That is a bit of hyperbole. Just as MD5 is a good hash function, as is SHA1 - they just are not good cryptographical hash functions. We've known this for more t

That is a bit of hyperbole. Just as MD5 is a good hash function, as is SHA1 - they just are not good cryptographical hash functions. We've known this for more than a decade, so this is just confimation of what we already knew. That said, it's relatively straight forward to upgrade Git for instance, but it will break all external linking to a repository unless they store both new and old hashes for existing commits. If the hashing function in Git should have been secure, it should not have been created with SHA1 in the first place, as it was known to be broke before development even began.