News for hackers. Stuff that matters.

A comment on Linus' reply on Git and SHA-1 collision. Parent comment

Re:Linus' reply on Git and SHA-1 collision by _pmf_ on Friday February 24, 2017 @06:12AM (#13722650)
> Some security-focused developers sign git tags and/or commits, specifically to have things verifiable end-to-end and not having to trust HTTPS and all the middle men that entails.

This is a completely orthogonal, separate layer of security that has nothing to do with this particular issue.

[ Parent | on HN ]
Re:Linus' reply on Git and SHA-1 collision by tokenizerrr on Friday February 24, 2017 @06:27AM (#13722709)
Maybe quote the second line as well?

> Would that not be a case where git relies on SHA1 for security? Someone could replace a tag or commit with a malicious version that verifies fine since it has the same hash the original developer signed.

What's your response to this? To me it seems like this would be a serious issue.

[ Parent | on HN ]
Re:Linus' reply on Git and SHA-1 collision by _pmf_ on Friday February 24, 2017 @06:59AM (#13722815)
You're right.
[ Parent | on HN ]