To me, “let’s add false attribution to every commit by default without informing the user” falls squarely into that category. I don’t think I’ve ever worked in an environment where something like that wouldn’t have been red-flagged in three seconds by anyone who took even a casual glance. I’d honestly be embarrassed if such a proposal even made it into a public pull request for my organization, nevermind that pull request getting merged.
The idea was to track AI-only changes and add the trailer when such changes were detected AND the setting was enabled. Obviously, we didn't want to attribute all changes to AI. There is a bug in change detection (which slipped through testing), which led to even non-AI changes being tracked. And thus we have this problem.
The PR linked here wasn't even implementing the feature, it was changing the default for the setting.
In another comment you say you caught it in testing and didn't think it needed fixing, which is it?
It just did though. Did you approve the PR without actually looking at the code?
The outlined story feels unfortunately very believable to me.
Teams need to push out the most number of features, and nobody stops even for a second to think about how a feature might affect other flows or other users not in the feature request.
It might have been quickly reviewed to check if the code does what it needs to do (add the coauthor note).
Do you think reviewers will think about unwanted effects, when they need get back to feeding their own poorly thought out and underspec’d features to their LLMs?
>The outlined story feels unfortunately very believable to me.
100% agree here - we seem to forget that most developers hate code reviews. I actually laughed out loud at the use of the word "discussion," it's so rare people want to get together and talk about changes. By the time the PR is up anything that stands in the way of merging and shipping is seen as a nuisance.
To my mind this whole debacle is not really the individuals fault or even the team's fault but the economic pressures that drive people into situations like this.
I think many people agree here.
This basically invalidates the entire premise that it was an innocent mistake. It's impossible for me to believe that you actually thought that people wouldn't care about 100% of their commits being attributed to Copilot even when it was never used. Either you're misconstruing what you caught with the testing beforehand or your entire development process is tainted, because there's no way that a non-evil corporation would see this default behavior and think that people would be fine with it. It seems far more likely you just thought you could get away with it.
this was malice or greed
Or that it was caught but didn't surface fully before release?
A helpful governance policy here might be that anything that mutates user content without opt-in consent requires a distinct sign-off or a double sign-off. If the goal is to prevent this from happening in future.
> This seems hard for me to believe. I expect more from Microsoft.
Those are some baseless expectations given the entire company's history
[0]https://github.com/microsoft/vscode/pull/313725/commits/1e70...
> "feel free to reach me directly (my alias @microsoft.com) or"
The docs for the function to interpret trailers even says this explicitly: https://git-scm.com/docs/git-interpret-trailers
> Add or parse structured information in commit messages
What metric did Microsoft use to assess that VS Code users "expect" their commits to have unsolicited messages added to them?
> Obviously, it should not be on when disableAIFeatures is on and it should not be reporting changes that were not done by AI.
Did you discuss adding these messages with your legal department?
What is Microsoft's position on adding such authorship statements to the code Microsoft did not author?
Or is Microsoft stating that using LLM assistants makes Microsoft a co-author of the code?
Does Microsoft have copyright claims on the code if LLM assistants are used at any time during its creation?
Literally who?
Now if we could also have comments inside the code ("BEGIN/END snippet by Copilot"), that would also be great!
I think the default to on should also be reconsidered regardless. The assessment (co-authored by AI) may be valid but the assumption the user wants that advertising is exactly that, an assumption, and a dubious one at that.
To have it silently just start adding marketing copy to git commit messages is pretty bad. To have that added text not be visible to the user in the UI so they can remove it before commit is just much worse.
This kind of thing being released speaks to a greater disfunction over there. Not a good look at all and I am not a Microsoft or AI hater. But my commit messages are not where you move fast and break things
The bad news is - where else have this happened in VS Code?
- A happy user of (n)vim
The problem is that it's only visible after committing, it doesn't seem to show in the integrated git view when you prepare the commit.
I noticed that as soon as you make a bug report/feature request on VSCode's repo, you instantly get someone's OpenClaw agent with an automated pull request that sometimes wants to change defaults in the main codebase
Looks like AI is really trigger-happy with that, with zero understanding or care that there's thousands of users affected and it's not just one individual's settings.json
Also, the hallucinated PR does not necessarily address the original issue whatsoever, just like this PR. It should have functionality to detect AI-authored code, but whoever made the PR skipped actually doing the hard work and just changed a default to always on, exactly the kind of misunderstanding you see with OpenClaw shotgun PRs
(Meaning the devs use it themself, that is great incentive to fix things)
This is one of the problems, but it is not only one. To be better, should be:
1. It should be visible in the UI for entering the commit message, to make it clear what it is doing.
2. It should not add such a thing if the Copilot is disabled. (It is mentioned by dmitriv and would hopefully be fixed soon enough)
I do not use Copilot nor any other LLMs nor VS Code, but if the problems are corrected then I think the feature would probably be reasonable.
What does that even mean? The git log exists. Do you mean they should shove the entire git log in the face of every user on every update?
Obviously this change was a massive fuckup, but that sentence makes absolutely no sense.
How else is a poor programmer gonna hit their KPIs and get that promo?
- a project manager vibe-coded the change without thinking it through at all
- the PR was reviewed by an LLM
- an actual engineer gave LGTM without really reviewing the changes, trusting the LLM
Did I get this right?
The PMs vibe-coding and having no idea what they're doing isn't even the main issue (although it is pretty bad).
The main issue is: how are the actual engineers supposed to "review" the slop? They probably report to the same PM or are at below in the org chart and might be evaluated by them. Not just at MS, but any company.
Such a conflict of interest would be detrimental to quality anywhere. You wouldn't build a bridge like this, nor should you software.
It's even more frightening if so. Meaning you really thought it's something users wanted.
Not saying you owe $BigCo better, but you owe this community better if you're participating in it.
Here's one:
I think a senior sysadmin needs to sit you down in their office and have a very serious talk with you about the responsibility that comes with writing code other people run. I am serious. We used to have these talks with everyone who got sudo access. You shouldn't be shipping code if you don't understand the trust that is required of people in your position.
This isn't just about this "feature" being active when AI features are disabled, the way you mis-implemented this has resulted in it modifying the commit message with the user even seeing it! That is malicious behavior, not an innocent little feature "to make life easier".
I've fully switched off of VS Code to Kate now, which is faster and better behaved in most cases anyway. Bye.
Seethe
This should not be vibe-coded by someone who has absolutely no idea about any of these things.
> As folks mentioned here - many similar tools do this as well.
It's really doubtful they have the same behavior people are complaining about here: namely including the authored by Copilot statement when it wasn't used (or even enabled).
That’s pretty close to “included when it wasn’t used (or even enabled)” since it’s opt-in by default and you have to explicitly say no. It’s not even clear where to turn it off, I just rely on the AI to figure out not to do it.
That is a very different case to VS Code which is something you can in fact use without Copilot.
(Both is not fine with me)
Then make it an extension, not a IDE-behaviour thing. Is that so complicated, so difficult?
I'd argue that this was extremely non-urgent and the fact that this got rushed so sloppily is a giant red flag about the priorities of you and your team. You asked about constructive criticism, and yet you're also acting like this is a one-off innocent mistake by only addressing what you've done to roll this back for now and address the immediate issue. I don't buy the premise that we could trust that this was a mistake made in good faith when it's something that you clearly should have known people would be so upset about if you got it wrong.
I simply do not believe you
I am not a legal, so can't comment on legal things. However, I have already responded elsewhere here that this feature has nothing to do with licensing or ownership and was added for those that want the attribution. I understand the desire to see anything Microsoft as bad and evil, but we are really just trying to make a better experience.
I'll respond to the third one, thanks!
> are you interested in my opinion on (n)vim?
The first comment is three short lines. One of them is the extremely reasonable and relevant question of where else this has happened in VSCode.
And you think that the commenter is wondering about your opinion on (n)vim? That is what you think they are interested in?
Could you just, like, ignore the signature if it is distracting you from the only other line that has a question in it?
> cwebster-99 / Courtney Webster / Product Manager at @microsoft working on VS Code and GitHub Copilot!
>> No description provided.
Stop making HN a worse place for everyone by being unnecessarily hostile. (and this comment is only mildly directed at you but rather at a bunch of people in this thread)
Anyone with a bit of software experience knows it’s easy to miss things when you are doing your own tasks + context switching + giving reviews. We should exercise kindness and empathy instead of projecting evil intentions.
Funny how these "mistakes" only seem to happen in ways that align with the agenda of the supposedly non-evil corporation.
Pretty sure no one thought “let’s add a lie to every commit and hopefully no one minds. Free Marketing yay!” at Microsoft.
They might not have intentionally done this (although it's honestly not clear), but they definitely didn't care enough to prevent it because it wouldn't have been hard at all. That's my point here; which bugs slip through and which don't implicitly conveys what their priorities are. I don't think it's particularly hard to infer what story this bug tells.
Only callous disregard for your users
> many similar tools do this as well
But since we have normalised that, it’s okay?
- It wasn't our intention
- Our users asked for it [you'll have to take our word for it]
- Everyone else is doing it anyway
- Statement that I am reasonable and will be co-operative with the community but with conditions
That's a bingo!
But I'm an idiot every day too, so I can relate. We can only learn from these mistakes, keep it up!
As a result I’ll be uninstalling vscode from all my machines, I’m tired of disabling things in vscode I didn’t ask for especially in regards to AI.
There are open source tools that clearly respect users more and have a track record of not doing these kinds of stupid things.
Be better.
Can you expand on this? Who "expects" their code editor to lie about using Copilot?
Does anyone (or any team) have ownership of the extensions/git/package.json file?
Please elaborate on what "similar tools" claim that commits are co-authored by AI when the AI features are all turned off. You're trying to defend the theoretically correct version of this that you didn't make, not the actual version you did make.
> I am open to any (constructive) comments/suggestions
It's hard to take this seriously; you know exactly what you did wrong here and what you should have done instead. Testing that this doesn't happen when Copilot was not used is extremely trivial; if you're not lying about it being unintentional, the fact that it didn't occur to anyone to do it still says more than enough about what the priorities are here. At absolute best, the priorities of you and your team are so fundamentally wrong that it's impossible to trust any of you going forward.
And another thing is, why was there absolutely no pushback from your part on any of the issues with the original PR, and why it was merged within hours in that state?
ALL he wanted to tell me was that I should give VSCode another shot: "It's good now".
You can't blame the dog, only the environment surrounding the dog.
That aside, corporations and groups don't make decisions. People do. We can understand and empathize with what led them to that decision (and sometimes we might be looking at the wrong person), but they're still responsible.
No one "expects" their tool to add pointless words to commit messages that serve literally no purpose other than to advertise your service. Please, stop trying to shove unforgivable corporate nonsense down our throats. This is disgusting, and this should be grounds for resignation if you actually had a moral compass.
If more people from MS had the guts to actually talk to their users, I'd probably have a lot less to complain about at work ¯\_(ツ)_/¯
Hopefully there's some good lessons to improve the process, not just feedback for this single incident.
This isn't enough. What was the _full train of thought_ for this? Why would it be added when AI isn't used?
On the other hand...this feels like a situation where possibly you should not have said anything at all? The fact that you're on HN responding feels ill-advised to me.
So far this is what I've gleaned:
- Microsoft has PMs vibe coding against VSCode (by itself not necessarily a big deal)
- Microsoft PMs can vibe code against VSCode and get stuff shipped to production with only a single approval
That second one is a huge deal in my book. What I've learned now is that VSCode, a product with an enormous deployment base, is trivially compromised if the calls are coming from inside the house. Apparently all that has to happen for all users to be affected is a PM requesting you to "please approve my PR real quick, trying to get it in." And now there's a massive change in the wild, visible to many users.
Being familiar with big corp dynamics, this really worries me. This does feel like a not-well-thought-out mistake but I can easily imagine many other scenarios that would be far worse.
How can I trust VSCode going forward? How can I reassure my employer and fellow colleagues that it's safe to use? This is really a terrible look for Microsoft and very damaging to the reputation.
I feel bad for you the engineer and PM here because with the web being what it is, folks are casting blame onto you. That's missing the point since the issue is that MSFT even let this happen in the first place. Engineering processes need to be halted and re-evaluated basically yesterday. If something like this happens again it may not be possible to rebuild the trust at all.
I hate to say it but for myself this issue makes me strongly consider switching away from VSCode permanently, something I had not seriously considered before yesterday. Best of luck to everyone on the VSCode team.
This goes beyond incompetence. Either you do not understand what important information a commit holds or what seems way more plausible to me is that Microsoft simply decided to try this out and see how people would react.
> There was no ill intent by evil corporation...
I will ever in my life buy that from Microsoft.
You are working for one of the largest companies on the planet. You push code that gets used by millions of people.
How on earth are you not thoroughly testing your changes??? How can something like this slip into a real build? Like, this is egregious.
I work somewhere that makes software for a lot of users (although not as many as Microsoft!). We also need to ship quickly. But we work on a 45-day cycle, with 15 of those days being dedicated to ensuring we didn't add any awful bugs (and fixing them ASAP before it goes to users - or reverting the change until it is ready).
I would expect Microsoft to have AT LEAST that amount of care. We can't trust that you are shipping software that even works anymore!
What other changes are going in that are broken in more subtle ways? It used to be that VS Code was rock solid, and any issues were likely third-party extensions - but now it's a crapshoot, and I can't be sure if crashes etc. are the fault of extensions or Microsoft themselves!
The VS Code team needs to use this mistake as motivation to lead the charge on making a quality editor. Not an editor that gets half-baked, untested changes pushed weekly. An editor that is dogfooded and where a mistake like this going to prod is unacceptable.
Because if you don't, people won't trust your editor anymore. Just like people have stopped trusting your OS, and now users are fleeing it in such numbers that the Windows team has recognized they have a problem and are changing course.
That WILL happen to VS Code and GitHub soon unless you actually start owning mistakes internally and fixing them before users find them.
I assume you are keenly aware that Windows, Office, and by extension, all of MS's customer facing products are not exactly regarded particularly well. Windows 11 specifically is a laughing stock today, even among folks who don't necessarily know computers, and a lot of that resentment is driven by 2 things:
• Pushing AI everywhere when no one asked for it. • Not reading the room and adding junk features that no one wants.
This change is both of those, again, wrapped up in another package. The timing of this is extremely bad for VS Code as a project as it looks an awful lot like, 'Microsoft is just shoving my AI junk into my stuff and failing to work on the features we actually want'.
I'm not taking a side on this either way as I will jam a fork into my eye before I use VS Code over VS proper and have no stake in this, but I'm just saying that the powers that be that are approving these kinds of changes are ~continuing~ to fail to read the room.
I'll add as someone who may be forced to consider VS Code in the future (Depending on if Windows unfucks itself before something critical breaks for me on W10), I would read something like that and I think rightly assume bad intent. I know VS Code and VS and Office and Windows are not the same team, but again, MS as a whole has a very serious optics problems and my read of this on the surface level is: "Oh, they tried to sneak in more AI junk, and when called out on it, they pushed it to the back, probably to make it a default again in some future update that they can hide it in". It just looks very, very bad at a time when no MS products have negative social capital to spend on this kind of stuff.
Hopefully this answers some more of the questions raised here. It also incorporates a lot of feedback from this thread with respect to next steps (thank you!).