> The problem isn't merely that "detecting maliciousness" seems fraught in itself (how does one infer intent reliably?) Its not detecting "intent" it is detect

> The problem isn't merely that "detecting maliciousness" seems fraught in itself (how does one infer intent reliably?) Its not detecting "intent" it is detecting that the hash is one vulnerable to the attack, which is extremely unlikely to happen by accident, so if you see it you can assume malice. It might be a band-aid, and sha256 is certainly a much better solution, but its more robust than it sounds at first glance (since it sounds crazy at first glance)