The Software Freedom Conservancy (SFC), a non-profit focused on free and open source software (FOSS), said it has stopped using Microsoft's GitHub for project hosting – and is urging other software developers to do the same.

In a [1]blog post on Thursday, Denver Gingerich, SFC FOSS license compliance engineer, and Bradley M. Kuhn, SFC policy fellow, said GitHub has over the past decade come to play a dominant role in FOSS development by building an interface and social features around Git, the widely used open source version control software.

In so doing, they claim, the company has convinced FOSS developers to contribute to the development of a proprietary service that exploits FOSS.

[2]

"We are ending all our own uses of GitHub, and announcing a long-term plan to assist FOSS projects to migrate away from GitHub," said Gingerich and Kuhn.

We will no longer accept new member projects that do not have a long-term plan to migrate away from GitHub

The SFC mostly uses self-hosted Git repositories, they say, but the organization did use GitHub to mirror its repos.

The SFC has added a [3]Give Up on GitHub section to its website and is asking FOSS developers to voluntarily switch to a different code hosting service.

[4]

[5]

"While we will not mandate our existing member projects to move at this time, we will no longer accept new member projects that do not have a long-term plan to migrate away from GitHub," said Gingerich and Kuhn. "We will provide resources to support any of our member projects that choose to migrate, and help them however we can."

GitHub [6]claims to have approximately 83 million users and more than 200 million repositories, many of which are under an open-source license. The cloud hosting service promotes itself specifically [7]for open source development.

[8]

For the SFC, the break with GitHub was precipitated by [9]the general availability of GitHub Copilot, an AI coding assistant tool. GitHub's decision to release a for-profit product derived from FOSS code, the SFC said, is "too much to bear."

Copilot, based on OpenAI's Codex, suggests code and functions to developers as they're working. It's able to do so because it was trained "on natural language text and source code from publicly available sources, including code in public repositories on GitHub," according to GitHub.

[10]False advertising to call software open source when it's not

[11]NASA advised to study up on what open source, free software, and permissive licenses actually mean

[12]Open-source developers under corporate pressure to adopt less-permissive licenses

[13]Bruce Perens quits Open Source Initiative: 'We've gone the wrong way with licensing'

Gingerich and Kuhn see that as a problem because Microsoft and GitHub have failed to provide answers about the copyright ramifications of training its AI system on public code, about why Copilot was trained on FOSS code but not copyrighted Windows code, and whether the company can specify all the software licenses and copyright holders attached to code used in the training data set.

Kuhn [14]has written previously about his concerns that Copilot's training may present legal risks and others have raised similar concerns. Last week, Matthew Butterick, a designer, programmer, and attorney, published [15]a blog post stating that he agrees with those who argue that Copilot is an engine for violating open-source licenses.

"Copilot completely severs the connection between its inputs (= code under various open-source licenses) and its outputs (= code algo­rith­mi­cally produced by Copilot)," he wrote. "Thus, after 20+ years, Microsoft has finally produced the very thing it falsely accused open source of being: a black hole of IP rights."

Arrogant, subtle, entitled: 'Toxic' open source GitHub discussions examined [16]MUST READ

Such claims have not been settled and likely won't be until there's actual litigation and judgment. Other lawyers [17]note that GitHub's Terms of Service give it the right to use hosted code to improve the service. And certainly legal experts at Microsoft and GitHub believe they're off the hook for license compliance, which they [18]pass on to those using Copilot to generate code.

"You are responsible for ensuring the security and quality of your code," the Copilot documentation explains. "We recommend you take the same precautions when using code generated by GitHub Copilot that you would when using any code you didn't write yourself. These precautions include rigorous testing, IP scanning, and tracking for security vulnerabilities."

[19]

Gingerich and Kuhn argue that GitHub's behavior with Copilot and in other areas is worse than its peers.

"We don't believe Amazon, Atlassian, GitLab, or any other for-profit hoster are perfect actors," they said. "However, a relative comparison of GitHub's behavior to those of its peers shows that GitHub's behavior is much worse. GitHub also has a record of ignoring, dismissing and/or belittling community complaints on so many issues, that we must urge all FOSS developers to leave GitHub as soon as they can."

Microsoft and GitHub did not immediately respond to a request for comment. ®

Get our [20]Tech Resources



[1] https://sfconservancy.org/blog/2022/jun/30/give-up-github-launch/

[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Yr5xZXTJLEqY5Dr7Kc7m3QAAAFA&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[3] https://sfconservancy.org/GiveUpGitHub/

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Yr5xZXTJLEqY5Dr7Kc7m3QAAAFA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Yr5xZXTJLEqY5Dr7Kc7m3QAAAFA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[6] https://github.com/about

[7] https://github.com/open-source

[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Yr5xZXTJLEqY5Dr7Kc7m3QAAAFA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[9] https://www.theregister.com/2022/06/21/githubs_ai_code_assistant_copilot/

[10] https://www.theregister.com/2022/03/17/court_open_source/

[11] https://www.theregister.com/2021/11/05/nasa_software_licenses/

[12] https://www.theregister.com/2021/05/13/open_source_proprietary/

[13] https://www.theregister.com/2020/01/03/osi_cofounder_resigns/

[14] https://sfconservancy.org/blog/2022/feb/03/github-copilot-copyleft-gpl/

[15] https://matthewbutterick.com/chron/this-copilot-is-stupid-and-wants-to-kill-me.html

[16] https://www.theregister.com/2022/06/29/toxic_interaction_github_open_source/

[17] https://fossa.com/blog/analyzing-legal-implications-github-copilot/

[18] https://docs.github.com/en/copilot/overview-of-github-copilot/about-github-copilot#using-github-copilot

[19] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Yr5xZXTJLEqY5Dr7Kc7m3QAAAFA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[20] https://whitepapers.theregister.com/