AI Loophole #1; Your GitHub README.md

https://lemmy.world/post/16572074

AI Loophole #1; Your GitHub README.md - Lemmy.World

I used to be the Security Team Lead for Web Applications at one of the largest government data centers in the world but now I do mostly “source available” security mainly focusing on BSD. I’m on GitHub but I run a self-hosted Gogs (which gitea came from) git repo at Quadhelion Engineering Dev [https://quadhelion.dev]. Well, on that server I tried to deny AI with Suricata, robots.txt, “NO AI” Licenses, Human Intelligence (HI) License links in the software, “NO AI” comments in posts everywhere on the Internet where my software was posted. Here is what I found today after having correlated all my logs of git clones or scrapes and traced them all back to IP/Company/Server. Formerly having been loathe to even give my thinking pattern to a potential enemy I asked Perplexity AI questions specifically about BSD security, a very niche topic. Although there is a huge data pool here in general over many decades, my type of software is pretty unique, is buried as it does not come up on a GitHub search [https://github.com/search?q=bsd%20security&type=repositories] for BSD Security for two pages which is all most users will click, is very recent comparitively to the “dead pool” of old knowledge, and is fairly well recieved, yet not generally popular so GitHub Traffic Analysis is very useful. The traceback and AI result analysis shows the following: 1. GitHub cloning vs visitor activity in the Traffic tab DOES NOT MATCH any useful pattern for me the Engineer. Likelyhood of AI training rough estimate of my own repositories: 60% of clones are AI/Automata 2. GitHub README.md [http://README.md] is not licensable material and is a public document able to be trained on no matter what the software license, copyright, statements, or any technical measures used to dissuade/defeat it. a. I’m trying to see if tracking down whether any README.md [http://README.md] no matter what the context is trainable; is a solvable engineering project considering my life constraints. 3. Plagarisation of technical writing: Probable 4. Theft of programming “snippets” or perhaps “single lines of code” and overall logic design pattern for that solution: Probable 5. Supremely interesting choice of datasets used vs available, in summary use, but also checking for validation against other software and weighted upon reputation factors with “Coq” like proofing, GitHub “Stars”, Employer History? 6. Even though I can see my own writing and formatting right out of my README.md [http://README.md] the citation was to “Phoronix Forum” but that isn’t true. That’s like saying your post is “Tick Tock” said. I wrote that, a real flesh and blood human being took comparitvely massive amounts of time to do that. My birthname is there in the post 2 times, in the repo, in the comments, all over the Internet. You should test this out for yourself as I’m not going to take days or a week making a great presentation of a technical case. Check your own niche code, a specific code question of application, or make a mock repo with super niche stuff with lots of code in the README.md [http://README.md] and then check it against AI every day until you see it. P.S. I pulled up TabNine and tried to write Ruby so complicated and magically mashed, AI could offer me nothing, just as an AI obsucation/smartness test. You should try something similar to see what results you get.

The comments so far aren’t real people posting how they really feel. An agenda or automata. Does that tell you I’m over the target or what?

Look my post is doing really well on the cyberescurity exchanges. So to all real developers and program managers out there:

Recommend the removal of any “primary logic” functional code examples out of your README.md, that’s it.

PSA, Here to help, Elias

Lmao you got some criticism and now you’re saying everyone else is a bot or has an agenda. I am a software engineer and my organization does not gain any specific benefits for promoting AI in any way. They don’t sell AI products and never will. We do publish open source work however, and per its license anyone is free to use it for any purpose, AI training included. It’s actually great that our work is in training sets, because it means our users can ask tools like ChatGPT questions and it can usually generate accurate code, at least for the simple cases. Saves us time answering those questions ourselves.

I think that the anti-AI hysteria is stupid virtue signaling for luddites. LLMs are here, whether or not they train on your random project isn’t going to affect them in any meaningful way, there are more than enough fully open source works to train on. Better to have your work included so that the LLM can recommend it to people or answer questions about it.

you got some criticism and now you’re saying everyone else is a bot or has an agenda
Please look up ad hominem, and stop doing it. Yes, their responses are a distraction from the topic at hand, but so were the random posts calling OP paranoid. I'd have been on the defensive too.

[Our company] publish[s] open source work ... anyone is free to use it for any purpose, AI training included
Great, I hope this makes the models better. But you made that decision. OP clearly didn't. In fact, they attempted to use several methods to explicitly block it, and the model trainers did it anyway.

I think that the anti-AI hysteria is stupid virtue signaling for luddites
Many loudly outspoken figures against the use of stolen data for the training of generative models work in the tech industry, myself included (I've been in the industry for over two decades). We're far from Luddites.

LLMs are here
I've heard this used as a justification for using them, and reasonable people can discuss the merits of the technology in various contexts. However, this is not a justification for defending the blatant theft of content to train the models.

whether or not they train on your random project isn’t going to affect them in any meaningful way
And yet, they did it while ignoring explicit instructions to the contrary.

there are more than enough fully open source works to train on
I agree, and model trainers should use that content, instead of whatever they happen to grab off every site they happen to scrape.

Better to have your work included so that the LLM can recommend it to people or answer questions about it
I agree if you give permission for model trainers to do so. That's not what happened here.

Why do you think they need your permission to use information you posted publicly to train their models? Copyright isn’t unlimited, and model training is probably fair use.

"Your honor, we can use whatever data we want because model training is probably fair use, or whatever".

I don't know what's worse, the fact that you think creators don't have the right to dictate how their works are used, or that you apparently have no idea what fair use is.

This might help; https://copyright.gov/fair-use/

U.S. Copyright Office Fair Use Index

The goal of the Index is to make the principles and application of fair use more accessible and understandable to the public by presenting a searchable database of court opinions, including by category and type of use (e.g., music, internet/digitization, parody).

authors should have no say in how published works are used.
Authors shouldn’t be paid for their labor?
I didn’t say that. you’re making a leap of logic

Yes, I am. Logically, if an author creates something and cannot control its distribution, it is available to everyone at no cost, therefore the author will never see a dime for their labor.

This discounts the donation model, because in practice, it rarely pays the bills. It also ignores patronage, because I doubt that you want the creation of art to be dependent on the generosity of the rich.

Thus, it makes sense for the author to maintain certain rights over the product of their labor. They provide the work under their terms, e.g. requiring payment for a copy, and that relatively low cost to the average Joe provides the money they need to buy food, pay rent, etc.

you recognize two well known cases where copyright is not necessary to get paid. I don’t think there is even an argument at this point. have a nice day.
Yes, and I said they’re not feasible, because they’ve been tried in the past and present and found to not work very well. If you disagree, I’m happy to hear your thoughts.
you claim they are not feasible, but we know people do get paid through them, so you’re just lying.

Yes, they do get paid, but not a living wage.

For the donation model, most people doing that work that I’ve talked to have day jobs, and do the other work on the side. There’s a reason the donation platform buttons say things like “buy me a coffee” and not “pay my rent for the month”: it’s because the donations don’t cover rent.

For the patronage model, like I said, I don’t think anyone wants work like this to be controlled by a handful of rich people.

I’m still interested in hearing your thoughts if you have more than “nuh uh” and “you’re lying”.

only one person would need to be able to live on either model to disprove your claim. since that has definitely happened, you’re definitely lying.
Just because it works once doesn’t mean it’ll work all the time for everyone.
any time it has worked proves you are wrong. the top 50 patreons clear over $100k a year

Exactly, and since it certainly follows a long tail distribution, the rest of the 250,000 creators on patreon make a tiny fraction of that. For the vast majority of people, it doesn’t provide a primary income.

I’m not sure you want to rely on Patreon in any case, since it also relies on the retention of rights for profit. In your scenario, when they upload to Patreon, anyone involved could tell them to get fucked and pay the author nothing.

Exactly, and since it certainly follows a long tail distribution, the rest of the 250,000 creators on patreon make a tiny fraction of that. For the vast majority of people, it doesn’t provide a primary income.

this is true for the vast majority of storytellers and artists and musicians through all of history.

I’m not sure you want to rely on Patreon in any case, since it also relies on the retention of rights for profit. In your scenario, when they upload to Patreon, anyone involved could tell them to get fucked and pay the author nothing.

anyone could do that now. people still get paid.