Thread

1. KolmogorovComp · 1790036883 · focus · HN ↗

   Does it mean that when switching trop sha1 to sha256 you need to forcepush and rewrite all history? Wouldn’t that be a massive source of potential vulnerabilities?

   1. nomel · 1790036991 · focus · HN ↗

      I don't know much about this. How does that enable vulnerabilities exactly?

      1. jayd16 · 1790037209 · focus · HN ↗

         Trusting a forced push w/o any other verification means nefarious history changes can be slipped in.

         1. vlovich123 · 1790046226 · focus · HN ↗

            You can still verify the contents - the content blobs don’t change after the migration. Not sure if there’s a practical attack one could do but maybe

            1. awesome_dude · 1790058736 · focus · HN ↗

               Um. how do you verify the contents? The history is for the contents you now have, not what might have been

               1. jayd16 · 1790085051 · focus · HN ↗

                  Shallow clones and such would break but you could rehash the local history manually and compare the SHA256 hashes commit by commit, no?

                  Issue is it would be pretty slow so you'd want it to be a one time thing.

Unofficial Hacker News client; not affiliated with Y Combinator.