4 ms·
Why does Linux think that the source file in question has to acquire an incomprehensible blob in the middle in order for a commit hash collision to occur? Can't
by wfunction 10y ago
Why does Linux think that the source file in question has to acquire an incomprehensible blob in the middle in order for a commit hash collision to occur? Can't the attacker just make all the changes he wants and then insert a random 1 KiB file somewhere to compensate for the commit hash? It could be totally tucked away somewhere you don't expect... you wouldn't see it just by looking at source code.
- Aldo_MX 10y agoI'm not an expert, but for me an incomprehensible blob that is pretty likely to be overlooked begins with: This program is free software; you can redistribute it and/or modify it under the terms of...
- alkonaut 10y agoHaha true, add gibberish below the fold of License.md and no one will ever read it. commit -m "Added dutch license translation"
- mattkrause 10y agoThe demonstration is a pair of PDFs that display differently. However, Google didn't find two PDFs that just happen to collide. Instead, they built one PDF that contains two jpegs and a switch that selects one of them for display. The neat bit is that the file has the same hash regardless of the switch's setting. This attack won't work on plain text source because it won't look like source code.