9 ms·

This feels like the modern version of 'Sent from my iPhone' but much more invasive. Git commits are legal and technical records. Falsifying who authored a piece

by yankohr 5mo ago

This feels like the modern version of 'Sent from my iPhone' but much more invasive. Git commits are legal and technical records. Falsifying who authored a piece of code just to pump up AI usage stats is a huge breach of trust and it is disappointing to see Microsoft prioritize branding over the integrity of the developer's log. I expect my IDE to record what happened, not what the marketing department wants people to think happened.....

polski-g 5mo ago
Good point. That fake commit addendum means that the entire commit contents would not be under copyright protection. AI generated code is not currently copyrightable.
- bdangubic 5mo ago
  Not that simple… this is great read: https://legallayer.substack.com/p/who-owns-the-claude-code-wrote https://legallayer.substack.com/p/who-owns-the-claude-code-w...
  - bjt 5mo ago
    Still if you're the lawyer on the side of the lawsuit claiming that the code is copyrightable, you really don't want that copilot attribution in the commit message muddying the waters.
    - bdangubic 5mo ago
      you actually do, as counter-intuitive as that seems. co-authored implies (and gives you room to argue) that you were involved in the process. hiding the fact that you did if proven otherwise (not that hard to prove in many cases if it comes to that) won’t be looking good. at my work, we are mandated to include AI attribution and I would say every well-run company should have same mandate
      - deleted 5mo ago
        [deleted]
- whattheheckheck 5mo ago
  Is thos actually decided yet? Closest thing was the image generation cases. What's your go to source for this?
- jiveturkey 5mo ago
  It doesn't mean that. A Co-Authored-By header isn't a legal signature or legal assertion of AI generated code.
  - VanTheBrand 5mo ago
    It’s certainly an assertion.
- hirvi74 5mo ago
  Outside this instance, how can one prove code was AI generated beyond a reasonable doubt? Also, do you (or anyone else) know how much AI/copied-code has to be modified for it to be considered independent? If AI generates code, and one just renames some variables/method signatures, then what?
  - tyre 5mo ago
    > how can one prove code was AI generated beyond a reasonable doubt? Subpoena the provider they use. Even if they don’t retain the full context, they have to save API calls for billing and analytics. If you’re clauding for the hour up to and after the commit, one can reasonably assume you built it with (if not exclusively by) AI.
    - skinfaxi 5mo ago
      > If you’re clauding for the hour up to and after the commit, one can reasonably assume you built it with (if not exclusively by) AI. That's not beyond a reasonable doubt.
  - graemep 5mo ago
    Reasonable doubt is required in criminal cases,most disputes about whether AI or human wrote code will be civil cases.
tln 5mo ago
Absolutely, messing with commits is more invasive than messages. It gets worse: "Sent from my iPhone" appears in the authoring view, and you can delete it. Co-authored-by: NEVER appears in the commit message UI - it is added without the user even seeing it.
- apexalpha 5mo ago
  My Claude Code just puts it in the commit which anyone can read before pushing. Is that not the case here?
  - adastra22 5mo ago
    I don't use git features in vscode, but from what I understand the user clicked some button to make a commit, typed in a commit message, and then hit "OK" and the editor called `git commit ...` in the background... after silently adding "Co-Authored by Microsoft Copilot" to the commit message. That's a little different than Claude doing the commits all by itself and happening to include an attribution line. Especially since, as it turns out, this was being done on clients that had all the AI stuff turned off. But even if that weren't the case, it'd still be wrong. Also you shouldn't be using Claude that way...
    - wallst07 5mo ago
      It's technically the same thing because a pre-commit hook can easily remove it. I did this with the very first versions of claude which didn't have a documented setting to turn it off, and kept it every since. It works with every single coding tool because it just looks for the same key word.
    - bbor 5mo ago
      Nothing wrong at all with separating out Claude’s work with commits! In fact, it’s preferable IMO — it lets people browsing the history identify code that was primarily written by AI.
      - 5mo ago
Gibbon1 5mo ago
One could argue that Co-Authored by Copilot means 'not under copyright'
- VanTheBrand 5mo ago
  Yeah the current guidance from US copyright office is that if it were said to be solely authored by copilot it would not be eligible for copyright. If it were said to be solely authored by human A (who happened to use co-pilot) the elements and arrangement of it not generated by co-pilot would be copyrightable. I’m not sure the copyright office has released guidance on attempting to register AI as a co-author I assume the registration would be rejected but you’d be able to re-submit as sole Human author.
  - graemep 5mo ago
    The Thaler case settled part of that: an LLM cannot be an author. The guidance says its case by and case I can find no indication separation of elements is critical. Its more how closely you guide and correct the AI https://www.copyright.gov/ai/Copyright-and-Artificial-Intelligence-Part-2-Copyrightability-Report.pdf https://www.copyright.gov/ai/Copyright-and-Artificial-Intell... You can go by US guidance if you only distribute the work in the US. Otherwise you need to he aware this varies elsewhere.
- Aurornis 5mo ago
  The headline literally says the line is being inserted regardless of usage, which makes it easy to argue that it’s entirely meaningless as an indicator of AI use at all.
  - Gibbon1 5mo ago
    If you can get AI to write your slop is it really socially valuable enough to justify copyright? Even before AI copyrighting software was questionable.
    - deleted 5mo ago
      [deleted]
Esophagus4 5mo ago
And also those early Spotify days where Spotify would automatically post what you’re listening to to your Facebook wall. I’ve always seen that practice of using the user as your recommendation lever without their consent as unethical.
- heisenbit 5mo ago
  My suspicion is that it violates the users copyright on their commit message.
  - rodw 5mo ago
    Technically (in the US at least) purely AI-generated content has no copyright, hence any copyright associated with the commit can only assigned to the human authors (or the entity they are working for). As I understand it neither Copilot nor Microsoft should have any actual claim of authorship (from a copyright/IP perspective). It's still quite problematic IMO
- delecti 5mo ago
  Those services always asked ahead of time though. And at the time, it was seen as cool, like a not-so-subtle "look at me, listening to music on this cool service".
deleted 5mo ago
[deleted]
Henchman21 5mo ago
I think it's kinda cute that you don't see it as an attempt to steal code by claiming they "co-authored" it. How long before they claim they can use any code co-authored by Copilot in training? How long before you see your own code, "co-authored by Copilot" as an output in a commercial product that YOU aren't making a profit from? Just a thought :)
visarga 5mo ago
That makes the bite less damaging - if everyone hax "Co-authored-by AI" in their commits less shame for it, just a normal fact of life now, not a sign of low quality.
- aDyslecticCrow 5mo ago
  It's either neutral useless information, or a sign of low quality. It's never positive. Its a sign that the developer didn't pay attention to what they committed. Like a spelling error, or forgetting to run the linter. If the IDE added "written with vscode" i would be equally furious.
  - Pay08 5mo ago
    According to the link, the message changing isn't visible to the user in any way (besides running a git log after the fact).
Pay08 5mo ago
I've never heard of git commits being used in a legal case, do you have any examples?
- alxndr 5mo ago
  I’ve had to talk to company lawyers about specific commits. Case was settled afaik
- tuetuopay 5mo ago
  I don't know if it's been tested in court, but that's the rationale behind the Signed-off-by lines the kernel requires in all patches sent. It's a way to tell the (legal) ownership of a piece of code.
yubblegum 5mo ago
It is designed to undermine any future disputes regarding IP and their "AI" being trained on our mind products.

by yankohr 5mo ago

polski-g 5mo ago

Good point. That fake commit addendum means that the entire commit contents would not be under copyright protection. AI generated code is not currently copyrightable.

bdangubic 5mo ago
Not that simple… this is great read: https://legallayer.substack.com/p/who-owns-the-claude-code-wrote https://legallayer.substack.com/p/who-owns-the-claude-code-w...
- bjt 5mo ago
  Still if you're the lawyer on the side of the lawsuit claiming that the code is copyrightable, you really don't want that copilot attribution in the commit message muddying the waters.
  - bdangubic 5mo ago
    you actually do, as counter-intuitive as that seems. co-authored implies (and gives you room to argue) that you were involved in the process. hiding the fact that you did if proven otherwise (not that hard to prove in many cases if it comes to that) won’t be looking good. at my work, we are mandated to include AI attribution and I would say every well-run company should have same mandate
    - deleted 5mo ago
      [deleted]
whattheheckheck 5mo ago
Is thos actually decided yet? Closest thing was the image generation cases. What's your go to source for this?
jiveturkey 5mo ago
It doesn't mean that. A Co-Authored-By header isn't a legal signature or legal assertion of AI generated code.
- VanTheBrand 5mo ago
  It’s certainly an assertion.
hirvi74 5mo ago
Outside this instance, how can one prove code was AI generated beyond a reasonable doubt? Also, do you (or anyone else) know how much AI/copied-code has to be modified for it to be considered independent? If AI generates code, and one just renames some variables/method signatures, then what?
- tyre 5mo ago
  > how can one prove code was AI generated beyond a reasonable doubt? Subpoena the provider they use. Even if they don’t retain the full context, they have to save API calls for billing and analytics. If you’re clauding for the hour up to and after the commit, one can reasonably assume you built it with (if not exclusively by) AI.
  - skinfaxi 5mo ago
    > If you’re clauding for the hour up to and after the commit, one can reasonably assume you built it with (if not exclusively by) AI. That's not beyond a reasonable doubt.
- graemep 5mo ago
  Reasonable doubt is required in criminal cases,most disputes about whether AI or human wrote code will be civil cases.

tln 5mo ago

Absolutely, messing with commits is more invasive than messages. It gets worse: "Sent from my iPhone" appears in the authoring view, and you can delete it. Co-authored-by: NEVER appears in the commit message UI - it is added without the user even seeing it.

apexalpha 5mo ago
My Claude Code just puts it in the commit which anyone can read before pushing. Is that not the case here?
- adastra22 5mo ago
  I don't use git features in vscode, but from what I understand the user clicked some button to make a commit, typed in a commit message, and then hit "OK" and the editor called `git commit ...` in the background... after silently adding "Co-Authored by Microsoft Copilot" to the commit message. That's a little different than Claude doing the commits all by itself and happening to include an attribution line. Especially since, as it turns out, this was being done on clients that had all the AI stuff turned off. But even if that weren't the case, it'd still be wrong. Also you shouldn't be using Claude that way...
  - wallst07 5mo ago
    It's technically the same thing because a pre-commit hook can easily remove it. I did this with the very first versions of claude which didn't have a documented setting to turn it off, and kept it every since. It works with every single coding tool because it just looks for the same key word.
  - bbor 5mo ago
    Nothing wrong at all with separating out Claude’s work with commits! In fact, it’s preferable IMO — it lets people browsing the history identify code that was primarily written by AI.
    - 5mo ago

Gibbon1 5mo ago

One could argue that Co-Authored by Copilot means 'not under copyright'

VanTheBrand 5mo ago
Yeah the current guidance from US copyright office is that if it were said to be solely authored by copilot it would not be eligible for copyright. If it were said to be solely authored by human A (who happened to use co-pilot) the elements and arrangement of it not generated by co-pilot would be copyrightable. I’m not sure the copyright office has released guidance on attempting to register AI as a co-author I assume the registration would be rejected but you’d be able to re-submit as sole Human author.
- graemep 5mo ago
  The Thaler case settled part of that: an LLM cannot be an author. The guidance says its case by and case I can find no indication separation of elements is critical. Its more how closely you guide and correct the AI https://www.copyright.gov/ai/Copyright-and-Artificial-Intelligence-Part-2-Copyrightability-Report.pdf https://www.copyright.gov/ai/Copyright-and-Artificial-Intell... You can go by US guidance if you only distribute the work in the US. Otherwise you need to he aware this varies elsewhere.
Aurornis 5mo ago
The headline literally says the line is being inserted regardless of usage, which makes it easy to argue that it’s entirely meaningless as an indicator of AI use at all.
- Gibbon1 5mo ago
  If you can get AI to write your slop is it really socially valuable enough to justify copyright? Even before AI copyrighting software was questionable.
  - deleted 5mo ago
    [deleted]

Esophagus4 5mo ago

And also those early Spotify days where Spotify would automatically post what you’re listening to to your Facebook wall. I’ve always seen that practice of using the user as your recommendation lever without their consent as unethical.

heisenbit 5mo ago
My suspicion is that it violates the users copyright on their commit message.
- rodw 5mo ago
  Technically (in the US at least) purely AI-generated content has no copyright, hence any copyright associated with the commit can only assigned to the human authors (or the entity they are working for). As I understand it neither Copilot nor Microsoft should have any actual claim of authorship (from a copyright/IP perspective). It's still quite problematic IMO
delecti 5mo ago
Those services always asked ahead of time though. And at the time, it was seen as cool, like a not-so-subtle "look at me, listening to music on this cool service".

deleted 5mo ago

[deleted]

Henchman21 5mo ago

I think it's kinda cute that you don't see it as an attempt to steal code by claiming they "co-authored" it. How long before they claim they can use any code co-authored by Copilot in training? How long before you see your own code, "co-authored by Copilot" as an output in a commercial product that YOU aren't making a profit from? Just a thought :)

visarga 5mo ago

That makes the bite less damaging - if everyone hax "Co-authored-by AI" in their commits less shame for it, just a normal fact of life now, not a sign of low quality.

aDyslecticCrow 5mo ago
It's either neutral useless information, or a sign of low quality. It's never positive. Its a sign that the developer didn't pay attention to what they committed. Like a spelling error, or forgetting to run the linter. If the IDE added "written with vscode" i would be equally furious.
- Pay08 5mo ago
  According to the link, the message changing isn't visible to the user in any way (besides running a git log after the fact).

Pay08 5mo ago

I've never heard of git commits being used in a legal case, do you have any examples?

alxndr 5mo ago
I’ve had to talk to company lawyers about specific commits. Case was settled afaik
tuetuopay 5mo ago
I don't know if it's been tested in court, but that's the rationale behind the Signed-off-by lines the kernel requires in all patches sent. It's a way to tell the (legal) ownership of a piece of code.

yubblegum 5mo ago

It is designed to undermine any future disputes regarding IP and their "AI" being trained on our mind products.