Giving Up Github

I saw the other day this initiative [Give Up Github](https://giveupgithub.org/). I think it makes sense for open source or free source communities to think about their continued usage of Github. I won't repeat the article but just mention Copilot, the AI code completion tool that was trained on many public projects on Github and as of last week, became a commercial, for-profit product. There is no license attribution, there is no legal precedence, there is no public dataset release (which means we don't know how many or what projects were used) and there is the small percentage of cases in which verbatim code is generated. I realize how Github is central for my FOSS projects. In a sense, Github is a walled garden, enjoying a huge network effect. It will take an effort to move to other solutions. Personally, I'm going to try [SourceHut](https://sr.ht/), I think it's very promising. What do you think?

I ditched github a couple of months ago and set up my own gitea instance. Couldn't be happier.

Emacs is already not on github. Thus I'm not sure what this has to do with emacs?

You're focused on THE Emacs repository, which is hosted by the FSF. I'm talking about the Emacs community, comprising of thousands of plugins and extensions, with hundreds or more of contributors; looking at MELPA, it looks like almost all of them are on Github, as are my projects. It's something I want people to think about.

Fair enough.

A ton of emacs packages are hosted and maintained via github. Microsoft has the opportunity to effectively steal the "rationale" behind it.

I use sourcehut and like it a lot but if you're not too keen on changing your workflow style, https://codeberg.org is an excellent alternative. Much less buggy than gitlab.

We support other forges, and self-hosted repos. I understand the reservations about GitHub, and share some of them, but the Emacs community has also benefited enormously from it overall due to the ease of hosting and contributions.

And they wouldn't be able to do it if they were on, say, gitlab or sourcehut? They could just clone any FOSS repo regardless of were it is hosted. Or am I missing something?

You are certainly right. The home turf advantage is very limited and it is probably limited to some metadate of unproven usefulness (i.e., when people log in and log out,...) The point here is to express dissent. You can still steal my code from elsewhere and violate licenses, but my moving it elsewhere makes a stand that I disapprove of that. If I stay on github, I might be seen as implicitly endorsing what they do.

Where is gitlab buggy? I support thousands of users on Gitlab, with 99.999999999% uptime.

Agreed. I use emacs because emacs is awesome. This whole free software debate, esp on the clickbaity ai-on-gpl-is-gpl debate, belongs on a more appropriate channel. Please, mods, keep it focused on emacs and leave us one place without politics.

I hate to say it but Stallman was right :(

GitHub is not just about hosting, it’s about development on that site. If Microsoft just mirrors packages from somewhere hosting them for us, fine so be it

[deleted]

Most *major* OSS projects are *already* not on Github! The GNU project (which maintains Emacs, among *many* other things) won't go *near* Github! And they've been trying to dissuade people from using Github for ages! They, along with Linux, Apache, Mozilla, LibreOffice, Gnome, KDE, and *many* more, run their *own* sites where *they* have control! Many of these offer hosting to relevant third-party projects which aren't big enough to want to host their own sites. (Although these days, it really doesn't take much to host your own.) Since this is r/emacs, I'll point out that [https://savannah.nongnu.org/](https://savannah.nongnu.org/) is where the GNU project provides third-party hosting. (Free/Open Source only, of course.) It seems like it might be an excellent place to host Emacs package development. But if it's not to your tastes, there are *plenty* of other options!

Why do you hate to say he was right?

he commented on the github acquisition specifically?

Because he is usually right in predicting something bad.

I have the same setup, it's super nice. But… I don't really want to expose my Gitea to the open Internet, and I want my stuff to be discoverable. So I need some kind of public-facing mirror (at least). Gitea federation looks promising, but will need some kind of public-facing service. I keep meaning to set up a thing that mirrors the Gitea stuff to some public service, but haven't gotten around to it. Solving this conundrum will make me 100% happy with selfhosting Gitea, as opposed to the 95% happy I am now.

I can’t find it right now, but he state his opinion on GitHub. And it wasn’t very goods. Even before MS bought it.

I'm never thrilled about dealing with differences between open source licences and if github obscures them via copilot and make the lawsuit more difficult, I have no problems. But I agree that we should give up github just like many other cloud service. People should own their data. But it costs money and time to host your own service. I'd need multiple servers in multiple locations to keep the uptime.

FSF isn't into GitHub or Copilot

Sourcehut seems very cool. Personally I'm sticking with Gitlab for now since it is FOSS, self-hostable, has a very polished CICD system (kick's Microsoft Github's butt).

Pure git ftw

Apache, Mozilla, LibreOffice, Gnome and KDE all have official mirrors on github, so their software is available for harvesting by Copilot. There are numerous unofficial copies of Linux and various GNU project source code on github, including the anonymously submitted "emacs-mirror", so not using github also does not prevent their code from being harvested by Copilot.

Emacs is on github....https://github.com/emacs-mirror/emacs

In which way does it diminish value of the service Github provides for free to you? Is that service less valuable to you now when they make money out of it? Are you angry because of them making money, or because it changed something for you? If you put your code in the public, för public to fork and use it, are they somehow violating your intention by using your code in their own project? Depending on your license, anyone could take your code and do what they want with it, can't they? They can also clone projects out of other source repositories, so even if everyone migrated out of github, they could still clone and access all your, mine, gnus, and everyone else's code, can't they? I am not saying anyone should stay on Github or not, but since you ask what do we think, I am giving some more arguments to think about.

For Common Lisp projects, the CLF has been running https://gitlab.common-lisp.net for many years now. Sounds like gitea would be an alternative. Our sysadmin has been complaining about gitlab bloat lately. Although I'm heavily attached to gitlab-ci.

As I understand RMS, Gitlab is not much better then Github ethically.

https://tomlehrersongs.com/wp-content/uploads/2019/03/all-is-well.pdf

I always liked darcs so use darcshub instead. doesn't really help if you really prefer git though.

I started a slow migration when the initial Copilot noise began. My new and ongoing personal projects have moved to a combination of Sourcehut (started using this year) and Gitlab (used as secondary for years). Sourcehut is still in alpha but has been great so far for everything where I don't need heavy forge/social features. It's unixy and minimalist, which I prefer, subscription-based-first so somewhat less likely to turn parasitic, and has some cool bits like [built-in support for Guix and NixOS CI builds](https://man.sr.ht/builds.sr.ht/compatibility.md). Pure git is easy to migrate. Sourcehut in particular auto-creates new public repositories on git push so if you have a desired URL in your head you literally never have to leave magit: `M a` to add repo, (or `M C` to just reconfigure origin if you're all in) `P e` to select and push to it, and done. Make sure the access permissions are what you need, obviously. One unexpected but obvious in retrospect pain point: Many cold builds are slower after moving off of Github because they're pulling assets *from* Github servers where everyone's releases are still sitting and suddenly network speeds actually matter again. Good incentive to keep projects slim but a concern for big distributed things like the nix/guix ecosystems.

I think it is pretty easy to set up mirrors in Gitea instances. I have a couple with Github on my private gitea instance. However, I am also in the process of moving my public repos to sourcehut and have yet to confirm if it is as simple.

I agree. It's also a matter of convenience, I'm more likely to file an issue on a platform where I already have an account (bitbucket, gitlab, github). If I had to sign up for yet another cloud service, chances are that I won't report that bug. And then there's the ability to cross reference issues on github between completely different repositories. I find it a very "nice to have".

I few points to respond to. They were ALWAYS making money from Github, that's not the point. It's one thing offering free accounts to lure in paying customers. It's another thing taking your public code and creating a product out of it. You say "depending on your license" but the dataset was compiled with almost all of Github public repositories, ignoring their licensing completely. Exactly which repositories? we don't know because they don't publish any details about the data/model (been a year). Can someone just scrape public code repositories in the web and create a for-profit product? yes, but no one has ever done this, as far as we know. Everything happening now is new and unprecedented in terms of software legal issues. What Github is doing will set the precedent for others. Previously we had companies use our behavior to create and sell behavior products. This is simply doing the same thing with our public code. No one has ever done that before, as far as we know. And code has licensing issues that need to be accounted for.

The very nature of open source software leads to it being available for "being harvested by Copilot". The licenses are what should have stopped Microsoft from doing so.

First off not a lawyer, so I could be completely wrong. As for the Copilot thing, I'm pretty sure reading the code doesn't require GPL license. I do wonder if copyright claims could be made if you can prove it is basically copying your code. Probably not, they most likely change things enough to avoid that.

I was persuaded by this same article, thanks for sharing. It sounds like many people here prefer Gitea over Gitlab. Curious why

Yup, moving away from github may still be a good thing to do but this doesn't stop copilot at all.

There’s no network effect on hosting. SourceForge was minbogglingly big a quarter of a century ago and then everybody packed up and left. GitHub can see the same. If they are useful, people will stay, if not, they’ll pack up and leave. I don’t see the issue with autopilot by the way. That is the very nature of open source. The only advantage is that GitHub has the data locally but mirroring public git repos isn’t exactly rocket science. It’s all above board and to be expected that a free service needs some monetization.

> They were ALWAYS making money from Github Exactly. > It's another thing taking your public code and creating a product out of it. What is license on your public code? Did you use a permissive license like Mit or LGPL that lets anyone take your code and make a product out of it, or did you put some prohibitive license that stops them from using your code as it pleases them? Even GPL is not very prohibitive as long as they don't distribute your particular code. Observe that it is not me endorsing someone taking public code and not giving anything back, but just reminding of legal consequence and your expectations. > the dataset was compiled with almost all of Github public repositories, ignoring their licensing completely. Maybe you are correct, maybe not. I personally don't know. Do we have evidence? Do we have evidence that they have actually intruded on legal licenses in the way they are not allowed to? > we don't know because they don't publish any details about the data/model Exactly. Unless someone finds their code distributed by that "copilot" and it is against the author's license, we can't say they are stealing the code. > Can someone just scrape public code repositories in the web and create a for-profit product? yes, but no one has ever done this, as far as we know. Just because somebody has never done it before is not an argument for neither moral wrong nor good. > Everything happening now is new and unprecedented in terms of software legal issues. Indeed. The question is if they breached on someone's license and how it is to treat code generated by code generators, because that what copilot is, a code generator. I think personally it is the same as distributing someone's code, so I think it should obey same license, but I am not a lawyer. > Previously we had companies use our behavior to create and sell behavior products. This is simply doing the same thing with our public code. This is sort of similar in terms that we as GitHub users are the product in a way, but I don't think it is the same as analyzing user behaviors to sell advertising. They are actually taking our code and making a product of it. That is not different from me taking some public library, like say STL (standard template library) or say libCurl and creating a proprietary application that I sell. There are different views of how ethical it is. Observe that RMS/GNU stance is that proprietary code should come with the code and permissive license to use and distribute that code and changes. It does not mean that code should be "free, as in beer", or that end users can not make money with it. Now Github, the company, has given away code free as in speech, Atom and tree-sitter for example, but not everything is free as in speech. The service itself is "free as in beer" not as in speech, and that is what sticks in the eye of FSF for example, why they say it is unethical as a service. To sum up, it is actually not a problem they make a product and make money out of it, it is mostly that this product does not come with the source code. If they take our public code, use it in a product and don't give back source code of our (and their) product or don't credit authors, and license requires them to, or does not respect the license in some other way, *that* should be unethical and probably nonlegal and acted upon. I haven't personally tried copilot, so no idea how it works or how generated code look like. But I hope people who did, or do, will act upon and report if the breach against some license. Maybe someone will have to write another program that tests their code generator and recognizes patterns out in public software? :)

Very well put. By the way, I didn't write the word "steal" anywhere in the post or comments.

> By the way, I didn't write the word "steal" Oh I apologize for that. For some reason, I thought I read it yesterday. When I wrote the answer to the second comment today, I didn't read the original post. I'll edit asap. Thanks for the polite correction.

More than that, enterprise licensing. Most small/midsize companies will stick with github as their forge for commercial work and that means paid seats. Moving to something else means loss of revenue as those in charge choose to set up a gitea instance (or pay someone to host gitea or something else)

FWIW, tabnine has been doing this for many years. The only difference is tabnine discloses that they only scrape repos with "permissive licenses".

I’m now hosting my own instance o `cgit`. I will move all my projects to my instante and mirror them to Source Hut or another git service.

… but if the projects are publicly available, couldn’t GitHub or anyone else just clone them and be in the exact same position…?

I think you sort of missed the whole data privacy train by a good mile eh? Would you want strangers who will never see/meet you accessing all your bills and photos and documents, make copies of it, and then use the ideas and value in them to make profit? If you say no, does it mean you resent the fact that they make money off your private data? Things to think about. Money-making through mass appropriation of data is the new 'model' that silicon valley behemoths have now adopted for the past 25 years. And it is not ok. Just because you don't personally feel like it costs you doesn't make it ok. Hyper-capitalist thirst for wringing out value using morally questionable means by bribing lobbyists and running mass information-campaigns is not ok. You know what is ok? To protest, even if you are being paid by these corporations for your daily job. It's the least you can do. People protested in Nazi Germany, and they protested under communist Russia, why not under Capitalist America?

> I think you sort of missed the whole data privacy train by a good mile eh? In which way is a code generator trained on publicly avaiable data a privacy issue? Pleae inform me on what is private in a public code repositories. > Would you want strangers who will never see/meet you accessing all your bills and photos and documents, make copies of it, and then use the ideas and value in them to make profit? I have neither bills, documents nor photos on my Github account, more than a funny foto of me skydiving. If anyone can make money out of that one, good luck, I certainly can't. Would it made better if I met them in private life then? I don't udnerstand the argument. Why is it important if it is a stranger or not. And why would my bills be there? How come my bills come into play here? > mass appropriation of data > And it is not ok. Can you explain why it is not ok, and what is mass appropriated here? The code I uploaded to Github is free for anyone to use. I have given it away to you, to anyone else here, and by that logic even to Microsoft. I am certainly not able to make money from my elisp code, if someone else is, so kudos. > Hyper-capitalist thirst for wringing out value using morally questionable means by bribing lobbyists and running mass information-campaigns is not ok. Who is bribed here? What is mass information here? They made a code generator based on neural network search. I think it is a good idea in itself. The only problem I see is that they don't give the source code to it :). > To protest, even if you are being paid by these corporations for your daily job. Why would you accept pay from someone you are protesting against? Aren't you guilty by association if you take payed from them? I certainly didn't get payed by anyone for a single line of code I ever uploaded to Github, not did anyone ever force me or bribed me to upload anything there. I did it solely for my personal amusement and learning purposes.

In some discussions I participated om Emacs-devel he considers quite clearly Github and Gitlab as non-ethical due to their use of proprietary javascript code and the source code of the service itself is closed, at least in the case of Github. You can search emacs-devel mail archive about discussions of switching development to some public repos.

Self hosted Gitlab FTW. So good.

> You can still steal my code from elsewhere and violate licenses Are you sure they are stealing your code and violating the license? Under which liecnse did you publish your code? Stealing is taking something without permission. If you have puslished your code under some permissive license like MIT or LGPL than you have given it away for free to anyone, inclusive Microsoft. Or did you put some clause in your license that exclusively forbids them to use your code in certain ways?

Right here we go. So, if you put an appropriate licence on it, does the final product they make give you any claim to it or the profits derived from it? Does microsoft respect the licenses in the various data-pools they use? No. Furthermore, using your very disturbing and lopsided understanding of public and private - let us examine the situation once more. Suppose there is a piece of land that a community lives on. It is public commons. There is no property rights to it. Then, someone starts using that piece of land to grow wheat, and when asked, replies with - well, it is the public commons, we all have access to it and I am using it to grow wheat. I will obviously not share the profits with you because the technology to grow the wheat is mine. The only way you can say this is morally ok is if you concede that the public commons is essentially privately owned by the strongest member of the community who decided to grow the wheat (because if they were weak, you'd kick them out asap). What modern silicon valley has managed to do, is to convince people that the land was never common - it was, in fact, a free resource that anyone can use. I work in AI too. And if you read beyond the manuals for pytorch and keras, and beyond the blogs of tech-gurus, you will find there is a vast literature which explains where the data we feed into our pipelines comes from, and importantly, what are the legal grounds for its appropriation/harvesting (collection is a media-friendly term that is employed by the AI industry). Well, I don't know. If you think you should agree with your employers all the time or else you don't deserve your pay, I'd say you have pretty much denounced your powers of thought and any confidence in your own moral decision-making. They pay you for your time, not for your loyalty. Good luck.

> Right here we go. > Furthermore, using your very disturbing and lopsided understanding of public and private > If you think you should agree with your employers all the time or else you don't deserve your pay I think you should take time to actually reflect over what I write and say, and to reflect over your answers before you post a wall of text that address none of questions posed to you. I don't see how is it constructive to just post more of your subjective projections and assumptions about me, instead of actually trying to answer some of objections to your wrong assumptions from the very first comment. You are free to assume whatever your want and to rebel as much as you want against whomever you want. But I personally find your opinons to be bombastic strawmens and hyperbolic oversimplifications wihtout any substance to even be worth answering. I don't know what do you think about yourself, but I am not in the mood for endless discussions with armchair warriors on social media who have to hide behind anonymous accounts because they know what they say is ridicolous.

Goes two ways my friend. Read that wall of text.

> effectively steal the "rationale" behind it. What does this mean?

> effectively steal the "rationale" behind it. What does this mean?

> I don’t see the issue with autopilot by the way. That is the very nature of open source. A main thrust of the arguments against Copilot is that it includes not-Open-source code.

So don’t buy it :). I don’t use closed source so whatever they do whizzes right by me. Seems that all the kids these days use some editor from Microsoft that’s sorta open source but not really/completely, but I don’t need to care because since 18.54 I’ve been on the same editor ;)

I … won't? That doesn't change the objections to Copilot. That is "the issue" with it that you're failing to see. I'm not sure what the rest of your comment has to do with anything.

I wouldn't buy a stolen TV either but that doesn't mean I don't also think the thief should be arrested.

Did someone steal something here? I don’t see it.

I have objections to all closed source software. Copilot not really an exception there. That’s pretty much the only issue I see here.

I'll have to look into that. I saw a bunch of people raving about sr.ht, so I tried it and I don't understand the appeal at all.

I'm pretty sure that copilot doesn't propagate to its users the license encumbrances of the code on which it was trained that produced an answer... So, yes, a license violation is bound to happen basically the first time someone uses copilot to write closed source.

It means that copilot can effectively learn all that code and sell "the knowledge of it" to anyone who wants to write closed source, without any awareness of license encumbrances.

The Codepilot project claims to be able to use open source code to create derivative works while ignoring the original licenses. It's not "stealing" except by analogy but it is absolutely wrong.

It's much much easier for them to do the harvest when the code is stored on their own servers instead of spread across many other locations.

[deleted]

lol, okay.

That’s a legal claim and I’ll leave that to the lawyers. Between the OSF and the FSF there’s enough legal muscle to wrestle even Microsoft back into shape. Frankly, I would not know whether use for training machine learning models would qualify for any kind of use typically allowed (or not) under open source licences. It’s an interesting new use case and I’m sure that if it is not above board, things will change.

> learn all that code and sell "the knowledge of it" You can also search google for "open file ansi C", open the first hit on SX that shows how to open a file in C, learn that code and use knowledge to write closed source. That is what people do. It is just that copilot seems to effectively automate this for you, and them (Microsoft) would like to get payed for it, and don't want to give you the source code so you can't do it as easily yourself. When it comes to "harvesting" the code, nobody is forbidding you, or me or anyone else to do the very same "harvest" on the very same platform. Would be slightly more expensive due to additional network/broadband cost, but fully possible. It is not like a field of wheat that can be "harvested" once and than its gone for everyone else. The code is still there; potentially anyone can repeat what Microsofts did here. (in theory at least)

It still depends on if they generate code verbatim, aka copy-paste sort of, and on license of the code. Have you used it? How does it work? It sounds a bit too simplistic that Microsoft would risk a potentially $$$ lawsuit on such easy to spot blunder. Maybe they did it, I don't know, but sounds unlikely since there is lots of money involved in that project.

I think its the mailing-list driven development, but the mailing list web frontend is not polished right now so unless you participated in a discussion from the very beginning, you might lose out on some things like attachments.

> It still depends on if they generate code verbatim, aka copy-paste sort of, and on license of the code. Have you used it? How does it work? There are several GIFs floating around the internet that shows copilot pasting the code verbatim, it is not to hard find them. Sometimes, it even copies the license header.

Can't that be the old ones from the time they launched their first public demo? I remember back then it caused a lot of discussion. I would expect them to fix such blatant mistakes in a polished end product. With code they use verbatim, they should respect the license and author copyrights when applicable. It is pretty bad if they don't.

> Goes two ways No it does not. Because I haven't posted a bunch of logical fallacies and completely missed the topic of discussion (it is not about the privacy, but a product made on public source code FYI), and I haven't ignored your miss informed comment despite understanding that you are completely off-topic. > my friend A friend does not open by declaring me for an idiot in very first sentence in the very first comment. A friend also reflect over what I say, so I very much doubt that you are my friend in any way. > Read that wall of text. I did. Unfortunately, it was a waste of my time. I don't think answering your fallacies further would be a better use of my time either.

I believe the situation never really improved much.

Alright, can you confirm? It would be interesting to know.

I haven't seen many major bugs with gitlab, but some things are just broken. Comments left on a specific commit in a merge request magically disappear when the branch is rebased. Even Gerrit gets this right, and it has the worst UI of any git forge.

I very carefully did **not** make a legal claim in my comment, but a moral one.

The comments flow with the code, as in an update to a line of code will potentially affect any chatter around it. But I can see how that could become confusing. Gerrit, FUCK Gerrit... Grrr... My issues with Gitlab: - The fucking charge for dumb ass features that are a part of Rails. - Kubernetes, they try to be the co-ordinator for deployments, although their new Operator is a better approach. - Documentation around Gitlab CI, completely misses the point. - And their deployments all suck, Omnibus, Kubernetes, and Terraform, it's all too complicated for most companies to have to deal with without hiring a whole team.

I think the fact that Github became this major requirement in the (continued) development of software and that it is difficult to leave it is a major problem. A truly free software (including the development of said software) should not depend on resources or platforms that can be taken away at a whim.

Every time there's a forge discussion people suggest just using git like it's an alternative, I don't understand it. People don't use Github because they don't know how to make a server to host a git repo. Usually when the idea is challenged it morphs into "just do all the things a forge does yourself - write various scripts and utilities and integrate various components". Which could go for anything. It's like saying "don't use Emacs, just use nano and then extend it yourself to do everything you need that Emacs does".

This is all within the last month or so: * consistently lags by several seconds when typing in textareas * fails to detect my 2fa device, making it impossible to log in * serves up captchas that cannot be solved * every single "last updated" date on https://gitlab.com/technomancy is wrong except one; most by several years * it prompts me to add a kubernetes deploy to my codebase despite it being an elisp project * shows a "could not dismiss banner" message when I try to close a banner announcing a change to a service I don't use or care about * hangs forever when doing a git push to the repository I have encountered a lot more bugs than that over the 10+ years I've been using gitlab, but there's too many for me to remember all of them. The strangest thing is that every time I try to use it, I find a new bug I hadn't seen before. Most of them are minor but there are definitely a few showstoppers. Edit: I logged into the site again for the first time since making this comment and I found a new bug. It really is one new bug every single time, somehow. Anyway when I went to go to the second page in my repository listing, it showed me a blank white page instead.

> I don’t see the issue with autopilot by the way. That is the very nature of open source. The difference is in the application of consent, which is a factor that Microsoft seems fundamentally incapable of understanding the very basics of.

It's kind of like picking T-Mobile over Verizon (US telcom providers). They are both unethical corporations that will do anything to gain marketshare, but there are some temporary incentives in place for the underdog to treat their customers better so long as they are in the underdog position; meanwhile the one in the dominant position thinks they can get away with all kinds of heinous shit.

Can you put an nginx in front of it that's configured to return 4xx responses to all non-GET requests?

Honestly in my eyes the MS acquisition didn't change anything; it just made it more likely that people would notice problems which had already been true for years. Same with the ICE fascist collaboration. Same with the monumental consent fuckups behind copilot.

Interesting idea. GET requests only would certainly reduce the attack surface area, though I wouldn't assume it eliminates all possibility. It'd be moderately jank since it'd be offering HTTP and SSH clone possibilities, but SSH wouldn't work. And I'd have to use the same DNS name internally and externally, which is moderately annoying.

Huh... yeah actually come to think of it I have no idea how gitea plays with having an existing SSH server running on port 22; I guess I figured it would find a way to use the system opensshd but that would complicate the install since then it'd need a unix user which knows how to reach the gitea binary... Anyway just a janky low-effort idea.

Well, it would be \_nice\_ for Microsoft to ask for consent, but as far as I currently understand it, there's no need to do so. And, well, Microsoft and "being nice"... that'll be the day.

I agree that their lawyers are expensive enough that it might not be a legal issue; I'm talking about ethically. And obviously you shouldn't expect Microsoft to behave ethically, but some people said "it'll be fine; don't worry" after the acquisition; which was obviously foolish.

Microsoft behaving ethically. That will be the day. He last time they did that… oh wait, they started by ripping off CP/M. Never mind. Perfect score on being assholes :)

I run it in Docker, so it's easy to let it do its own SSH thing and remap to a different port externally. Maybe the solution is a primary internal Gitea with push mirrors to a public external "don't care if it gets hacked" instance, or a non-self-hosted one. I think that's a code solution only, so stuff like issues wouldn't work, but they wouldn't work without user registration anyway, so it might be as good as it gets for now.

But would make it super obvious that there must be copyright implications

This all sounds like user errors…

welp, you’re code is dope as fuck! Do you use git cli natively?

All of them?? How? It's possible given a very stupid user that the captcha and the 2fa ones could be user mistakes but the other ones are 100% sure bugs on their side. Unless you think "typing too fast" is a user mistake and that it's the user's responsibility to keep their typing speed under 40 WPM in order not to put too much strain on the site.

As much as I dislike the developer of sourcehut and think he's an overly-opinionated inflammatory ass, it's an example of "just use git" taken to its logical conclusion (then shared with others) more or less, and it's honestly quite nice, even if I imagine it's more difficult to attract contributors with the mailing list flow.

Technically speaking, corpus data licensing for machine learning is a relatively new frontier. I'm vaguely aware of Microsoft having published a couple of licenses they drafted for CC-style corpus data licensing, but it's worth noting that anything *not* covered by the terms of an existing license, by default, falls back to All Rights Reserved. I suspect, although I'm not certain, that GitHub has worked around this in some way with their TOS, probably something related to you allowing them to perform processing on any and all data stored in git repositories hosted with them. It was probably even already there prior to Copilot, as many of GitHub's features rely on processing the data in your git repos. Legally speaking, likely not much ground, especially against a company the size of Microsoft.

It's worth noting that it may actually be against GPL terms to mirror a project to GitHub unless you're the rights holder, given that you're breaking the license terms by agreeing to their TOS which is what's giving them the legal capacity to use repos hosted on GitHub as corpus data for Copilot.

But is it though? The TOS says: ​ >This license does not grant GitHub the right to sell Your Content. It also does not grant GitHub the right to otherwise distribute or use Your Content outside of our provision of the Service, except that as part of the right to archive Your Content, GitHub may permit our partners to store and archive Your Content in public repositories in connection with the GitHub Arctic Code Vault and GitHub Archive Program. It isn't the user who uploads GPL code that breaks the license or GitHub TOS, it is GitHub themselves. They may argue it is covered by their vague "as necessary to provide the Service, including improving the Service over time. " in the preceding paragraph that defines provision of the service, but I don't think this would be legally defensible given that CoPilot is a huge departure from the original intent of the code hosting service and not merely an improvement of the service over time.

It's hard to say -- I made the assumption that they had some provision in the TOS as I couldn't see a company like Microsoft doing this otherwise, but I'm honestly not certain at this point. Something a lawyer would need to check out.