[–] 1 point 1 month ago

Yes I read the article. I don't agree with all the conclusions.

Now is the best time to change to a new algo. SHA1 is not completely broken yet. It most probably will be at some point.

Also AFAIK they will have compatibility tools for SHA1 repos in git. I don't see the big deal with the path they chose.

We will probably nor agree on that one. I think the hashes are important and that they are mutable right new with effort and later without. It's okay that we don't agree though. The git maintainers have made their decision anyways.

  • source
  • parent
  • context
  • [–] 1 point 1 month ago (2 children)

    I have. In some languages you can use git repos as dependencies. It's good practice to use hashes instead if tags because tags are not immutable. SHA1 hashes are better than tags but better hases would be even better.

    Also traceability. You can build a chain from your commit over ci to the artifact if you do it right. If you can change the files to a hash you can destroy that trust chain. Sha256 makes that impossible.

    People use the hashes in ways you might not. It wasn't meant as a trust anchor but it became one. And that is now being addressed. I also think that the git maintainers have put a lot of thought into backward compatability and making the change as painless as possible.

  • source
  • parent
  • context
  • [–] 2 points 1 month ago (4 children)

    You are exactly doing what I described. You are saying "your using it wrong" instead of acknowledging that's how people use it and and then improving that. You might not need this feature because you are "using it correctly" but that doesn't matter. For the lived reality of many people sha256 is the correct move.

  • source
  • parent
  • context
  • [–] 7 points 1 month ago (6 children)

    Even if it's not the purpose it can fulfill it. Hashes are used for all kinds of things like traceability or for pinning versions. They are used in a context where people depend on that a hash always has the same code behind it and SHA1 can not guarantee that anymore. A better hashing algo is needed to keep the way how people use git secure.

    It's not enough to say "you shouldn't use it that way". We have to accept the reality of how git is used and adapt.

  • source
  • parent
  • context
  • [–] -4 points 1 month ago (7 children)

    Why does everyone think that their culture is so great that they need their own country. We don't need more borders but less. Culture is for sharing and if some tradition falls into obscurity maybe wasn't that important after all.

    I'm all for abandoning stupid traditions anyways. Our absession with traditions has reached a point where it is getting stupid. Just because someone somewhere started doing something doesn't mean we it's worth preserving and doing forever. A lot of traditions are not even that old and we didn't have the luxury of so many traditions when most people couldn't read or write.

    It's a shame that we are clinging on to what makes us different when we should instead stand together to halo and support each other. We are all more similar that different, hurtling on a rock through space. We are all human.

  • source
  • view more: next ›