Thread

1. 6thbit · 1790877655 · focus · HN ↗

   I thought this would be a snark but it's an extremely well put together argument against the "Hashmageddon".

   If you're replacing the weakness of SHA-1 just by going to another algorithm, you better be prepared to go to the next one when sha256 collisions happen, and it doesn't sound like git's design would be easy to modify for this type of crypto agility.

   I do like their proposal for using signatures to establish trust and allow swapping sha256 for whatever comes next.

   1. TheRealPomax · 1790878144 · focus · HN ↗

      Perhaps not clear enough, but Scott was a cofounder of GitHub, so he knows a thing or two about git in the real world =)

      1. schacon · 1790880122 · focus · HN ↗

         Being a founder of GitHub doesn't make my opinion more interesting. I hope the argument stands no matter who wrote it. :)

         1. TheRealPomax · 1790894697 · focus · HN ↗

            It does though, even if it shouldn't be blindly taken as gospel. Arguments help, but some folks have a better brand of apple box to stand on, and "I live and breathe git" helps quite a bit ;)

Unofficial Hacker News client; not affiliated with Y Combinator.