Git 3.0 will make SHA-256 the new default content hashing algorithm and it will be an incomprehensibly expensive and ultimately valueless and avoidable global nightmare.
In a well-fleshed-out post, Scott Chacon shows how unneecessary Git 3.0’s move to replace SHA-1 with SHA-256 is.
I pull it from there because I trust that GitHub has its authentication game together enough that it’s unlikely that anyone malicious…
i don’t. more importantly, my package manager doesn’t. that is, every package manager i can think of references git commit hashes in its build system. the end user trusts that when they build from commit xxxxxxxx, they’re getting the exact same code as everyone else. what exactly is being signed in these build systems i don’t know, but whatever scott or linus or anyone else wishes would happen, in the real world, commit hashes are a part of the trust chain.
then again, a lot of package managers just use tags. so maybe in practice, they do trust microsoft.
i don’t. more importantly, my package manager doesn’t. that is, every package manager i can think of references git commit hashes in its build system. the end user trusts that when they build from commit
xxxxxxxx, they’re getting the exact same code as everyone else. what exactly is being signed in these build systems i don’t know, but whatever scott or linus or anyone else wishes would happen, in the real world, commit hashes are a part of the trust chain.then again, a lot of package managers just use tags. so maybe in practice, they do trust microsoft.