3 ms·
SHA1 wasn’t meant to be a security measure but as far as I know no one has been able to generate a collision that could fool a code review. > Just replacing an
by gavindean90 6y ago
SHA1 wasn’t meant to be a security measure but as far as I know no one has been able to generate a collision that could fool a code review.
> Just replacing an object in a repository is not enough; the attacker would have to find a way to distribute that object to other repositories around the world, which is not an easy task. The colliding object would have to function as C source (if the kernel were the target of attack here), and would have to stand up to a casual inspection — it would have to look like proper kernel source.
https://lwn.net/Articles/715716/ https://lwn.net/Articles/715716/
- ganafagol 6y ago> SHA1 wasn’t meant to be a security measure It literally stands for Secure Hashing Algorithm.
- detaro 6y agopresumably the mean that the use of SHA1 in git wasn't meant to be a security measure.
- petertodd 6y agoRegardless of whether or not SHA1 was meant to be a security measure, it should have been. Linus's original thinking re: git security is much less useful than just having a secure hash function that you can rely on.