You Ask, I Answer: Disclosure of Code by Programmers and AI?

In today’s episode, you’ll learn why disclosing the use of AI in programming is not just an ethical consideration but a critical practice for protecting yourself legally and ensuring the security of your code. You’ll discover the potential risks associated with copying and pasting code from sources like GitHub and how using AI tools like ChatGPT introduces similar challenges. I’ll explain how proper documentation and transparency can shield you from legal issues and help maintain the integrity of your work. Tune in to gain a deeper understanding of responsible AI usage in programming and learn how to safeguard your projects in the ever-evolving world of software development!

https://youtu.be/3VvnM0oKpJM

Can’t see anything? Watch it on YouTube here.

Listen to the audio here:

Download the MP3 audio here.

Machine-Generated Transcript

What follows is an AI-generated transcript. The transcript may contain errors and is not a substitute for watching the video.

In today’s episode, Neil said, “What’s the difference between a programmer copying and pasting off of GitHub and a programmer using generative AI? Should programmers have to disclose when they use GitHub to grab entire subroutines that perform commercial code functions? What’s the difference between that and using AI? Why should we have to disclose the use of AI?”

Okay. So, two reasons, two reasons you want to disclose both instances. And I think it’s important to say I believe very strongly in disclosure, that you should say, “Here’s what’s in the box. Here’s how this was made.” We are not okay, a product anymore that doesn’t have ingredients on it. This, this spice blend had no ingredients, it just said “spices.” We would not be okay with that. Our government regulatory agencies also would not be okay with that. But that disclosure helps a consumer understand what’s in the box.

In the case of food, you’ve got an allergy of some kind, you need to know, yeah, there’s soybeans in there or sesame oil or wheat or whatever the thing is. If you are making code—Python, C++, Java, Swift, you name it—and you are incorporating other pieces of code, whether it’s by copying and pasting off of GitHub or Stack Exchange, whether it is made by ChatGPT, you absolutely should disclose it.

First, there’s a licensing reason. Software is generally covered by licenses. And the license gives you, tells you what you can and can’t do with a piece of software. If a programmer copies and pastes code off of GitHub, and they don’t disclose it and document it that they’ve incorporated code from somewhere else, that code they’ve incorporated may be under a very specific license. And that license may say, “Here’s what you can and can’t use it for.”

For example, the new public license imposes very strict conditions on companies reusing that code, the GPL code. If a company fails to comply with the license and fails to disclose that the software is under the GPL or portions of it on the GPL, they’re in legal hot water. They are in trouble. So, someone copying and pasting code from the internet may be in hot water. So, you absolutely want to disclose and document where you got your code from. If you’re getting it from ChatGPT, you want to disclose you got it from ChatGPT. So that if someone came back later and said, “I’m suing you because you copied this code, or you didn’t adhere to the terms of license,” you can say, “Nope, I used ChatGPT. Here’s the outputs. I have documentation of how I got these outputs and things. I did not use your code.” Now, it’s entirely possible that OpenAI software may have replicated that, but you at least have covered your bases to say, “Here’s where I got this from. I did not willfully infringe on your intellectual property.”

Reminder, by the way, I am not a lawyer. I cannot give legal advice. Please contact a lawyer, an actual attorney for advice specific to your situation.

Second reason you should disclose is lineage. About six months ago now—this is recorded in 2024—there was a little bug in SSH, the secure shell that is used in pretty much every computer on the planet in that library. There was a hack, a shadow hack with the XZ compression library, which was documented in a critical vulnerability and exploit notice, CVE-2024-3094. If you’re copying and pasting code from somewhere else, there is a nonzero chance you’re ingesting hostile code, you’re copying, pasting, potentially hostile code into your application.

You need an audit trail of where pieces of code came from, especially for security purposes, so that if it’s disclosed six months or 20 years later that this library, of this package, of this routine is, in fact, actually hostile, someone knows where it came from. And they can quickly excise it or use an AI to inspect it or whatever the case may be.

The bottom line of all this is that disclosure is important. Disclosure is important because it protects you. Disclosure is important because it protects you. It protects you from unnecessary risk because you’re no longer saying, “Yeah, I made this thing up entirely myself.” You’re saying, “No, I did this with help. Here’s the help that I got. Here’s where it came from. And here’s the lineage, the path, the chain of evidence for all the different pieces that you’ve, you’ve put forth.” That protects you, because you can disclose that maybe you didn’t have malicious intent. You can disclose that you didn’t willfully infringe on the copyright or, or because you’re adhering to a specific license.

You’ve got to document stuff. I don’t like documenting things, believe me. Ask anyone who’s ever worked with me—but especially my partner, Katie—how much I don’t love documentation. But nowadays, documentation is easier than ever. You can just hand your code, whatever, to a language model and say, “Document my code for me. Infer what all these different pieces do.” And then it goes through it, documents everything, you review it and say, “Okay, now this is production-ready because everything’s documented.” You’ve got to document things, especially in the age of AI, for legal reasons and for security reasons.

So, that’s the answer to Neil’s question. Thanks for tuning in. I’ll talk to you on the next one! If you enjoyed this video, please hit the like button, subscribe to my channel if you haven’t already, and if you want to know when new videos are available, hit the bell button to be notified as soon as new content is live.

You Ask, I Answer: Disclosure of Code by Programmers and AI?

Machine-Generated Transcript

Comments

Leave a Reply Cancel reply

Pin It on Pinterest