>1) Git doesn't rely on SHA-1 for security. It relies on HTTPS, and a web of trust. This is a big lie. When the -S flag is used, git signs the SHA-1 of the com

>1) Git doesn't rely on SHA-1 for security. It relies on HTTPS, and a web of trust. This is a big lie. When the -S flag is used, git signs the SHA-1 of the commit. Moreover HTTPS does not provide any form of authentication due to the extremely broken CA model. NSA could simply ask any CA to give them a cert for github for example. Not to mention that https would only authenticate that you are talking to the github server, it would say nothing concerning the authenticity of the code. >they'd still have to convince you pull from their repo. This requires trust. How about compromising your servers instead? Or maybe simply have NSA asking github to let them modify a commit (which would end up having the same SHA-1 and being signed by you). >4) Even if you pulled it in, your git client would simply ignore their "poison" object, because it would say, "oh, no thanks, I already have that object". At worst, the code simply wouldn't work. No harm would be done. https://stackoverflow.com/a/34599081 https://stackoverflow.com/a/34599081 Didn't Git v2.0 break backwards compatibility? Couldn't they simply move to Sha-2 during that time?