[growse]

This is not a suddenly emerging "gotcha".

This risk has always existed. It existed when they chose to open source it in the first place.

Time and time again we see the lesson being learned the hard way that "if your business value is your codebase, it's hard to build a business whilst literally giving it away".

[larodi]

> "if your business value is your codebase, it's hard to build a business whilst literally giving it away".

perhaps then it comes as no surprise that some very outspoken open-source proponents do not open-source their core business components. I can understand they do it in order to exist as a company, as busineses, but I don't understand why they have to endure being shamed for staying closed-source, while all their stack is open. many such companies exist.

and let's add to this all the fact that everything released in 2025 as open-source gets slurped by LLMs for training. so, essentially, you feed bro's models breakfast with your open-source, like it or not. in the very near future we'll be able to perhaps prompt a 'retell' of Redis which is both the same software, but written so that it is not.

in essence there seems to be now little reason to open-source anything at all, and particularly if this is a core-business logic. open-source if you can outpace everybody else (with tech), or else you shouldn't care about the revenue.

[miki123211]

A sufficiently capable LLM might be good enough to do cleanroom design on its own, with little to no human assistance. That would destroy the entire idea of copyright as it exists for software.

You need one agent that can write a complete specification of any piece of software, either just by using it and inferring how it works, or by reverse engineering if not prohibited by the license. You then have a lawyer in the middle (human or LLM) review it, removing any bits that are copyrighted. You then need another agent that can re-implement that spec. You just made a perfectly legal clone.

Cleanroom design is a well-established precedent in the US, and has been used before, just with teams of humans instead of LLMs.

I think some companies will be completely unaffected by this, as either the behavior of their code can't easily be infered just from API calls, or because their value actually lies in users / data / business relationships, not the code directly. Stripe would be my go-to example, you can't just reverse-engineer all their optimizations and antifraud models just by getting a developer API key and calling their API endpoints. They also have a lot of relationships with banks and other institutions, which are arguably just as important to their business as their code. Instagram, Uber or Amazon also fall into this bucket somewhat.

[dcow]

Humans can also do that, they’re just slower and presumably more expensive.

[eek2121]

Except that LLMs themselves are close to being killed off for the lack of clean room implementations themselves, at least here in the U.S.

[palata]

One can hope, but I don't think it will happen.

[bloomburger]

??????

[palata]

I agree with the fact that LLMs are big open-source laundering machines, and that is a problem.

I mostly see it as a problem for copyleft licences. Permissive don't protect the users in the first place, so...

[pbronez]

So who’s gonna sue an AI company asserting that all code they produce is GPL due to being trained on GPL code?

[growse]

How is training a model on GPL code and then having it write code any different to having a human read GPL code and then write code?

Unless there's a specific copyright claim over a specific piece of code that was copied and published, it's hard to see how the GPL has any relevance.

[bccdee]

Because, unlike humans, LLMs reliably reproduce exact excerpts from their training data. It's very easy to get image generation models to spit out screenshots from movies.

[growse]

That doesn't mean that all of the output from an LLM trained on GPL code is a derivative work (and therefore GPL'd too).

[palata]

I see that argument over and over, and I don't understand how people can consider it makes sense.

"My clipboard learned the code, just like a human would. So it should be fine to copy-paste anything and call it my own".

"How is killing a human any different to killing a computer?"

"If humans can vote, why couldn't computers vote as well?"

Can we start at "humans are not computers", maybe?

[growse]

> Can we start at "humans are not computers", maybe?

Sure. So it stands to reason that "computers" are not bound by human laws. So an LLM that finds a piece of copyright data out there on the internet, downloads it, and republishes it has not broken any law? It certainly can't be prosecuted.

My original point was that copyright protections are about (amongst other things) protecting distribution and derivative works rights. I'm not seeing a coherent argument that feeding a copyrighted work (that you obtained legally) into a machine is breaching anyone's copyright.

[palata]

I feel like nobody cares. It sucks, I know. Like climate change, biodiversity loss, the energy crisis.

Feels like we're pretty much screwed. Doesn't mean it's not a problem.

[motorest]

> I agree with the fact that LLMs are big open-source laundering machines, and that is a problem.

Why do you believe this is a problem? I mean, to believe that you first need to believe that having access to the source code is somehow a problem.

> I mostly see it as a problem for copyleft licences.

Nonsense.

At most, the problem lies in people ignoring what rights a FLOSS license grants to end users, and then feigning surprise when end users use their software just as the FLOSS license intended.

Also a telltale sign is the fact that these blind criticisms single out very precise corporations. Apparently they have absolutely no issue if any other cloud provider sells managed services. They single out AWS but completely ignore the fact that the organization behind ValKey includes the likes of Google, Ericsson, and even Oracle of all things. Somehow only AWS is the problem.

[palata]

> I mean, to believe that you first need to believe that having access to the source code is somehow a problem.

How in the world did you get there from what I said? Open source code has a licence that says what the copyright owner allows or not. LLMs are laundering machine in the sense that they allow anybody to just ignore licences and copyright in all code (even proprietary code: if you manage to train on the code of Windows without getting caught, you're good).

> At most, the problem lies in people ignoring what rights a FLOSS license grants to end users

Once it's been used to train an LLM, there is no right anymore. The licence, copyright, all that is worthless.

> Also a telltale sign is the fact that these blind criticisms [...]

No clue what you are talking about here.

[motorest]

> LLMs are laundering machine in the sense that they allow anybody to just ignore licences and copyright in all code (...)

No. Having access to the code does that. You only need a single determined engineer to do that. I mean, do you believe that until the inception of LLMs the world was completely unaware of the whole concept of reverse engineering stuff?

> Once it's been used to train an LLM, there is no right anymore.

Nonsense. You do not lose your rights to your work just because someone used a glorified template engine to write something similar. In fact, your whole blend of comment conveys a complete lack of experience using LLMs in coding applications, because all major assistant coding services do enforce copyright filters even when asking questions.

[palata]

> do you believe that until the inception of LLMs the world was completely unaware of the whole concept of reverse engineering stuff?

The scale makes all the difference! A single determined engineer, in their whole life, cannot remotely read all the code that goes into the training phase. How in the world can you believe it is the same thing?

> Nonsense. You do not lose your rights to your work just because [...]

It is only nonsense if you don't try to understand what I'm saying. What I am saying is that if it is impossible to prove that the LLM was trained with copyrighted material, then the copyright doesn't matter.

But maybe your single determined engineer can reverse engineer any trained LLM and extract the copyright code that was used in the training?

[necovek]

AI companies have not shied away from slurping anything available with complete disregard for the licensing of the material.

As such, code available is as much a boon to them as open source.

[palata]

And leaked proprietary code.

[vin047]

This is exactly what the AGPL was made to combat against. But open source devs still choose more permissive licenses first - presumably to attract corporate clients to use their product (and because devs are suckers to large corporate interests)

[palata]

This. They choose a permissive licence, proudly advertise it ("use us instead of our competitor because they are copyleft and we are not"), and then come whining when other competitors benefit from the very fact that they chose a permissive licence.

[_msw_]

There are different FOSS communities that hold different values. I come from the copyleft camp because I want to advance Software Freedom objectives for end-users. Others are more interested in advancing software developer freedom, and they find the obligations that are designed to advance end-user rights are unduly burdensome to the software developer. Articles like the one on the FreeBSD website [1] explain why they take a different position

I choose to believe that both of these sub-communities of the larger FOSS community are principled in their beliefs. I don’t see whining from FreeBSD folks about competitors, or for-profit companies using all the permissions they give with their choice of license.

[1] https://docs.freebsd.org/en/articles/bsdl-gpl/

[palata]

> I don’t see whining from FreeBSD folks about competitors

Sure! Then that's all good! I have nothing against the use of permissive licences (though I am on the copyleft camp too, obviously). Or put it in the public domain.

My problem is with those who do and then whine about it.

[_msw_]

Yeah, that really grinds my gears too.

It especially bugs me when company blogs call out “abuse” when they only exist as a company because others gave them the permissions needed to build a business on software they did not author themselves!

[palata]

> This risk has always existed.

Doesn't mean it was not a problem.

[growse]

The solution to the old problem of "what if someone uses my code to compete with me" is "don't open source your code".

This isn't complicated. It's trade secrets 101.

I'm being disingenuous though. Of course the bait-and-switch merchants know this, they're just banking on getting enough product momentum off the free labour of others before they cash in. That's the plan all along.

[plufz]

I think that is a little unfair. I don't know anything about the companies behind Redis and Elastic. But another possibility is that they want to make a good open source product and create some sort of business around it and find it difficult to make a waterproof moat. I'm sure that there are many other open source companies with the same basic strategy that are just more lucky, e.g. don't get AWS as competition.