5 ms·

GitHub won’t feel any heat about this until Microsoft salespeople start demanding it. I’ve added to my todo list a reminder to raise this issue with mine. In

GitHub won’t feel any heat about this until Microsoft salespeople start demanding it. I’ve added to my todo list a reminder to raise this issue with mine. In fact, I’m going to give them a deadline for when we will start evaluating competitors that do support SHA256. I suspect that most people on HN do not interact with their MS account team. That relationship is probably managed by your CIO or IT department. They probably have monthly or quarterly “business review” meetings. You should get this issue on the agenda of that meeting.

sdfhdhjdw3 4y ago
Thank you.
codazoda 4y ago
Is there something special about GitHub on this? This seems like a Git issue and not a GitHub issue to me; unless I'm missing something.
- lucb1e 4y ago
  They don't accept pushes of repositories in that format. The article says "none of the Git hosting providers appear to be supporting SHA-256", and while GH is not mentioned by name (and I applaud them for indeed not strengthening this "git == github-the-brand" trap), I can't imagine GH was left out of scope when checking the major hosting providers.
- evil-olive 4y ago
  as the article says, you can create a local git repository with SHA-256 hashes today, and it should work fine...but the moment you try to push your repo up to Github, you'll hit a brick wall. Gitlab also appears to be lacking support [0], and the same with Gitea [1]. so it's a grey area where Git itself supports SHA-256-based repos, but without the major Git hosting services also supporting them, the support in core Git is somewhat useless. 0: https://gitlab.com/groups/gitlab-org/-/epics/794 https://gitlab.com/groups/gitlab-org/-/epics/794 1: https://github.com/go-gitea/gitea/issues/13794 https://github.com/go-gitea/gitea/issues/13794
vulcan01 4y ago
Git is not GitHub and GitHub is not Git. This article is about Git, the software, not GitHub, the Git hosting service.
- sdfhdhjdw3 4y ago
  Did you skip the bit that discusses hosting providers?
- ElectricalUnion 4y ago
  Git supports it, GitHub doesn't. People use forges, therefore they are mislead to believe Git doesn't support it.
  - chrisseaton 4y ago
    Forges?
    - lucb1e 4y ago
      I also found that confusing in the article. I actually listened to it using text-to-speech and thought it was some brand, like sourceforge. But now I think they just mean any git hosting service.
      - sroussey 4y ago
        Code hosting was called a forge. Thus codeforge, etc.
        dwheeler 4y ago
        Code hosting services are still called forges. It's a useful generic term with a small syllable count.
    - beermonster 4y ago
      Forge is the general term for Git service providers such as gitlab, GitHub, sourcehut, bitbucket et al
bradhe 4y ago
- girvo 4y ago
  You sound like someone who didn’t read the article. Git basically supports it already. GitHub et al do not, and that is what is holding it back.
lewisl9029 4y ago
Just the other day, I was actually forced to downgrade the file hash used in the product I'm working on to sha1 in order to interact with GitHub's APIs efficiently (to avoid having to download the entire file just to recompute a sha256 for matching). Luckily I've versioned the internal hash so the upgrade path back to sha256 should be as smooth as the downgrade was. I'm still bitter about it though.

sdfhdhjdw3 4y ago

Thank you.

codazoda 4y ago

Is there something special about GitHub on this? This seems like a Git issue and not a GitHub issue to me; unless I'm missing something.

lucb1e 4y ago
They don't accept pushes of repositories in that format. The article says "none of the Git hosting providers appear to be supporting SHA-256", and while GH is not mentioned by name (and I applaud them for indeed not strengthening this "git == github-the-brand" trap), I can't imagine GH was left out of scope when checking the major hosting providers.
evil-olive 4y ago
as the article says, you can create a local git repository with SHA-256 hashes today, and it should work fine...but the moment you try to push your repo up to Github, you'll hit a brick wall. Gitlab also appears to be lacking support [0], and the same with Gitea [1]. so it's a grey area where Git itself supports SHA-256-based repos, but without the major Git hosting services also supporting them, the support in core Git is somewhat useless. 0: https://gitlab.com/groups/gitlab-org/-/epics/794 https://gitlab.com/groups/gitlab-org/-/epics/794 1: https://github.com/go-gitea/gitea/issues/13794 https://github.com/go-gitea/gitea/issues/13794

vulcan01 4y ago

Git is not GitHub and GitHub is not Git. This article is about Git, the software, not GitHub, the Git hosting service.

sdfhdhjdw3 4y ago
Did you skip the bit that discusses hosting providers?
ElectricalUnion 4y ago
Git supports it, GitHub doesn't. People use forges, therefore they are mislead to believe Git doesn't support it.
- chrisseaton 4y ago
  Forges?
  - lucb1e 4y ago
    I also found that confusing in the article. I actually listened to it using text-to-speech and thought it was some brand, like sourceforge. But now I think they just mean any git hosting service.
    - sroussey 4y ago
      Code hosting was called a forge. Thus codeforge, etc.
      - dwheeler 4y ago
        Code hosting services are still called forges. It's a useful generic term with a small syllable count.
  - beermonster 4y ago
    Forge is the general term for Git service providers such as gitlab, GitHub, sourcehut, bitbucket et al

bradhe 4y ago

girvo 4y ago
You sound like someone who didn’t read the article. Git basically supports it already. GitHub et al do not, and that is what is holding it back.

lewisl9029 4y ago

Just the other day, I was actually forced to downgrade the file hash used in the product I'm working on to sha1 in order to interact with GitHub's APIs efficiently (to avoid having to download the entire file just to recompute a sha256 for matching). Luckily I've versioned the internal hash so the upgrade path back to sha256 should be as smooth as the downgrade was. I'm still bitter about it though.