thing if Microsoft were to assert copyright over anything produced by CoPilot.
So, while I think the SFC has a point, I also think they're protesting too much and about the wrong thing. I don't host anything on GitHub myself, mainly because I started, and am sticking with Mercurial, but also because of the GitHub's terms and conditions, Being taken over by Microsoft didn't help either but that was long after I'd made my decision. And I'm also not a fan of monocultures: when everyone else gets malaria, I'll be the one holding out for Dengue fever!
This issue of "when is open source not F/LOSS?' is as much about defining the word "open" as anything else. In mathematics, the term means different things in different contexts. Geometry, topology and set theory all give it different and incompatible technical meanings. In set theory it is even incompatible with the theory's use of "closed", so that a set may be open and closed at the same tile, known as clopen.
The open-to-inspection-but-not-reuse garbage is just another example. You can't say that people are "missing the point" to use the word in a different way, as that would be autocratically imposing your own meaning on a much-twisted word - and if the English-language lexicon is one thing, it is much-twisted over time and space. This is what the maths example illustrates in its small way. But you can say that the open-to-inspection-but-not-reuse brigade are a bunch of sharks to be steered well clear of. Certain of Microsoft's bad smells being a case in point.
Meanwhile some fool accuses real OS project of not being one because its source code is not hosted on GitHub (as reported here). Microsoft seems to be doing their marketing and PR much better than their programs.
Microsoft didn't say that, and the complainer in that case didn't list GitHub as the only "acceptable" location. In any case, it's the raving of someone who doesn't understand a lot of things, from open source to security to Russia's war in Ukraine. I wouldn't take that complaint as representative of anything in this debate.
It doesn't even need to be git. That's designed for a project on the scale of the Linux kernel, which relatively few of us are working at.
At home I'm using fossil. Its command set is cleaner than git's nasty big heap of mixed metaphors. It includes a wiki, forum and ticket tracker, the sort of metadata that github holds hostage. (Do any of the other hosted services allow you to take all that with you?) Also a clean looking web gui. If you don't want to use your system package handler it comes in a single binary.
After the switching cost is paid the only thing I'm aware of that you'd lose is the ability to rebase. Fossil records what you did, not what you'd like to say you did. And that's a good thing.
BTW it's created by Richard Hipp, the author of SQLite. He's not exactly known for sloppy code is he?
Fossil is indeed good. I've used it locally for several years. It has a built in web server too. HTTPS support server side was added fairly recently.
What Fossil doesn't have is all the things that we take for granted with Github - such as the service is up there and running 24x7. Somebody has to do that. For small or even larger projects, somebody needs to ensure that is done. Github has a free tier. If you are spending your time running a source control service, whether it with git, fossil, or whatever, you are now spending some of your time doing that instead of your normal coding. Now I grant you that setting up fossil is not hard, but it does not take 0 time. Then you have to arrange your own backups. Maybe you already do that. Fine. But it all needs to be done.
It doesn't even need to be git. That's designed for a project on the scale of the Linux kernel, which relatively few of us are working at.
And more importantly, it's designed for a truly distributed use case. Most of the projects using GitHub are using it as a single central server, which is not where git has any significant advantages.
It'd make more sense to be using SourceForge and Subversion for that use case. Subversion's model is easier to understand (the vast majority of git users seem to have no idea of what its internal representation actually is) and better suited to the central-repository use case.
Most projects seem to be using git because most projects are using git.
I would rather not use subversion any more. It is... painful. In ways that git is not. Git sucks in other ways, sure. I cannot pin-point the annoyances then and now, but I know that I prefer git. And sourceforge is... good grief! Have you looked at it recently? Full of scripts and nasty and ugly and ....
nah. I'll pass.
I use git because I hate it less than subversion.
I have a feeling Git has things you need when you outgrow fossil and find it too restrictive. 2nd law of software - if its any good it will have to work with absolutely everything else sooner or later. I'm not saying you should include 200 unit tests before you write your first "Hello World!" but you should be aware you will have to and which particular cloud server /dev/null handles.
This post has been deleted by its author
I agree with your point, but if the copilot thing has digested millions of people's code, then the attribution list for derived works would have to be very long indeed (probably much bigger than the code itself). And there is no way they would have paid heed to what each open source licence used actually meant. Then the argument is inevitably going to be made by MS that GitHub's terms and conditions take precedence over individual project software licences......................
It's what happens when you wade into the open source world like a 10 ton gorilla hoping to monetise it.
I'm sufficiently old and scarred to be rather skeptical of source code in the sky, but this is merely one example of a growing problem.
You can, at least, get your source code back from GitHub in the format you submitted it, but that does not necessarily free you from its clutches if it's the route to other people's code you depend on. Moving your build pipeline, though, may involve rather more significant work.
If you look at all the other online tools - some based on FOSS and some proprietary - that are in pretty much ubiquitous use for everything from graphic design through to project management, there's a significant availability risk and in many cases no realistic way to migrate your data to your own servers or to other vendors.
There are many aspects of these tools with which it might be possible to take issue at some point but for many of them there is no realistic way out once you're committed. The convenience of an online solution you don't need to host and you likely aren't paying for nevertheless has a high cost.
For the SFC, the break with GitHub was precipitated by the general availability of GitHub Copilot, an AI coding assistant tool. GitHub's decision to release a for-profit product derived from FOSS code, the SFC said, is "too much to bear."
But how is moving away from GitHub going to help, if you still publish your work as open source on some other platform? Or even just as source tarballs? Microsoft will simply scrape that instead.
The only solution I can see is *more restrictive* FOSS licences. Normally these don't put limits on who can use the software, or what you can use it for. Such conditions are explicitly forbidden in the Open Source Definition.
It seems we'll need new licenses that forbid specific uses - such as embedding in code-generation systems or for training AI models.
Even then, it will be extremely hard to prove that your code was used to train an AI, short of whistleblowers.
> Microsoft will simply scrape that instead.
Could be, but 1. the hosting platform would probably notice; and 2. The hosting platform's terms of service may forbid scraping, in which case there may be legal/financial consequences for the scraping company.
> The only solution I can see is *more restrictive* FOSS licences.
In this case, Microsoft didn't care about the licenses, because they believe (though no legal reasoning has been given) that the FOSS licenses don't apply to their usage. So it doesn't matter what license the code has.
But how is moving away from GitHub going to help, if you still publish your work as open source on some other platform? Or even just as source tarballs? Microsoft will simply scrape that instead.",
If I were a nasty person I'd find a way to detect when it is Microsoft scraping projects on the new platform and feed them poisoned code.
That would solve the secondary problem of know if MS is using "our" code to train its AI. If the copilot support forums are flooded with users who suddenly have mysterious and difficult to track down bugs... you'll know :)
The MS will then have to spend so much time and money ferreting out subtly bad and downright malicious code, they'll actually get negative value from scraping "our" site's code.
If I were a nasty person, that is.
It might be feasible to tell if Co pilot was trained on a few particular cider snippets, neural networks, unless significant care is taken and even then.., tend to resonate significantly (statistically detectably) to training data versus unseen data, although so much code is similar when looked at as snippets. An excellent grad school thesis project...
Two major misstatements in this piece:
1. It's not training. It's harvesting, like Google News harvesting news from real news websites. (That Microsoft did not harvest its own proprietary code is telling.)
2. It's not AI. It's pattern matching, like a search engine. There's no learning. It doesn't write code. It regurgitates code without attribution.
I know because I invented similar technology more than 25 years ago, except my technology surfaces the original code with attribution.
That Microsoft would do something like this is not terribly surprising, because it presumably purchased GitHub to monetize it. It probably figures it can get away with this because the origin is obfuscated, and because it would be difficult for a FOSS litigant to prove substantial monetary damages (a basic problem of FOSS licensing).
it would be difficult for a FOSS litigant to prove substantial monetary damages (a basic problem of FOSS licensing)
If it ever got to litigation in the first place. Microsoft's history is replete with individuals and companies that were too small to afford taking them to court because they would have died long before it ever came in front of a judge, and if it did, Microsoft would simply keep appealing until the entity that dared to challenge them was drained of money. Stack was a notable exception to that dirty game.
Probably more that the developers of this tool were at GitHub, not the main Microsoft organization, so didn't have access. While I entirely understand the SFC's complaint and think that Microsoft/GitHub's excuses are stupid, I'm having trouble caring because the tool they've built seems so useless to me. There's no way that Copilot can understand what I want the code to do, so no matter how much good code they've ingested, they'll not have anything to fill in. At least when an IDE suggests parameters or the like, they have a reason for doing that, but I also turn that off too.
If the copyright of images used in training data translates into a copyright on the neural net
Self driving cars are going to have a problem, even if Telsa/Google/Whoever capture their own street images does the DoT own the copyright on the shape of the STOP sign?
Do the people whose faces were used for your iPhone camera's face detection have a copyright on the algorithm?
Can criminals register a trademark on their face and stop police using it in mugshots?
"does the DoT own the copyright on the shape of the STOP sign?"
No. For one thing, such things are frequently standardized, so it wouldn't necessarily be them. Many governments, including the American government, can't copyright things, so things they have designed and published are automatically in the public domain.
"Do the people whose faces were used for your iPhone camera's face detection have a copyright on the algorithm?"
I'm guessing the photos used were collected by the algorithm writers to avoid this. Unlike, for example, facial recognition where it needs the details of many peoples' faces, face detection just requires a lot of pictures of faces on different backgrounds. They can be from a small subset of people, so it's easier to get consent.
"Can criminals register a trademark on their face and stop police using it in mugshots?"
No. Getting a trademark or copyright doesn't prevent people from using the work, but from conducting business with it or distributing it respectively. A criminal could copyright a photo, but the police will be taking a new one not copyrighted by them. They could trademark their face, but the use of the image would be allowed because the police weren't using it to sell products or imply endorsement.
In this circumstance, however, the code is copyrighted and not licensed such that Microsoft's use is acceptable. Microsoft could probably argue successfully that they were permitted to read it and use it in derivative works, and thus the creation of their tool is fine. However, the tool is going to output things which potentially fall under licenses with other terms, and Microsoft doesn't appear to have a plan for how they'll deal with those. In short, they would have no legal problem if they created this thing, including reading all the code they did, but never used it. As soon as they want to distribute the result, they have an issue.
....scraping billions (yes....billions) of images from FB and elsewhere.....
....and selling the result to police forces and other entities worldwide.
In this and the Copilot matter, it seems to me that copyright owners are just like the rest of us.......we have NO IDEA who might be out there stealing our work or our privacy.
The fundamental problem is "the cloud".
Perhaps we should adjust the Benjamin Franklin dictum: "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety."
As: "Those who would give up essential Control, to purchase a little temporary Cashflow improvement, deserve neither Control nor Cashflow."
..since the original Traf-O-Data days.
I got a big laugh out of the "why did they not train on MS code" quote. As would anyone else who has seen the MS codebase. I think the Win2K / XP and NT4 codebases should still be out there. The ones that escaped about 20 years ago. Over 200 meg (each) of mostly very bad code. Apart from the DEC code in the kernel of course. The rest? You dont want to ask.
Don't know about this. While copilot was shown to use snippets of code, its model is also not meant to do that, and won't if there is further refining. For copilot to get better, it needs to understand the purpose of each piece of code instead of the purpose of whole sections, which matches the idea of avoiding plagiarism. It becomes a general understanding of code.
Beyond the intent and future argument, there's also the question of how much copied code do you consider to be plagiarised code. Unless you're purposefully having copilot do entire files for you, the architecture & quirks will vary. We all know there is some sort of "plagiarism limit" somewhere between copying a small function that you found smart and a bigger function, purposefully unique to its program. There's truly a need to ask whether code made of hundreds of pieces of different sources can be considered plagiarism of any of them. And going further, there's a need to question whether we would hold a robot and a human to different standards on that matter too.
First comment on this topic I've read that gets the nuance of this situation - thanks, and I agree. It's not copying code, it's writing new code "inspired by" the code it's digested. The argument is where inspiration stops and plagiarism starts, but assuming it's functioning as described I think it's far from clear.
It's fine. It isn't breaking any licences. It isn't copying why code from any system. What it generate is completely novel. They're isn't a single licence on GitHub that says that you cannot read public code and build statistics from it. Nothing blocks code analysis. I don't see anyone complaining about DependaBot, or secret scanner.
Ok, if it's generating a block of trivial code for which there are only a handful of possible solutions, it may generate something similar to choose that's in a public licenced repo, but I'll do that myself too, all the time. But, it'll pick up on my variable names and use them appropriately.
This complaint is spurious and probably malicious. Ignore it.
Is nobody going to mention Black Duck, or YMMV other standard scanners for open source components?
It’s fairly standard practice nowadays for companies developing proprietary software to run something like Black Duck over it before release. Because who knows what their developers have cut and paste from Stackoverflow or GitHub, and there’s legal risk associated with that. If it triggers, the developer has to justify it to a lawyer, or delete it. Hint: the lawyer always wins.
But now, an innocent developer accepts code suggestions from CoPilot, and suddenly behind the scenes they are getting code snippets from open source on GitHub….every single line of code guaranteed to be flagged by BlackDuck.
How does MS think this is going to *work* in the modern ecosystem? Did they not join the dots?
If copilot can't inform its users which license(s) applied to the code that it "regurgitates", then the only legally safe way for it to be used (I expect) is for Github to require all copilot users to license their resulting code under the GPLv3+. After all, it's the only(?) license that has the property of vaccinating derivative works against becoming non-free software.
While it's possible that some instances of regurgitated code might not contain GPL'd code, what corporate lawyer would be willing to advise their clients to accept that risk? Ironically, copilot could increase the use of the GPL. :-) That's assuming people would even continue to use copilot. It's probably more likely that corporate lawyers would warn their clients' developers not to use it.
Another alternative of course, is for Github to throw away all of the "learning" that copilot has done and start again from scratch but this time scrupulously excluding all GPL code (and any other vaccine licenses that might exist).
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
