News for hackers. Stuff that matters.

A comment on GitHub shouldn't allow username reuse. Parent comment

Re:GitHub shouldn't allow username reuse by craftyguy on Friday February 09, 2018 @06:51PM (#16344857)
> I really feel like git having a secure package identifier built in is the right answer.

git commits can be gpg signed: https://git-scm.com/book/id/v2/Git-Tools-Signing-Your-Work

[ Parent | on HN ]
Re:GitHub shouldn't allow username reuse by Zamicol on Friday February 09, 2018 @07:39PM (#16345083)
I would never use that. It uses SHA1. The problem is the hash, not the signing. A secure package identifier doesn't necessarily need to be signed. Conversely, you must have a decent hash algorithm.

Your mentioned method signs the git commit hash. A signature is only as good as the hash you use, and SHA1 is not suitable.

https://blog.thoughtram.io/git/2014/11/18/the-anatomy-of-a-g...

Also see https://github.com/git/git/commit/721cc4314cb593e799213ad5f9...

[ Parent | on HN ]
Re:GitHub shouldn't allow username reuse by Shoothe on Saturday February 10, 2018 @07:40AM (#16347063)
What do you mean by "secure package identifier"? Do you mean commit hash using strong hashing function or something else?
[ Parent | on HN ]