GitHub shouldn't allow username reuse

Re:GitHub shouldn't allow username reuse by Zamicol on Friday February 09, 2018 @06:24PM (#16344698)

I really feel like git having a secure package identifier built in is the right answer.

I haven't heard any news of git moving to SHA3-256.

Why shouldn't this be built in?

Here's an old thread from 2017-03-04: https://public-inbox.org/git/CA+dhYEViN4-boZLN+5QJyE7RtX+q6a...

[ Parent | on HN ]

Re:GitHub shouldn't allow username reuse by craftyguy on Friday February 09, 2018 @06:51PM (#16344857)

> I really feel like git having a secure package identifier built in is the right answer.

git commits can be gpg signed: https://git-scm.com/book/id/v2/Git-Tools-Signing-Your-Work

[ Parent | on HN ]

Re:GitHub shouldn't allow username reuse by Zamicol on Friday February 09, 2018 @07:39PM (#16345083)

I would never use that. It uses SHA1. The problem is the hash, not the signing. A secure package identifier doesn't necessarily need to be signed. Conversely, you must have a decent hash algorithm.

Your mentioned method signs the git commit hash. A signature is only as good as the hash you use, and SHA1 is not suitable.

https://blog.thoughtram.io/git/2014/11/18/the-anatomy-of-a-g...

Also see https://github.com/git/git/commit/721cc4314cb593e799213ad5f9...

[ Parent | on HN ]

Re:GitHub shouldn't allow username reuse by Shoothe on Saturday February 10, 2018 @07:40AM (#16347063)

What do you mean by "secure package identifier"? Do you mean commit hash using strong hashing function or something else?

[ Parent | on HN ]