> Choosing a non-broken algorithm like SHA-2 was an easy choice they could have made that would still hold up today. Yet, the requirement of the hashing algori

> Choosing a non-broken algorithm like SHA-2 was an easy choice they could have made that would still hold up today. Yet, the requirement of the hashing algorithm for Git is not broken, it's not cryptographic but merely stochastic, and Linus knows this. Why bother to produce a collision, when you have the power to get your changes pulled into a release branch? Your attack might be noticed, and your cover blown. Instead, simply try to get a bug merged that results in a zero day. In case somebody discovers it, at least you have plausible deniability that it happened on accident.