• 0 posts
  • 6 comments
Joined 1 year ago
Cake day: June 12th, 2025
  • Programming@programming.dev•Github co-creator & Pro Git author skewers Git 3.0's SHA-256 movebyJakenVeina@midwest.social
    3 days

    The blog post lays it out pretty well.

    The vulnerability of SHA-1 is that it’s possible for an attacker to find colliding hashes. But that’s not really an attack vector, because it’s not like they can find aatching hash for just ANY input. In order to pull off an attack, using a hash collision, an attacker would have to already be trusted within the controlling system, in which case they can do a hell of a lot worse than swapping out a file.

    Like you say, the hash is used as a lookup key within the git repo’s database. The requirement for that is uniqueness, which SHA-1 still fulfills just fine. The trust isn’t in the database lookup, the trust is in the systems that controls access to and distribution of that database.

    As the article points out, Linus Torvalds himself said as much in 2005, when he first wrote git:

    I really think people should not consider the sha1 the “security”. The real security is in distribution.

  • Programming@programming.dev•Github co-creator & Pro Git author skewers Git 3.0's SHA-256 movebyJakenVeina@midwest.social
    3 days

    There’s people who seriously think commit hashes are there for security purposes? Furthermore, there are git MAINTAINERS that think this?

    How absurd. Author is completely right, making SHA-256 the default implementation serves no purpose. SHA-1 is a completely valid algorithm for non-security use cases, which is precisely how git uses it. This is a solution looking for a problem.

    I think he’s maybe overblowing the impact of this change. Realistically, the only ones who are going to be impacted are the folks who maintain git-related tools and forges, as he mentions. The rest of us probably won’t even notice. But that’s still a ton of pointless work for those folks.

  • Programming@programming.dev•FTC chair suggests AI developers should be liable for conduct of agentsbyJakenVeina@midwest.social
    8 days

    I’d say the difference is that a gun doesn’t HAVE any other use-case. Its purpose is exclusively to injure or kill living things.

    Also, there’s definitely a difference in the capabilities of each tool. The severity of what a gun is capable if is a heck of a lot higher than what an LLM agent is capable of (doomsdayers notwithstanding).

    I do generally agree with you, though. America’s gun violence problem is not reeeeally a function of America having more guns. That’s just an exacerbating factor.