3 ms·
Just like git, which has much wider impact, considering how many more people use software from git than use pgp or gpg.
by pmoriarty 6y ago
Just like git, which has much wider impact, considering how many more people use software from git than use pgp or gpg.
- saghm 6y agoI don't think git isn't using SHA1 for security though (outside of potentially when signing commits, but that's generally done with gpg, which you drew a distinction with). Assuming you're talking about commit hashes, I'm not particularly worried about the threat of a someone crafting a commit with a malicious hash to my repo because I have much bigger issues than commit hash duplicates if someone malicious is able to commit to my repo. Given that, SHA1 is just as safe to use for my commit hashes as it's always been; the fact that crafting collisions purposely has gotten easier doesn't make accidental collisions any more likely to happen.
- account42 6y ago> I have much bigger issues than commit hash duplicates if someone malicious is able to commit to my repo On github, all forks of a repo shared the commit objects.