Microsoft open sources Salus software bill of materials (SBOM) generation tool

Re:Microsoft open sources Salus software bill of materials (... by rdpintqogeogsaa on Sunday July 17, 2022 @12:18AM (#32124428)

This is nearly beside the point, but why include SHA-1 as a default hash algorihtm in a greenfield project?

[ Parent | on HN ]

Re:Microsoft open sources Salus software bill of materials (... by geocar on Sunday July 17, 2022 @02:15AM (#32124875)

It's not exactly green-field: SPDX is over ten years old now, and browsers only started removing SHA-1 in the last five years.

[ Parent | on HN ]

Re:Microsoft open sources Salus software bill of materials (... by klysm on Sunday July 17, 2022 @06:12AM (#32125624)

As other commenters have said, it’s not greenfield, but is there a valid attack vector on a collision here?

[ Parent | on HN ]