Microsoft Did It Again, SFC Urges Developers to Quit GitHub

Microsoft’s new service for automatically writing AI-based code, Copilot, has sparked outrage in the Open Source community.

“Microsoft loves open source.” So much has been put on this slogan recently, only to change the Open Source community’s perspective toward the Redmond company.

And while Microsoft was no longer demonized as the worst thing that could happen to the Open Source, certain of the Redmond tech giant’s tactics remained regardless of the times.

It must be said unequivocally, now and forever, that Microsoft loves open source! However, with one additional qualification: when it can generate a profit from it.

While this may appear to be perfectly acceptable from a business standpoint, it is quite the opposite regarding moral violations. And Microsoft did it again.

GitHub Copilot Uses Open-Source Code and Strips Credit

As you know, Microsoft acquired GitHub in 2018 for more than seven billion dollars. In reality, GitHub is the world’s largest repository of open-source code.

At the heart of the problem that has blown up the Open Source community in recent days is the GitHub Copilot service. It’s a code writing assistance tool driven by artificial intelligence (AI) that the company just unveiled.

And now we get to the core of the issue. Copilot is powered by natural language text and openly available source code, including code in GitHub public repositories. And, of course, you must have a paid subscription or a special invitation from Microsoft to access Copilot.

To put it another way. You are a developer who has contributed valuable content to various GitHub projects over the years. Of course, everyone is welcome to use it.

Would you be satisfied if your code was used for profit by a closed-source app without giving you credit? In its classic fashion, this is where Microsoft tramples on moral boundaries.

In response to this action, the Software Freedom Conservancy (SFC), a non-profit that provides various services to open-source software projects, has stated its intention to leave GitHub and has asked others to do the same.

After the SFC last week reminded GitHub of its unanswered questions and refusal to participate in public discussions, GitHub responded that it would not participate in any public or private discussion because “a broader conversation seemed unlikely to change your (SFC’s) stance, which is why we (GitHub) have not responded to your detailed questions.”

Without a doubt, an arrogant and rude approach. In other words, “Leave if you don’t like it. We don’t mind.” But what Microsoft’s GitHub fails to realize is that the Open Source community is extremely sensitive to violations of software freedoms. And the snowball that is currently bouncing on top of the mountain could roll and become an avalanche.

The conclusion of all of this is obvious. For Redmond’s tech giant, there have never been and will never be moral borders that are not worth crossing in pursuing profit. So, they’ve done it again. Is anyone surprised?

I didn't have much money in the early 80s, so my H8 grew a board at a time. I had just started work at PacBell and my coffee buddies were Apple II owners. When the Lisa came out, I was impressed with the capability, but it was way beyond my budget. I took a trip to San Jose and purchased a simple graphics card that I could interface to the H8 bus. Straight device access at the register level and NTSC output. No software. I purchased a C compiler from The Software Toolworks for $80 and purchased the Foley and Van Dam graphics book (in C). Inside of a week, I was able to plot a 3D (X, Y, Z-axis depth) mathematical function. A Polaroid camera snapshot of the green only monochrome screen served as the literal screen shot. A couple years later, the UseNIX conference (Baltimore?) took pictures of the attendees and saved a good gray scale file of the picture. It was necessary to write a raster rendering application to covert the file to a viewable image. It worked. Not near as convenient as the graphics files we have today.

Who knows what could have been if everything was open source.

Another "hat" I wear now is software security. Sharing code is a wonderful way to be more productive, but it also means sharing bugs and vulnerabilities. New CVE (Common Vulnerability Enumeration) listings arrive almost daily. A single shared library with a vulnerability can expose hundreds of products built with the library. The price we pay for productivity and convenience is perpetual vigilance and regular patching when the flaws surface.

I'm currently moving multiple systems that live on dedicated servers into Docker containers using microservice patterns, kubernetes pods and helm charts to "compose" the systems. It's a very different paradigm and it has a new set of attack surfaces. We have 3 people dedicated to running security scans on each new "pod" and ensuring everything is as vulnerability free as possible.

Security has always been a pain and you’re right, open source gave script kiddies a new power.

I remember when Norton Antivirus actually shipped with a virus (I think a disgruntle employee). Which gave rise to the conspiracy theory that virus companies were generating viruses to increase profits.

On a different note, one of my favorite old time viruses was one that asked, “Have you ever dance with the devil in the pale moon light?” as it was formatting your hard drive in the background.

That’s impressive!

Nowadays I stick mostly to embedded work but back in the day I churned out some interesting software tools.. small compilers, program generators, parsing tools, web spiders... and various odd things. And if a problem involved pattern recognition then I was there...

We used to use small 286 mobos with modified bios chipsets as custom PLCs

I love this stuff :-)

My FRA contracts used PC104 running Linux or QNX with custom, stripped down kernels with BusyBox for utilities and custom code to drive the GPS, A2D board and CAN controller. The PC104 had an Ethernet to 802.11b converter with OLSR mesh networking in place to span up to a 255 car train.

The cars have accelerometers that support +/- 80g at up to 100 KSPS on the bearing adapters to perform spectral analysis of the cup/cone/cage/roller vibration. PIC18F6680 MCUs provided the CAN interface and a German supplier provided the CANopen embedded libraries. I designed and programmed devices to service a tri-axial accelerometer on each bolster for ride quality assessment, temperature sensors, a handbrake controller, an anglecock controller and a brake piston position sensor. Wilcoxon Research provided the accelerometers and did the CAD, fab and packaging of each controller. A dedicated PIC16F device monitored the 12 pole tachometer output of the Timken generator to determine car speed over the track and the threshold speed for making net charge to the system battery vs load. The 16F "pushed" the "power on" button and reported battery voltage.

I published a paper at the 10th Annual CANOpen Conference in Rome describing the Onboard Continuous Monitoring System. A related paper was published for the ASME/IEEE in Pueblo, CO a couple months later. More details than are suitable here. I love embedded and kernel work, but it is hit and miss on opportunities. Customers want systems moved "to the cloud". Lots of Java, Docker, kubernetes, Kafka, helm, keycloak and whatever UI framework is popular when the proposal is being written.

One of my co-workers was doing custom Xilinx devices to do DSP with sample rates in the 400 MSPS range. My tasking on that project was real-time stream compression. Never a dull moment :-)

On a different note, one of my favorite old time viruses was one that asked, “Have you ever dance with the devil in the pale moon light?” as it was formatting your hard drive in the background.

That's rotten. The one's that annoy me most are the ransomware viruses with continuous morphing viruses that easily evade the best AV software. The most damaging to hit my own machines came from Sweden. It burrowed a Window PE virus into the firmware of the keyboard controller on the motherboard. That machine is now Linux only. The virus goes active if a Windows OS boots.

My boss brought me a ransomware computer that infected all of his wife’s images. The ransomware maker screwed up, the maker provided two parts of the encryption key. It took about 24 hours of running calculations on the computer to get the final key, but I saved thousands of family images.

Long story short, the ransomware jerks fixed the vulnerability and rendered most of the fixes useless.

That sucks. Hopefully you rescued enough to matter long term. Both my boss and a high school friend contacted me with unusable laptops. The high school friend had a home load refinance inaccessible. The Kaspersky AV boots to Linux and cleans viruses off a Windows filesystem. That was pass 1. Pass 2 was with MalwareBytes. Between those two, the laptop was clean and refi info accessible. My boss was similarly infected and it was keeping him out of a critical proposal. Same tools rescued it.

My local FFL called when his "IT" guy was found stealing. All the 4473 records were in a database on a Linux machine. He was dead in the water. I downloaded a system rescue Linux DVD, booted it, mounted his filesystem and cleared the root password. Having done that, I booted, logged in and found a website pointing to a database. mySQL. Cool. A little poking around revealed the table structure. A little more and I exported all the critical data into a CSV. Copied to floppy, copied to his Windows laptop. Loaded in Excel. 100% recovery. He needed it as the ATF was coming for an inspection the next week. I left with some very nice ammunition that I would normally buy for myself. Items that weren't moving due to a fairly high price. My S&W 500 Magnun and 460 Magnum have some fine supplies for a future use.

CAN and ARINC work is always a little nerve-wracking since you are dealing with safety issues on every hand.

I’d sure hate to be the guy who’s firmware caused a disaster :-/

Imagine the hand-wringing and grief that must have resulted from the recent Boeing fiasco with the flight control on the 737 MAX ...

Working with biomedical devices is similar... you can leave NOTHING to chance.

It’s nice to be able to just create hobby projects now, no one is gonna be in mortal danger :-)

I enjoy playing with simple AVR projects and prefer DIP packages to avoid the hassle of having boards made... I often do dead-bug soldering, it’s a fright to look at but once the project is in the cute 3d printed enclosure who’s gonna know...lol

I was seeking very low power with high noise tolerance on the railcar. The PIC18F6680 was clocked at 4 MHz. The ride quality accelerometer routines were written in assembler to ensure the 120 SPS with boxcar averaging could fully process before the next interrupt arrived. Delivering the data result over the CAN bus was a leisurely event by comparison. The anglecock, cutlever and handbrake controllers were more entailed with actuator/sensor pairs. Unfinished was an enhancement using DigiMesh on XBee to permit a dynamic "consist" with remote activation of the onboard monitoring system and detection of A vs B end orientation on the rail. It matters when controlling the anglecock/cutlever for the A or B end of the car. The brake piston position sensor served to save time for the brakeman doing a visual inspection of each car to ensure the brake was disengaged before the train moved. Flat spots on a wheel from being dragged are not good. The thermal sensors in the bearing adaptors (inboard/outboard) for each bearing served as advance warning of a pending bearing burnoff allowing detection more repidly than the in-track sensors located every 10 to 20 miles. A burned bearing derailment avoided is a big economic win.

My FRA project died on January 20th, 2009 just after noon eastern time. Upon Obama's inauguration, I had to call the 46 people on the project to inform them. The funding was so abruptly cut that $1 million in specialized equipment was abandoned in a railyard in Joliet, IL. I had $80k in specialized development tools in my home lab. I packed up $50k of licensed software and sent to UPS back to the project office. Some of the hardware still occupies space in my basement. A year after the funds were pulled, my PhD colleague died from melanoma. He did the business development with FRA. I did all the EE/CS work. We subcontracted the physical board CAD/fab/packaging.

My wife got into creating little scenes with my dead bugs in the early 80s. She was a pretty good Pascal programmer on my OS/9 systems, but it wasn't her favorite thing. She earned a ham license to complement being a Master Falconer in a time when cellphones were in their infancy. Caring for a bird of prey is too time intensive for her now as a full-time police/fire/EMS dispatcher, so she moved on to collecting snakes and lizards. :-)

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.