News for hackers. Stuff that matters.

A comment on Linus on Git and SHA-1. Parent comment

Re:Linus on Git and SHA-1 by aseipp on Saturday February 25, 2017 @08:16PM (#13735043)
This conversation has gone on several times over the course of years on the Git mailing list. In almost every situation it's been completely brushed off as a mostly non-issue to change from SHA-1 inside Git, despite the fact it's been known SHA-1 has basically been on life support. There are lots of opinions on both sides, but ultimately, until now, the Upstream decision seemed to be "WONTFIX".

Given this context, of course nobody wrote patches: they would have obviously been rejected and been a total waste of time. Until now, when we actually have to deal with it.

This is all aside from your argument being fundamentally weak, however ("you can't criticize anything unless i say so and contributed by meeting this arbitrary standards. i mean, didn't do anything either, i just get to make up the rules you abide by!!")

[ Parent | on HN ]
Re:Linus on Git and SHA-1 by simplehuman on Saturday February 25, 2017 @11:24PM (#13735668)
> This is all aside from your argument being fundamentally weak, however ("you can't criticize anything unless i say so and contributed by meeting this arbitrary standards. i mean, didn't do anything either, i just get to make up the rules you abide by!!")

Are we both reading the same GP comment? It reads as "If he took this stuff seriously, he wouldn't have waited 12 years since SHA-1 was broken to even start considering any changes.".

[ Parent | on HN ]
Re:Linus on Git and SHA-1 by nickpsecurity on Sunday February 26, 2017 @10:27AM (#13737628)
It's equivalent to the other comments. The others just have more facts to back it up & should've probably been the original. If The reason it's equivalent is:

1. Saw a known issue that cryptographers and security people were warning him about.

2. Alternatives existed that didn't have that issue. People were pushing on it.

3. Ignored all that to tell them it wasn't a problem, the issue could never have real-world consequences, and he wasn't interested in fixes.

In practice, that means he didn't take it seriously. He also made sure it wouldn't get fixed by letting people know he wasn't making a change to it. One more example in a long line of them where Linus doesn't give a shit about security enough to apply known, good practices.

[ Parent | on HN ]