Thread

1. ltbarcly3 · 1790875540 · focus · HN ↗

   This seems like Y2K fud.

   The alternative to making sha256 the default is to leave sha1 the default. Nobody changes to sha256. sha1 is broken in 10 years. Suddenly everyone has to switch all at once on the same day because it is a critical security issue, but github never implemented sha256 because they didn't have to. This would be a major problem.

   This is very very easy to fix if you run into it.

   1. Adopt git 3.0 if you can with sha256.

   2. If you can't use sha256, set the config to put things back to sha1. Wherever you need to do this you probably already set dozens of ENV vars or settings, just add a new one.

   Or write a 15 page analysis about how the above is so hard people will probably just find it catastrophic to even think about.

   1. addaon · 1790875726 · focus · HN ↗

      > Adopt git 3.0 if you can with sha256.

      Who is "you" in the context of a distributed version control system? I think this is not just the plural you, but the unbounded you -- it's all people who not just interact with your project now, but who you hope may interact with it in the future. The question is what the cost is of committing a near-infinite population to this migration, not the cost of doing a single `brew update` on your personal machine, no?

      1. ltbarcly3 · 1790875868 · focus · HN ↗

         Just clone the repo again. Jesus Christ, you act like the simplest thing in the world is some kind of insurmountable challenge.

Unofficial Hacker News client; not affiliated with Y Combinator.