Hold on ....

Are you saying all software hosted on github is infected with copilot? Or am I misreading the situation?

Your confusion is understandable since MS has called like 4 different products “Copilot”. This refers to the coding assistant built into GitHub for everything from CI/CD to coding itself.

All code uploaded to GitHub is subject to being scraped by Copilot to both train and provide inference context to its model(s).

Basically having your code in GitHub is implicit consent to have your code fed to MSs LLMs.

Copilot steals from all the code on github.

Gentoo is still around‽ But Arch exists and eMachines was discontinued like 10 years ago!

Excellent!

Gentoo is still a better distro, it underpins every ChromeOS device (they just do the compilation for you)

I know this is probably sarcastic but honestly Gentoo's great if you don't trust binaries by default. Nothing is an absolute guarantee against compromise, but it's an awful lot harder to compromise a source code repository or a compiler without anyone noticing (especially if you stick to stable versions) than it is to compromise a particular binary of some random software package. I trust most package maintainers, but they're typically overworked volunteers and not all of them are going to have flawless security or be universally trustworthy.

I like building my own binaries from source code whenever possible.

I don't necessarily disagree with the first sentence (fan of Gentoo; never used Arch), but the second sentence is not helping its case.

I don't have to love ChromeOS to acknowledge that it's a sold OS that's commercially viable and that's only possible because of the solid Gentoo base it's built on.

No, it isn't.

"Basically" your vibes aren't an actual answer. Businesses are not forking over millions to give away their code.

You can have conspiracy theories about it using the code anyway (I'm particularly confused about your use of the word "scrape" which tells me you don't know how AI training works, how hosting a website works, or how scraping works - maybe all three?) but surreptitiously using its competitors' code to train CoPilot would be a rare existential threat to Microsoft itself.

Does GitHub use Copilot Business or Enterprise data to train GitHub’s model?

No. GitHub does not use either Copilot Business or Enterprise data to train its models.

https://github.com/features/copilot#faq

Your Freudian slip is right, LOL.

Anyway, sure, Gentoo is a good choice to build on, but picking an evil thing as the example doesn't exactly endear one to your POV, emotionally speaking. Besides, SteamOS is based on Arch, so the notion that Gentoo is strictly "better" (not equal) to Arch on the basis of being used to make distros for commercial products isn't very persuasive.

I'm not saying you're wrong about Gentoo being good. I'm just saying the supporting argument is a weak one, and doubling down by saying that sort of thing is "only possible" with Gentoo is even weaker.

Like Meta and it's privacy rules, I bet they do even if they're saying they don't.

If you're gullible enough to believe an FAQ coming from Github themselves, then I have bad news for you.

FAQs are not legally binding. If you want to quote something, then do privacy policy and terms of service.

All code uploaded to GitHub is subject to being scraped

No kidding: That was literally my very first thought back in the days when I learned that M$ has taken over GitHub.

(Copilot did not exist then)

Just to add to what the other commenters said, the quote you highlighted doesn't even say what you think it does.

It says that Copilot data is not used to train the models, not that code uploaded to Github isn't used to train the models.

As an aside, your nitpicking of the term "scrape" and rant about how the user you're replying to must be ignorant is cringe, jsyk.

Genuine question from a longtime Linux user who never tried Gentoo - doesn't updating take forever? I used a source build of firefox for a bit and the build took forever, not to mention the kernel itself

It's in every enterprise and business contract signed with them. The FAQ was just the first result on Google. Its obviousness shouldn't even require that much. It's extremely clear how few of Lemmy's "technology" crowd have any contact with adult life.

You aren't paying enterprise subscriptions to use Facebook, and as bad as they are, Microsoft are not Meta.

"Gullible" is not a thing you can be when somehow has signed a contract with you... that's why contracts exist.

Depends on your system specs, but.... yes, generally speaking. There is a reason most people and most distros use binaries. Even Gentoo can use binaries for some stuff.

Are you going to suffer significant damage if your updates take forever though? What's the hurry? The number of times I have literally needed the absolute latest version of something installed right now are pretty damn minimal. The major exception is widespread, exploited zero-day remote-access vulnerabilities, but those are rare, and especially rare are ones that affect the exact versions and configurations of software that I am currently using and cannot reasonably just opt to "stop" using. Even so, there are usually other ways to block the network traffic, disable the offending part of the configuration, or otherwise mitigate the risk. Besides, there's nothing stopping you from literally just downloading a patched binary if that's what you need at that moment.

Patience is a virtue, and it's generally good for you. You don't have to be addicted to constant updates, but you do need to be thoughtful and understand how to build defense-in-depth.

It's not so much "I must have the latest version NOW" and more that while it was building my system load would spike from 0.1 to 7+ and everything ran like shit for like half an hour.

I'm a messy, impatient boy - I know my limitations!

There are a lot of binary packages now, and explicit bin versions of big ones like firefox or the kernel. Without using those an update after some months may take half a day. With them, even a weak laptop only takes a few minutes.

Gentoo doesn't want to push you into some compiled utopia, it's offering you the option of customizing or taking control where needed.
You can have your system use binary packages but then set one packet to source, download the source, modify it, write a patch, and have a package with a completely custom sourcecode modification that you can easily keep updating as normal at the cost of it now taking longer due to compiling from source.

Gentoo is more linux than anyhing. It is literally a penguin. What does Arch have?

Why are you referring all your answers to GitHub Enterprise and corporate contracts? Nobody here is talking about that, as the news is about an open source project. Public GitHub and GitHub Enterprise are fundamentally different.

You accuse others of responding based solely on "vibes," but you do exactly the same thing in the opposite direction. And yet, of all people, you're saying we don't act like adults.

The long update has the advantage of providing an opportunity to touch grass.

Users

touch grass is literally a one-liner, cmon bro

source: just trust me bro

Source: I'm employed

All of the responses are saying that Github reads all code. Github public and Github enterprise are products of the same organisation. Many are even saying they will consume enterprise data anyway despite contracts not to. As I said in my first response, there aren't many things that would ruin Microsoft's ability to operate but this is one.

What vibes do you think I'm going off?

Who are you employed by, I wonder?

go ahead and cite the relevant part of the github business "contract" lmao

A company that pays Microsoft to host code and would join the suit that would bury them if they used proprietary code to train models in breach of paid contracts?

1. How would you know?
2. How would you prove it?
3. It probably isn't even a breach of contract.

Gentoo does not have always the latest builds, not by default.

Updates depend on your amount of packages, hardware, and willingness to utilize that hardware for compiling.

I don't use DE, just dwm+dmenu, so my biggest packages are Firefox and LibreOffice, which can take 3+ hours with dependencies. KDE or Gnome would most likely add more.

But you can put number of cores for compiling into config. If you have your PC on most of the day, you can set it to 1 or 2 and you most likely won't even know about it.

Or, if you have 16 core CPU, let 14 do the compiling and you can browse the web with the remaining two.

This all assumes you have enough RAM as well. It's not as bad, but you should have at least 32GB.

The distro is smooth, way more than anything I've ever tried, and I'm not switching from it.

Everyone should follow

Did this few months ago. Everyone should do the same.

Oh my. The “you are all noobs, I am the only techie here, so I know it” argument is so unnecessary and makes you appear super entitled.

You obviously seem not to have an idea how all that shit works, where OpenAI and Microsoft scrape copyrighted material, which is illegal, to train their models. On top of that, in the US there are many laws where they can circumvent ToS if it helps national security, and we all know with Trump, that he will do everything to support his economy. So we end up with a situation, where the contracts say they will not use the data to train models, while doing this exact thing, and nobody ever will be able to prove it and the whole legal system in the US will protect the corporation. So good luck with that “lawsuit”.

But that is only when Microsoft would play by rules, which they don’t. Which no one does. So they just use the data to train the models, generating billions of value, and just wait for a lawsuit where they pay a fine of 100k.

This all comes to the conclusion that you are not just naive and inexperienced, but also an entitled asshole.

Dude AI companies do not give a fuck about the law. It's hard to prove a specific piece of data was used to train a model so they put everything in they can. There's literally a lawsuit about this, where Microsoft and others claim using code on GitHub to train is fair use.

As far as I can tell this lawsuit is about copyright infringement of open source code, but as we where talking about an open source project leaving GitHub because of this, that's what's relevant.

I myself would not be surprised if they could not withstand the urge to put more high quality code from enterprise users into their training data, but as they are not suing and we don't know their code, that's speculation.

I guess it's about copilot scanning the code, submitting PRs, reporting security issues, doing code reviews and such.

Here, you dropped your 'I use arch, btw'

why? github offers basically free hosting for code. as long as git clone works, everything should be fine?

reporting security issues

Is this not an advantage? If AI can find new security vulnerabilities reliably?

It often makes up non existent vulnerabilities. I think it was curl getting flooded with fake vulnerability reports which drowns out real reports, esp because it can take time to parse through the code or run the poc

Or it could introduce new ones :)

https://daniel.haxx.se/blog/2025/07/14/death-by-a-thousand-slops/

because "free" isn't free.

Mine too. More precisely: code uploaded to GH won't be yours anymore. IIRC there were changes to the TOS that supported this. But even if not, predicting the obvious doesn't make us prophets.

basically free

What does that mean?

as long as git clone works

Granted, I still use code form github.

But the person you're replying to meant that everybody who still hosts code on GH should gtfo.

And if you peek behind the curtains of software projects, many more made that move already a long time ago.