Thread

Git 3.0's upcoming SHA-256 default will be a costly mistake

570 points · 536 comments · chmaynard

quotemstr · 1790876012 · focus · HN ↗
Would the author feel the same if git had used MD5 instead of SHA-1?
1. happytoexplain · 1790876186 · focus · HN ↗
  They address this very theoretical. In short: Yes. Which makes sense if you don't treat the hash as a form of security against malice, especially in the case of attacks that are already impractical, which is the entire thrust of the article.
2. [deleted] · 1790876221 · focus · HN ↗
  [deleted]
3. schacon · 1790876388 · focus · HN ↗
  I do actually literally write in this that if it was MD5 it also would not be a problem.
  1. quotemstr · 1790877940 · focus · HN ↗
    Fair cop.
4. techjamie · 1790881187 · focus · HN ↗
  The hash isn't the security, the distribution is.
  <a href="https://lore.kernel.org/git/Pine.LNX.4.58.0504291221250.18901@ppc970.osdl.org/" rel="nofollow">https://lore.kernel.org/git/Pine.LNX.4.58.0504291221250.1890...
  As linked by another commenter in this thread, Linus worked out years ago that even if someone inserted a malicious object into the kernel repo, it would at best be a nuisance and not a major concern.
5. eviks · 1790908588 · focus · HN ↗
  Follow the ethos of the quote master!
  > We could be using MD5 and it would honestly probably be just fine.

Unofficial Hacker News client; not affiliated with Y Combinator.