Would be a terrible shame if lots of people opted out.

If you are a EU citizen you might also want to write a complaint to privacy@huggingface.co because they are collecting your personally identifiable information in machine-readable form which they are distributing to third parties.

  • abacabadabacaba@infosec.pub
    link
    fedilink
    English
    arrow-up
    60
    arrow-down
    2
    ·
    1 month ago

    The best way to opt out is by not using GitHub. Also opts you out of Copilot and a bunch of other stuff.

    • fruitcantfly@programming.dev
      link
      fedilink
      arrow-up
      14
      ·
      1 month ago

      Other git hosts are also getting scraped, and have had to implement counters because of it. For example, this is the kind of thing Codeberg shows crawlers. I’ve even seen people who self-host complaining about getting overloaded because of bots scraping their forge

      • PlexSheep@infosec.pub
        link
        fedilink
        arrow-up
        5
        ·
        1 month ago

        I’ve put Anubis before most of my website, including my forgejo instance. For the projects hosted there, which is not all, I can only hope that that’s enough.

        I like to have the visibility and CI of GitHub. But this sucks ass.

    • Eager Eagle@lemmy.world
      link
      fedilink
      English
      arrow-up
      6
      ·
      1 month ago

      note that former users would have needed to remove their GitHub data before August 2025 to not be in this dataset

    • DarkCloud@lemmy.world
      link
      fedilink
      arrow-up
      4
      arrow-down
      1
      ·
      1 month ago

      When I back something up, I save a copy and add “backup” to the name… Because I’m advanced.

      If I’m feeling really good and healthy, I’ll even put it on a usb stick.

    • qaz@lemmy.world
      link
      fedilink
      English
      arrow-up
      4
      ·
      1 month ago

      They also scraped some of my assembly code of which I’m pretty sure the latest version has a major bug. Let’s hope they don’t use these models to program my new PC’s bios.

  • SpaceCowboy@lemmy.ca
    link
    fedilink
    arrow-up
    44
    arrow-down
    1
    ·
    1 month ago

    A decade ago, if someone asked someone working on an Open Source project if they’d be ok with an AI reading their code and learning from it, they’d most likely say “yeah that sounds really cool!”

    Somehow the tech-bros have fucked up AI so much that something that should be really cool seems creepy, lame, and nefarious all at once.

    • FizzyOrange@programming.dev
      link
      fedilink
      arrow-up
      5
      arrow-down
      1
      ·
      1 month ago

      I mean they’d have been ok with it because tech bros were the ones automating other people out of jobs and never thought it would come for theirs.

      The level of AI we have now was impossible science fiction a decade ago.

  • chicken@lemmy.dbzer0.com
    link
    fedilink
    arrow-up
    25
    ·
    1 month ago

    A little bit infuriating since huggingface itself requires login to access a large portion of the content on their site

  • Prior_Industry@lemmy.world
    link
    fedilink
    English
    arrow-up
    17
    ·
    1 month ago

    When I hear this company’s name I can’t get the idea out of my head that it’s related to the face huggers from Alien.

  • Kissaki@programming.dev
    link
    fedilink
    English
    arrow-up
    14
    ·
    edit-2
    1 month ago

    We want to give developers agency over their source code by letting them decide whether or not it should be used to develop and evaluate machine learning models.

    crawled directly from GitHub and built to pre-train code LLMs with full-repository context

    Repositories that opted out are removed from the dataset before each patch release.

    “agency”

    Which AI company will not use v1 which has all of the data but will use later patch releases instead which have less data?

  • purplemonkeymad@programming.dev
    link
    fedilink
    arrow-up
    13
    ·
    1 month ago

    Am I alone in not wanting to put my username into that field? If they don’t have it will they then just decide that it’s now a good time to scrape it? Or are they going to record that it was searched?

    • qaz@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 month ago

      The right move is to private all repositories you are uncertain of that you want them to be preserved forever in an AI training set.

  • goatbeard@beehaw.org
    link
    fedilink
    arrow-up
    12
    ·
    1 month ago

    Since they stole my paper on ethics in computer science, maybe the model will learn to act better than its owners

  • qaz@lemmy.world
    link
    fedilink
    English
    arrow-up
    10
    ·
    edit-2
    1 month ago

    I just followed the opt out link and they’re making you open a public issue with a Markdown list with all your repositories you want removed.

    Surely there has to be a better way to do this (probably the point).

    Also why are they storing 4.71 TB in a Git repo? How are they going to deal with removal requests?

    EDIT: It seems like they’re manually responding to the issues, wtf? There’s a perfectly fine GitHub auth system that they could use to verify everyone’s GitHub account / repository ownership

    EDIT 2: This is apperently a collaboration between Hugging Face and ServiceNow, why is my companies IT ticketing system scraping all of GitHub?

    • Kissaki@programming.dev
      link
      fedilink
      English
      arrow-up
      4
      ·
      1 month ago

      with a Markdown list with all your repositories you want removed.

      The repo readme linked FAQ says

      You can choose to request either (1) all repos, or (2) you can specify select repos that you own to be removed.

      so “all of them” should be acceptable

    • qaz@lemmy.world
      link
      fedilink
      English
      arrow-up
      5
      ·
      1 month ago

      No, it seems to only be a subset of public repo’s.
      I have like 65 repo’s and only 13 were scraped. I don’t get why they specifically scraped those though. They don’t have the most stars, they aren’t the oldest or newest, not the ones with the most forks, nor do I see a pattern based on programming language.

  • Kissaki@programming.dev
    link
    fedilink
    English
    arrow-up
    5
    ·
    1 month ago

    Noteworthy: They crawled only the default branch HEAD and inlined all source content.

    • The file contents are included inline. The decoded UTF-8 source text is embedded directly in the dataset, so it is fully self-contained — you can start training the moment the download finishes.
    • It reflects the state of GitHub in August 2025. The corpus is a direct crawl of GitHub repositories at their default-branch HEAD, capturing roughly two additional years of open-source code compared to The Stack v2.