Tag Archives: Open Source

GPL compliance and permissive training data theory

This is the second post within a new series that I might start one day, about how companies abuse common misunderstanding of the GNU General Public License (GPL) to sell their stuff. Today, a slightly scary example. Scary, as it is so off the point.

The company Exafunction, Inc. claims that with their product “Codeium” they can provide intelligent programming assistance, based on a large language model (LLM). Just like Copilot of GitHub, Inc. and even better as they do not infringe any license and specifically not the GPL. Their writeup “GitHub Copilot Emits GPL. Codeium Does Not.” provides an adventurous interpretation about the GPL: You need consent to use it in a commercial context. Moreover training your model on purely permissive-licensed code will free you of any legal trouble.

Things are slightly different. Strange that nobody told them in their “… early conversations with the open source community”.

The GPL does not restrict commercial use. It does not even refer to it at all. You are fine in any fields of endeavour as long as you respect and fulfil its obligations.

The main problem with generative AI and the current ML-based programming assistants is that you cannot trace verbatim copies of code to its origin. Due to that you cannot fulfil the most essential obligation of any Free and Open Source Software license: attribution. Calling out the original authors.

It does not help if you train your model with just permissive-licensed code. You will infringe the underlying licensing terms if you do not provide any reference to the original authors and license(s). No matter if it is a permissive or copyleft license. Either way you will not have a valid legal base, speak license, to re-use the original work and it is as bad as any copyright violation with all of its consequences.

For more details or before starting the marketing campaign of your new programming assistant, it could be worth to take a closer look, for example at the ongoing GitHub Copilot litigation and its underlying motivation.

GitHub Copilot – Your AI-powered accomplice to steal code?

Last week GitHub and its parent company Microsoft announced “GitHub Copilot – their/your new AI pair programmer”. E.g. The New Stack, The Verge or CNBC have reported extensively about it. And there is a lot of buzz around this new service, especially within the Open Source and Free Software world. Not only by its developers, but also among its supporting lawyers and legal experts, although the actual news is not that ground breaking, because it is not the first of its kind. Similar ML-/AI-based offers like Tabnine, Kite, CodeGuru, and IntelliCode are already out there, which have also been trained with public code.

Copilot currently is in “technical preview” and planned to be offered as commercial version according to GitHub.

Illustration: GitHub Inc. © 2021

The core of it appears to be OpenAI Codex, a descendant of the famous GPT-3 for natural language processing. According to its homepage it “[…] has been trained on a selection of English language and source code from publicly available sources, including code in public repositories on GitHub”. Update 2021/07/08: GitHub Support appears to have confirmed that all public code at GitHub was used as training data.

GitHub is the platform where the majority of source code of the global Open Source community has meanwhile been accumulated: 65+ million developers, 200+ million repositories (as of 2021) or 23+ million owners of 128+ million public repositories (as of 2020). Alternatives to it have become scarce as long as you do not want to host it on your own.

Great, in what amazing times we are living in! Sounds like with Copilot you do not need your human co-programmers any longer, who assisted you during the good old times in form of pair-programming or code review. Lucky you and especially your employer. On top you will save precious time because it will help you to directly fix a bug, write typical functions or even “[…] learn how to use a new framework without spending most of your time spelunking through the docs or searching the web”. Not to forget about copying & pasting useful code fragments from Stackoverflow or other publicly available sources like GitHub.

At the same time, two essential questions arise, in case you care a bit about authorship:

  1. Did the training of the AI infringe any copyright of the original authors who actually wrote the code that was used as training data?
  2. Will you violate any copyright by including Copilot’s code suggestions in your source code?

Let’s not talk about another aspect that GitHub mentions in their FAQs – personal data: “[…] In some cases, the model will suggest what appears to be personal data – email addresses, phone numbers, access keys, etc. […]”

Continue reading GitHub Copilot – Your AI-powered accomplice to steal code?

The impact of Open Source within the European Union

The results of the Open Source Impact Study tasked by the European Commission have been widely discussed mainly because of its numbers. Though being announced just now, the study identified for the year 2018 a contribution of 0.4% to the GDP worth EUR 63 billion by FOSS, if measured by the increase in commits. 10% more contributors would even raise the GDP of the European Union by 0.6% (EUR 95 billion). The overall cost-benefit ratio is estimated with at least 1:4.

But it gets even more interesting, when looking into the results of the accompanying survey covering about 900 stakeholders (mainly companies) from all around Europe.

For them, incentives for using and investing in Open Source have been, sorted by relevance:

  1. finding technical solutions
  2. avoiding vendor lock-in
  3. carrying forward the state of the art of technology
  4. knowledge creation

As benefits they have seen:

  • support of open standards and interoperability
  • access to source code
  • independence from proprietary providers of software

Within the participants the cost-benefit ratio has been estimated even with 1:10.

Quite some news outlets have reported about the presentation of the study’s findings at the OpenForum Europe Policy Summit 2021, though the final report to the Commission is still pending.

English: “How much are open-source developers really worth? Hundreds of billions of dollars, say economists” by Daphne Leprince-Ringuet
German: “Studie: Open Source trägt 95 Milliarden Euro zur EU-Wirtschaftskraft bei” by Stefan Krempl

Update 2021/02/15 – Netzpolitik.org hat heute auch ein Interview mit dem maßgeblich an der Studie beteiligten Innovationsforscher Knut Blind veröffentlicht: “Open Source braucht öffentliche Finanzierung” von Alexander Fanta

Update 2021/09/06 – The full report has now been published: “Study about the impact of open source software and hardware on technological independence, competitiveness and innovation in the EU economy”.

Virtual Conference Experiences

The current circumstances also forced conferences (those gatherings with really large audiences) completely into cyberspace. Some sticked with traditional approaches to stream talks via off-the-shelf videoconferencing applications and built upon the integrated very limited interaction features offered by these poor proprietary tools. Others have gone complete new ways and brought fascinating and well working concepts on how to still successfully connect the crowds to enable lively conversations and facilitate the exchange of knowledge and experiences in a distant environment.

Let’s start with rc3 and its virtual conference venue in form of rc3 world, implemented with Work Adventure. In a pixel-2D-adventure-style you could walk around the area and as soon as you are approaching other characters, a live audio and video stream with those humans or other live forms controlling the character would open. Limited to 4-5 persons at a time, it allowed you to talk directly with each other – face to face. Due to the limitation of participants you were still able to have a working conversation.

Somehow you needed to get used to having an unexpected and sudden interaction with one and another – on live video, but still it brought back the heavily missed opportunity to get in personal touch with other participants who are sharing possibly similar interests.

rc3 world (screenshot by derstandard.at)

The FOSDEM 2021, the worlds biggest conference on Free and Open Source Software usually taking place in Bruxelles, had for me a very convincing overall concept. The organizers and infrastructure artists have done a tremendous job that allowed for the most impressive conference experience so far and for long. Naturally and purely based on Free Software, at its core matrix, element, and Jitsi.

How did it work and what was so great about it?

Presentations of specific areas of interest had been summarized in virtual rooms with a fixed agenda, like in most physical conferences. Participants logged into a chat infrastructure which represented the rooms by group conversations. You would simply join the room(s) that you are interested in and could start texting with each other and the speakers like on IRC. Talks had been recorded beforehand and where automatically started – by the computer (systemd) – at their scheduled time. Its audio and video were streamed right above your chat window. When the talk ended, the Q&As were streamed live for a fixed amount of time within that room until the next talk started auto-playing according to schedule. During that first part of the Q&A session of a talk, moderators where clarifying upvoted questions and comments from the chat and interacting realtime with the presenters. Those interested could then continue discussing with the speakers and further extend their conversation by switching to a separate room. So per talk you had a dedicated room for the second part of the Q&A that would open shortly after and even allowed anyone there to interact live via audio and video.

In sum that meant that you could check the schedule for topics you are interested in, connect at the announced time and be sure to really listen to that talk instead of watching tech staff doing mic checks or heavily delayed earlier talks whilst being unsure about if and when the one you came for would actually start.

In addition the highly valued Q&A and following backstage (and off the record) conversations could still take place without interrupting or being interrupted by the subsequent talk.

Just impressive and so useful! Thanks a lot to all who made this happen and work that well! These concepts are now here to stay, even when conferences will hopefully resume soon back in the physical world.

2021/02/15 – Updated link of [matrix] to point at the now available summary of their efforts for FOSDEM 2021.

Switching from Lightroom to Darktable on macOS

I started my digital photography life with a Nikon D80 and Lightroom 1.0 quite a while ago (2007). When Adobe stopped selling copies and only provided subscription options was one of the moments it became very clear that an alternative is needed. Let’s not talk about Lightroom CC, its unstable desktop app, and a recent user nightmare.

To be independent from the business needs of a company, the only option is to go for an alternative that is licensed under an Open Source license. With that preference in mind and if it is about RAW processing, you have the choice between digiKam, RawTherapee, and darktable.

I was following darktable since a few years. The 2.x versions have not really been working for me. In contrast the releases of 3.0 and 3.2 have been milestones in growing darktable into a serious and easy to use – not to say even more mature – alternative to Lightroom and it is time to do the final switch. Now or never.

To share it upfront: I did not get disappointed nor frustrated by this decision. I am just wondering, why the hell did I not switch earlier?

Continue reading Switching from Lightroom to Darktable on macOS

Yet another Open Source Organization?

Google just made some news – and controversy – with their ‘independent’ corporation The Open Usage Commons Foundation. Possibly some kind of 501(c) non-profit organization, we don’t know yet.

It has been instantiated for the sole purpose of trademark management (and enforcement?) for Open Source projects, who are said to be not well positioned to care by themselves. For a start Google assimilated their own projects: Angular, Istio, and GerritCode Review. Own Projects? Oh well, at least for Istio – that was co-developed with IBM – they now clarified who has ownership of its trademark.

In their introduction statement they claim: “[…] Accordingly, a trademark, while managed separately from the code, actually helps project owners ensure their work is used in ways that follow the Open Source Definition by being a clear signal to users that, “This is open source.” […]”

Josh Simmons, the president of the Open Source Initiative (OSI) maintaining the referenced definition has a diplomatic statement to that, which also serves well as a summary: “Of course, OSI is always glad when folks explicitly work to maintain compatibility with the Open Source Definition. What that means here is something we’re still figuring out, so OSI is taking a wait-and-see approach.[1]

Or is this yet another project for the Google Cemetery because the Open Source community is not that into trademarks as cooperations are?

There are more detailed summaries and discussions:

GPL compliance and the persistent cancer theory

In the golden age of Open Source compliance offerings, one of the key marketing argument still appears to be: “The General Public License (GPL) is sooo risky. In case of GPL infringement, you will have to release all of your code – speak your intellectual property (IP) – under the same terms. Take our license scanner as we are the best to protect you against such nightmares.”

That statement simply is not correct. But very effective if you want to sell your services. Which company wants to be forced to release its valuable IP into the public only by not following specific license terms?

This myth was supposedly framed by Steve Balmer of Microsoft who once said back in 2001: “The way the license is written, if you use any open-source software, you have to make the rest of your software open source. […] Linux is a cancer that attaches itself in an intellectual property sense to everything it touches. That’s the way that the license works.”

His general understanding of one of the basic principles of Free Software and the GPL – reciprocity – speaks of great intellectual power. However this muddle-headed theory in total is utterly wrong but still persistent today serving as one of the main arguments to sell license compliance offerings.

Even infringing the terms of the GPL will never force you to put your own source code under the same license. Simple as that.

Sure, in the worst case you have violated a software license. In this aspect there is no difference between the GPL or any other even proprietary license. Copyright infringement claims are caused by

  • the actual violation of the license and
  • the unlicensed use of software.

You have to cope with its consequences. Legal remedies are

  • punitive damages and
  • injunction to not distribute your product any further.

Not more, not less.

Continue reading GPL compliance and the persistent cancer theory