> With reasonably long cryptographically strong hashes it's not a weak point (or you could call almost all cryptography a weak point). We do not yet know if on

> With reasonably long cryptographically strong hashes it's not a weak point (or you could call almost all cryptography a weak point). We do not yet know if one way functions truly exists, so from a theoretical standpoint, any hash function is a weakpoint if you do not properly handle malicious collisions. > SHA-1 is considered weak for many years, git should've migrated from it already. Linus addressed this many years ago, when de was working on the first version of Git. It was chosen, despite the fact that it was known to be weakened. I don't know if they lost sight of this, or the geniuenly still believe that malicious colliding hashes are not a problem. I do not know enough about the intimate details of Git to comment on that fact.