Thread

1. nicoburns · 1790875496 · focus · HN ↗

   From what I'd read, SHA256 in git is showing every sign of being another IPv6. In particular:

   - It's implemented in a non-backwards-compatible way

   - The benefits over the older model are a bit nebulous

   - There's a large amount of tooling that needs to catch up, and little sign that there is movement there

   1. Onavo · 1790875891 · focus · HN ↗

      There's a massive push right now from top down to have secure software supply chains. Google SBOM and SigStore. It's not an organic need but if you have government customers you don't have many options.

      1. Dayshine · 1790876477 · focus · HN ↗

         Ironically rewriting git history is a perfect opportunity for a supply chain attack.

         1. samus · 1790921156 · focus · HN ↗

            The switchover date is usually announced well in advance and any interested parties can easily verify that the conversion was authentic.

Unofficial Hacker News client; not affiliated with Y Combinator.