4 ms·
I'm curious what sort of vulnerabilities this could expose. Conflicting git check ins, breaking cache layers, tampering with downloads, etc
by crystaln 12y ago
I'm curious what sort of vulnerabilities this could expose.
Conflicting git check ins, breaking cache layers, tampering with downloads, etc
- dnet 12y ago1. git uses SHA-1, not MD5; former has problems, but is still better than latter 2. git stores the length of a blob before hashing [1] which makes it harder (but not impossible) to perform such attacks [2] [1] http://www.git-scm.com/book/en/v2/Git-Internals-Git-Objects#Object-Storage http://www.git-scm.com/book/en/v2/Git-Internals-Git-Objects#... [2] http://blogs.msdn.com/b/oldnewthing/archive/2004/05/19/134937.aspx http://blogs.msdn.com/b/oldnewthing/archive/2004/05/19/13493...