4 ms·

I'll have to update my program which generates vanity hashes. I do enjoy starting projects with an obligatory "Initial Commit" with a deadbeef SHA-1

• bmn__ 7y ago
  I like to start a repo with an "empty" commit, that is to say its tree is the magic 4b825dc. https://news.ycombinator.com/item?id=18342763 https://news.ycombinator.com/item?id=18342763 I wonder if it would still be practically possible to manipulate the commit id.
  • loeg 7y ago
    Yep. You can inject arbitrary metadata into the git commit object and the git cli ignores it, other than including it in the hash. E.g., https://github.com/kevinwallace/gitbrute https://github.com/kevinwallace/gitbrute , https://github.com/kevinwallace/gitbrute/commit/0001111 https://github.com/kevinwallace/gitbrute/commit/0001111 .
  • wyoung2 7y ago
    Wow! I wouldn't have guessed that Git had that vulnerability. Fossil solves it easily: creating a new repo involves generating a random project code (a nonce) which goes into the hash of the first commit, so that even two identical commit sequences won't produce identical blockchains. Fossil lets you force the project ID on creating the repo, but the capability only exists for special purposes.
    • kzrdude 7y ago
      It doesn't seem to be a vulnerability at all