VS Code inserting 'Co-Authored-by Copilot' into commits regardless of usage (opens in new tab)

[0]https://github.com/microsoft/vscode/pull/313725/commits/1e70...

To have it silently just start adding marketing copy to git commit messages is pretty bad. To have that added text not be visible to the user in the UI so they can remove it before commit is just much worse.

This kind of thing being released speaks to a greater disfunction over there. Not a good look at all and I am not a Microsoft or AI hater. But my commit messages are not where you move fast and break things

- a project manager vibe-coded the change without thinking it through at all

- the PR was reviewed by an LLM

- an actual engineer gave LGTM without really reviewing the changes, trusting the LLM

Did I get this right?

To me, “let’s add false attribution to every commit by default without informing the user” falls squarely into that category. I don’t think I’ve ever worked in an environment where something like that wouldn’t have been red-flagged in three seconds by anyone who took even a casual glance. I’d honestly be embarrassed if such a proposal even made it into a public pull request for my organization, nevermind that pull request getting merged.

> As folks mentioned here - many similar tools do this as well.

It's really doubtful they have the same behavior people are complaining about here: namely including the authored by Copilot statement when it wasn't used (or even enabled).

Here's one:

I think a senior sysadmin needs to sit you down in their office and have a very serious talk with you about the responsibility that comes with writing code other people run. I am serious. We used to have these talks with everyone who got sudo access. You shouldn't be shipping code if you don't understand the trust that is required of people in your position.

This isn't just about this "feature" being active when AI features are disabled, the way you mis-implemented this has resulted in it modifying the commit message with the user even seeing it! That is malicious behavior, not an innocent little feature "to make life easier".

I've fully switched off of VS Code to Kate now, which is faster and better behaved in most cases anyway. Bye.

- It wasn't our intention

- Our users asked for it [you'll have to take our word for it]

- Everyone else is doing it anyway

- Statement that I am reasonable and will be co-operative with the community but with conditions

That's a bingo!

Literally who?

I simply do not believe you

Only callous disregard for your users

> many similar tools do this as well

But since we have normalised that, it’s okay?

I think the default to on should also be reconsidered regardless. The assessment (co-authored by AI) may be valid but the assumption the user wants that advertising is exactly that, an assumption, and a dubious one at that.

What metric did Microsoft use to assess that VS Code users "expect" their commits to have unsolicited messages added to them?

> Obviously, it should not be on when disableAIFeatures is on and it should not be reporting changes that were not done by AI.

Did you discuss adding these messages with your legal department?

What is Microsoft's position on adding such authorship statements to the code Microsoft did not author?

Or is Microsoft stating that using LLM assistants makes Microsoft a co-author of the code?

Does Microsoft have copyright claims on the code if LLM assistants are used at any time during its creation?

Then make it an extension, not a IDE-behaviour thing. Is that so complicated, so difficult?

Does anyone (or any team) have ownership of the extensions/git/package.json file?

Can you expand on this? Who "expects" their code editor to lie about using Copilot?

This isn't enough. What was the _full train of thought_ for this? Why would it be added when AI isn't used?

Hopefully this answers some more of the questions raised here. It also incorporates a lot of feedback from this thread with respect to next steps (thank you!).

This goes beyond incompetence. Either you do not understand what important information a commit holds or what seems way more plausible to me is that Microsoft simply decided to try this out and see how people would react.

> There was no ill intent by evil corporation...

I will ever in my life buy that from Microsoft.

As a result I’ll be uninstalling vscode from all my machines, I’m tired of disabling things in vscode I didn’t ask for especially in regards to AI.

There are open source tools that clearly respect users more and have a track record of not doing these kinds of stupid things.

Be better.

I assume you are keenly aware that Windows, Office, and by extension, all of MS's customer facing products are not exactly regarded particularly well. Windows 11 specifically is a laughing stock today, even among folks who don't necessarily know computers, and a lot of that resentment is driven by 2 things:

• Pushing AI everywhere when no one asked for it. • Not reading the room and adding junk features that no one wants.

This change is both of those, again, wrapped up in another package. The timing of this is extremely bad for VS Code as a project as it looks an awful lot like, 'Microsoft is just shoving my AI junk into my stuff and failing to work on the features we actually want'.

I'm not taking a side on this either way as I will jam a fork into my eye before I use VS Code over VS proper and have no stake in this, but I'm just saying that the powers that be that are approving these kinds of changes are ~continuing~ to fail to read the room.

I'll add as someone who may be forced to consider VS Code in the future (Depending on if Windows unfucks itself before something critical breaks for me on W10), I would read something like that and I think rightly assume bad intent. I know VS Code and VS and Office and Windows are not the same team, but again, MS as a whole has a very serious optics problems and my read of this on the surface level is: "Oh, they tried to sneak in more AI junk, and when called out on it, they pushed it to the back, probably to make it a default again in some future update that they can hide it in". It just looks very, very bad at a time when no MS products have negative social capital to spend on this kind of stuff.

And another thing is, why was there absolutely no pushback from your part on any of the issues with the original PR, and why it was merged within hours in that state?

You are working for one of the largest companies on the planet. You push code that gets used by millions of people.

How on earth are you not thoroughly testing your changes??? How can something like this slip into a real build? Like, this is egregious.

I work somewhere that makes software for a lot of users (although not as many as Microsoft!). We also need to ship quickly. But we work on a 45-day cycle, with 15 of those days being dedicated to ensuring we didn't add any awful bugs (and fixing them ASAP before it goes to users - or reverting the change until it is ready).

I would expect Microsoft to have AT LEAST that amount of care. We can't trust that you are shipping software that even works anymore!

What other changes are going in that are broken in more subtle ways? It used to be that VS Code was rock solid, and any issues were likely third-party extensions - but now it's a crapshoot, and I can't be sure if crashes etc. are the fault of extensions or Microsoft themselves!

The VS Code team needs to use this mistake as motivation to lead the charge on making a quality editor. Not an editor that gets half-baked, untested changes pushed weekly. An editor that is dogfooded and where a mistake like this going to prod is unacceptable.

Because if you don't, people won't trust your editor anymore. Just like people have stopped trusting your OS, and now users are fleeing it in such numbers that the Windows team has recognized they have a problem and are changing course.

That WILL happen to VS Code and GitHub soon unless you actually start owning mistakes internally and fixing them before users find them.

Please elaborate on what "similar tools" claim that commits are co-authored by AI when the AI features are all turned off. You're trying to defend the theoretically correct version of this that you didn't make, not the actual version you did make.

> I am open to any (constructive) comments/suggestions

It's hard to take this seriously; you know exactly what you did wrong here and what you should have done instead. Testing that this doesn't happen when Copilot was not used is extremely trivial; if you're not lying about it being unintentional, the fact that it didn't occur to anyone to do it still says more than enough about what the priorities are here. At absolute best, the priorities of you and your team are so fundamentally wrong that it's impossible to trust any of you going forward.

ALL he wanted to tell me was that I should give VSCode another shot: "It's good now".

You can't blame the dog, only the environment surrounding the dog.

If more people from MS had the guts to actually talk to their users, I'd probably have a lot less to complain about at work ¯\_(ツ)_/¯

Hopefully there's some good lessons to improve the process, not just feedback for this single incident.

On the other hand...this feels like a situation where possibly you should not have said anything at all? The fact that you're on HN responding feels ill-advised to me.

So far this is what I've gleaned:

- Microsoft has PMs vibe coding against VSCode (by itself not necessarily a big deal)

- Microsoft PMs can vibe code against VSCode and get stuff shipped to production with only a single approval

That second one is a huge deal in my book. What I've learned now is that VSCode, a product with an enormous deployment base, is trivially compromised if the calls are coming from inside the house. Apparently all that has to happen for all users to be affected is a PM requesting you to "please approve my PR real quick, trying to get it in." And now there's a massive change in the wild, visible to many users.

Being familiar with big corp dynamics, this really worries me. This does feel like a not-well-thought-out mistake but I can easily imagine many other scenarios that would be far worse.

How can I trust VSCode going forward? How can I reassure my employer and fellow colleagues that it's safe to use? This is really a terrible look for Microsoft and very damaging to the reputation.

I feel bad for you the engineer and PM here because with the web being what it is, folks are casting blame onto you. That's missing the point since the issue is that MSFT even let this happen in the first place. Engineering processes need to be halted and re-evaluated basically yesterday. If something like this happens again it may not be possible to rebuild the trust at all.

I hate to say it but for myself this issue makes me strongly consider switching away from VSCode permanently, something I had not seriously considered before yesterday. Best of luck to everyone on the VSCode team.

But I'm an idiot every day too, so I can relate. We can only learn from these mistakes, keep it up!

Probably they thought the new generations forgot about how awful they were in the not so distant past.

I think they set it all on fire because greed got the better of them again.

If Microsoft were consistent, which isn't, power saving mode would disable AI features.

Fair that I didn't instruct it explicitly to make more pro-user choices, it just seemed to think slurping as much information into the backend was an default intention. Wasted a few more tokens to iterate on it to remove things, but it was IMO interesting enough that I finally submitted feedback around what I imagine is an interesting training problem.

Microsoft's decade-long PR rehabilitation has worked wonders for them.

It's the bourgeoisie dream: A means of production that also does the labor 24/7 and can't complain, infinitely spawnable. Theoretical slavery+, so of course they're throwing everything into the furnace for it.

Mmm... I think I missed that part.

When did this happen?

I’m sure Google cares very much about UX as a funnel into their ad brokerage, but was there some time when they cared about it in the user’s interest?

Maybe that magical moment when the results page showed the results first?

"Decades" is a stretch. There was a brief window around the Windows 7/8 era and then, like a dog returning to his vomit, they returned to their user-hostile bullshit. Windows 11 is the culmination of that, but Windows 10 was plenty bad. Remember how Windows 10 made Solitaire a subscription service? Sticking copilot into everything is just more of the same.

Are we talking about the same Google? They still haven't fixed Android gesture navigation after almost a decade.

That reminds me of a few years ago when Android phones replaced the behavior of "long press sleep/power button" from "shut down" to "ask AI about what's in your screen". Perhaps a manager got promoted somewhere for "raising AI usage" in Android phones.

If you look at the staggering amounts of money that have been put into the tech, this attitude becomes practically mandatory, in an inhuman sense. They have to get ROI, at literally any cost. And it shows.

VSCode hasn't yet been rebranded into VS CoPilot by pure luck.

I will fight against any Microsoft tooling being used at every company until I die. This is unforgivable.

Which literal 20+ year period was that?

I hated with a passion when people claimed "MS loves open source now". I feel vindicated.

If a corporation can do a 180° turn in one direction, it can do a 180° turn in the other direction just as fast. They did not understand that, either because they didn't want to or because they weren't smart enough to understand how incentives shape behavior.

The incentives or a corporation are roughly making money for "shareholders"[0], making money for the C suite, making money for managers.

[0]: = People who do none of the actual work but have enough money to use it to get more money which therefore goes to them instead of the people doing actual work. (Intentionally saying "get" instead of "make" because they don't "make" anything.)

TRYING to rehabilitate. only fools fell for it

Have we been using the same Google?

"Sent from my iPhone" appears in the authoring view, and you can delete it.

Co-authored-by: NEVER appears in the commit message UI - it is added without the user even seeing it.

I’ve always seen that practice of using the user as your recommendation lever without their consent as unethical.

This kind of tagline marketing works best with people people who aren't even aware that they're participating, and who aren't bothered to do anything different it even if they become aware.

The juice isn't worth the squeeze, so the marketing remains.

  Sent from my iPhone
  Downloaded from Demonoid
  Rusty n Edie's: The world's friendliest BBS 216-726-0737

It's interesting to see how communication, digital and otherwise, has evolved over time.

This is the author of the MR - https://github.com/cwebster-99 - A Product Manager at Microslop

I've routinely spoken on the uselessness, and oftentimes detriment of product managers in tech.

The dearth of leadership driving for vanity metrics like PMs writing code doesn't help either.

Juiced stats? No such thing, at least as long as stock number go up.

Your free commit today is brought to you by duff beer

ERROR! Merge conflict. Please drink a verification can.

Hard disagree. The "credit" it gets is through the form of charging my credit card.

Imagine for a moment that you are a company which hired a human developer to create your app rather than AI. In this case, the developer sold his or her right to credit by way of becoming a paid employee. All credit/rights/etc to the code become the ownership of Company, not the developer.

Anyone else remember the bill gates borg category on slashdot?

"git.addAICoAuthor": "off"

Look, if an agent writes the code and the commit message then adding a Co-authored-by by default is ok. Not even showing it before the commit is made is not, and adding the message when AI was just completing code is not.

and if they can get more revenue by less quality and cutting corners they will do it; see countless examples of such scandals in many industries...

It's very "Trust Me Bro". My workplace has already banned Zed after legal review purely on the lack of any controls over the collaboration feature that gets turned on the instant that you log into Github with it.

Man, I feel old.