‹ BackHN Continuity

Thread

Git 3.0's upcoming SHA-256 default will be a costly mistake

570 points · 536 comments · chmaynard

  1. MBCook · · focus · HN ↗
    So they’ve been talking about this for many years, planning, and finally announce when they’re going to switch the default.

    So this is the right time to post that everything they’re doing is wrong? Did you engage in all the discussions about it and how best to handle it? Whether SHA-256 was the best solution?

    I don’t see anywhere that it talks about alternate proposals or why they might have been better. Why the particular suggestions here were rejected.

    This seems like a bunch of Monday morning quarterbacking.

    1. schacon · · focus · HN ↗
      I do mention this in like the first paragraph. I don't feel great about it, but I've listened to these issues for years now during contributor summits and Git Merge talks and while it's always seemed problematic, I thought they would come up with a good solution. This last Git Merge confirmed that it's close to the switch and not in any way solved or improved. I don't want to just go with it for groupthink reasons. I never thought it was a good idea and I have said that, but we have a last chance to rethink this, so I'm curious if I'm alone or in the silent majority.
      1. throwworhtthrow · · focus · HN ↗
        Your argument is persuasive and well illustrated. I think the problem is the intro paragraphs come off as too certain of catastrophe which, when juxtaposed with your claim that "smarter people than me have been working on this", makes it sound like you don't actually believe they're smarter than you. The rest of your essay feels fair and not judgmental.
        1. schacon · · focus · HN ↗
          I do believe they're smarter than me, but sometimes very smart groups talk themselves into ultimately impractical solutions because they're all smart. Sometimes you need a dumb guy to come in and say "are you sure this is right?"
          1. throwworhtthrow · · focus · HN ↗
            I believe you are sincere. But "is about to be a huge, costly, global train wreck" lacks the nuance of "are you sure this is right?" and will rub some people the wrong way.

            Edit: I'm not suggesting you should have written it any differently. I think you made the right choice to be a bit provocative because it grabs the attention that's needed.

            1. schacon · · focus · HN ↗
              I do believe this. But that doesn't mean I can't be convinced otherwise by a good argument. The point of this post is to see if anyone has a great counterargument to change my mind.
              1. conartist6 · · focus · HN ↗
                I think you're basically right about this: if you're going to ask an ecosystem to bear the costs of a breaking change, you should be asking yourself what will be bought for the price you will pay.

                For users it's a set of scales that hangs in balance. On one side is the disruptiveness of the change to them, and on the other is the promise of what they will gain once on the other side.

                If there's a problem with the current thinking it's that it proposes to trigger a big expensive breakage that we'll be paying for for 10 years, but there hasn't been any serious discussion of what else is broken about git that needs to be fixed to git to continue to be relevant for the next 10 years.

                Most discussions are pre-constrained by the idea that ecosystem wide breakages are impossible.

                In theory it's good for me if the git ecosystem splits compatibility in half with no obvious benefit. That just makes it easier for me to waltz in with a third backwards-incompatible migration path, one which actually offers eye-popping kinds of benefits in return for the cost of the breakage. That's why I'm competing with you in the race to replace Github. It's just that I'm also racing to replace git, so I assume you'll be in some amount of trouble if I should succeed.

    2. nofunsir · · focus · HN ↗
      The plans have been on display in a cellar. Beware of the leopard.
      1. MBCook · · focus · HN ↗
        I don’t understand what this is supposed to mean.
        1. NikolaNovak · · focus · HN ↗
          It's a hitchhiker guide to the galaxy reference, where sure, something is technically available but not clearly published and there are hoops even for those who know what they're looking for.

          (No clue if it's applicable here, I'm not aware of this case, but I believe that's the reference if it helps :)

          Edit : exact quote, as Arthur's house is about to be demolished for a highway bypass:

          "But the plans were on display…”

          “On display? I eventually had to go down to the cellar to find them.”

          “That’s the display department.”

          “With a flashlight.”

          “Ah, well, the lights had probably gone.”

          “So had the stairs.”

          “But look, you found the notice, didn’t you?”

          “Yes,” said Arthur, “yes I did. It was on display in the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying ‘Beware of the Leopard.

          1. Dylan16807 · · focus · HN ↗
            It's not at all applicable.
        2. fragmede · · focus · HN ↗
          nofunsir is a stoichastic parrot, matching to a bit in Hitchhikers Guide to the Galaxy, wherin the protagonist should have known to protest a plan to demolish his home where plans where clearly documented in a hard to find place that they could not have known about. It is not a good pattern match, because git has been discussing this in public on documented mailing lists for years.
          1. nofunsir · · focus · HN ↗
            No I'm not. Real thumbs here. If anything this paragraph sounds like LLM slop
            1. fragmede · · focus · HN ↗
              Run it through pangram if you want, I wrote it with my human brain. What I did not do, however, was parrot an inapplicable quote.

              In what way has git's discussion of their move been hidden away in a metaphorical basement?

              1. nofunsir · · focus · HN ↗
                I'm sure the cellar was also documented, Arthur eventually found it, did he not?

                Mailing lists are basements in 2026

                1. fragmede · · focus · HN ↗
                  Since 1999, we've had Google to help people find things. True, a mailing list isn't an Instagram reel delivered directly to your face with audio and blasted out on Fox News, but if one was interested in the development of git, an LLM or a Google search would readily tell you about the existence of those mailing lists.
              2. pcthrowaway · · focus · HN ↗
                That comment was short enough that you'd really have to be naive to think a tool could reasonably detect if it was authored by an LLM.

                Additionally, as someone who read Hitchiker's guide to the Galaxy ~3 decades ago, I managed to suspect it was a reference to it, even if the reference wasn't the most applicable

        3. zygentoma · · focus · HN ↗
          I believe it's a reference to the hitchhikers guide to the galaxy – where the plans to remove the protagonists building to build a bypass road was hidden in this way.
      2. bawolff · · focus · HN ↗
        This isn't really applicable. The plans have been talked about for a while very publicly.
    3. kazinator · · focus · HN ↗
      A number of years ago when I heard about this, I was pretty angry and made a private fork of git immediately in which I tried to scrub away the SHA-256 bullshit. But that's basically just paddling upstream with a spoon for a oar.

      The stewards of Git are going to do whatever they want, and there is nothing you can do about it if you don't have the clout to create a fork that takes the lead.

      No amount of discussion will do anything because they've already decided that their view of the situation is correct. Git hashes are not just content identification but a digital certificate mechanism, and their collision resistance is a grave issue that must be fixed, the end.

      You will be browbeaten in any discussion; it's not worth the energy in a world replete with issues.

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.