3 ms·
How well does the scenario scale in this sense that there could be hash collisions across the number of projects available on GitHub? Or was it simplified in it
by 0x6c6f6c 4y ago
How well does the scenario scale in this sense that there could be hash collisions across the number of projects available on GitHub? Or was it simplified in its search for a SHA hash only?
I would imagine some hash collisions between all repositories in GitHub exist at this point.
- rektide 4y agoGit is now using SHA256, so there is quite very close to zero risk. Trying to intentionally create a SHA1 collision is also going to be "quite difficult" for the foreseeable future.
- glandium 4y ago> Git is now using SHA256 Not by default, and I don't think it's officially stable yet (but I haven't checked the status in a while). I'm not even sure github supports SHA256 repos.
- rektide 4y agoThanks, seems right. Someone asked github in a discussion 18 months ago[1], and they said soon, but there's still no sign of progress, no issues to track, no indication soon really was in the pipeline. [1] https://github.community/t/support-for-sha-256-hashes/157493/6 https://github.community/t/support-for-sha-256-hashes/157493...
- jwilk 4y agoFWIW, Git (since v2.13) uses an SHA-1 implementation that detects known collision attacks.