[GNC-dev] GnuCash and Github

[john]

My number one use of GitHub, and IIRC the reason we mirrored it there in the first place, is to refer to and reference code when communicating on these lists, bug reports, and IRC. That's replaceable too by serving the repo ourselves or moving the mirror back to Sourceforge.

The fear is that Github's copilot will violate our author's copyrights by copying sufficiently substantial sections of code into a non-GPL project, stripping off the copyright and license in the process. I've seen claims that this has already happened.

In my completely non-legal opinion that makes every project that uses CoPilot GPL and the FSF should be suing all of them to publish their source code. But I think that's also true of any project whose developers read Stack Overflow or search on the web for solutions to their coding problems. The world has changed since the GPL was conceived and sharing source code meant sending me a blank DECTape and a paid mailer or downloading a tarball by anonymous FTP and code on the web--regardless of where--is findable by web-searching for a function name, and even if we don't provide web access someone else will. The GPL encourages that.

Plus the bird has flown. Sure, we could take down our Github repo. That won't affect the 673 forks, and some of those folks will get our code from somewhere and keep their repos up to date.

In fact it seems to me that the Software Freedom Conservancy is missing the point: The problem with Copilot isn't that it's encouraging proprietary-software developers to use open-source code in their projects. Although the GPL requires that using GPL code turns the project into a GPL one, most other FLOSS licenses don't. They require only that copyright statements are preserved and Copilots failure to do so is the real problem.  That's a matter for the courts; in order to get the matter before the courts somebody has to sue Github. Filing those suits on behalf of their client projects is the Software Freedom Conservancy's job, see https://sfconservancy.org/copyleft-compliance/. Since they have a history of suing over GPL compliance the boycott call suggests to me that they think they'd lose, either on merit or just because Microsoft has a bigger badder legal team. It's interesting that the FSF has nothing to say on their own, just a few links to articles: https://www.fsf.org/licensing/copilot.

Regards,
John Ralls



> On Nov 13, 2022, at 6:59 AM, Derek Atkins <derek at ihtfp.com> wrote:
> 
> Hi,
> 
> What are the features of github that we use/depend on?
> 
> - We don't use github's git repo except as a read-only version -- we COULD
> open up code for RO access.
> 
> - We don't use github issues; we have our own bugzilla.
> 
> - We DO use github pull requests; we could theoretically migrate to gerrit
> for review/management.
> 
> - We DO use github actions; we could theoretically migrate to Jenkins
> (with gerrit) for build/test/CI work.
> 
> Am I missing anything?
> 
> Having said that, and admitting I did not follow the link and read the
> complaints, what is the fear with their "use" of GnuCash?
> 
> -derek
> 
> On Sun, November 13, 2022 9:48 am, Geert Janssens wrote:
>> Some may have heard the rumblings around github semi-recently. The
>> software
>> conservancy is calling free software projects to seek alternatives. They
>> motivate this in much
>> more detail over here:
>> https://sfconservancy.org/GiveUpGitHub/[1]
>> 
>> In short, they claim github is a proprietary tool that's leveraging the
>> hosted free software for
>> their commercial purposes. In itself that would be acceptable as long as
>> it's done according
>> to the licenses of these free software projects. There have been several
>> situations where
>> that's not the case, "copilot" being the latest and most worry-some.
>> 
>> Is this something we as a free software project should think about and
>> possibly act on ?
>> 
>> Personally I don't like it at all that I chose to write code under a free
>> software license to
>> ensure my effort helps and benefits the free software ecosystem. Yet that
>> a commercial
>> company then decides to use my code to train an AI that's meant to help
>> build proprietary
>> software. The legal status of that is still very unclear and certainly not
>> what I intended my
>> code to be used for.
>> 
>> That is obviously only my personal opinion, but I wanted to express it as
>> starting point for a
>> wider discussion on this topic.
>> 
>> Is the golden cage that is github to developers really becoming
>> detrimental to real free
>> software principles ?
>> 
>> Should we do something about this ? Once hooked into the github ecosystem
>> it's pretty hard
>> to leave, as the sfc also acknowledges. They do offer initial suggestions
>> for alternatives, but
>> they are not at the same level as github currently.
>> 
>> Please share your views on this topic as well.
>> 
>> Regards,
>> 
>> Geert
>> 
>> --------
>> [1] https://sfconservancy.org/GiveUpGitHub/
>> _______________________________________________
>> gnucash-devel mailing list
>> gnucash-devel at gnucash.org
>> https://lists.gnucash.org/mailman/listinfo/gnucash-devel
>> 
> 
> 
> -- 
>       Derek Atkins                 617-623-3745
>       derek at ihtfp.com             www.ihtfp.com
>       Computer and Internet Security Consultant
> 
> _______________________________________________
> gnucash-devel mailing list
> gnucash-devel at gnucash.org
> https://lists.gnucash.org/mailman/listinfo/gnucash-devel