‹ BackHN Continuity

Thread

Git 3.0's upcoming SHA-256 default will be a costly mistake

570 points · 536 comments · chmaynard

  1. ltbarcly3 · · focus · HN ↗
    This seems like Y2K fud.

    The alternative to making sha256 the default is to leave sha1 the default. Nobody changes to sha256. sha1 is broken in 10 years. Suddenly everyone has to switch all at once on the same day because it is a critical security issue, but github never implemented sha256 because they didn't have to. This would be a major problem.

    This is very very easy to fix if you run into it.

    1. Adopt git 3.0 if you can with sha256.

    2. If you can't use sha256, set the config to put things back to sha1. Wherever you need to do this you probably already set dozens of ENV vars or settings, just add a new one.

    Or write a 15 page analysis about how the above is so hard people will probably just find it catastrophic to even think about.

    1. OutOfHere · · focus · HN ↗
      For the record, Y2K was not fud. It was very real, in a long list of datetime problems that are to come. Further datetime problems are coming at scheduled dates.
      1. bigstrat2003 · · focus · HN ↗
        It was definitely FUD. There was a real problem (date counters would roll over), but the impacts of it were so ridiculously overstated that it eclipsed any sane discussion of the issue. We had people at the time predicting that planes would literally fall out of the sky when Y2k hit, which was never a realistic possibility.
        1. rswail · · focus · HN ↗
          Considering one of my team literally was carrying a Motorola satellite phone on the NYE/D of 2000-01-01 in case our mobile or land comms went down because the public transit was running all night, we took it very bloody seriously.

          If there was an interruption to services on that night in particular, that's a serious public safety issue.

          We had tested our system, and integration tested with all the other systems we connected to directly, but any FMECA analysis would show you that there were failure modes that we couldn't mitigate.

          So people on planes falling out of the sky? Probably no.

          People being crushed in a railway station on NYE? Possible yes.

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.