News for hackers. Stuff that matters.

A comment on Git 3.0's upcoming SHA-256 default will be a costly mistake. Parent comment

Re:Git 3.0's upcoming SHA-256 default will be a costly mistake by hedora on Thursday October 01, 2026 @11:14PM (#49929502)
I'd expect an LLM to prove this (if true) in ~ 60 minutes, given just your post and "try to prove this true or false; here's a github PAT".
[ Parent | on HN ]
Re:Git 3.0's upcoming SHA-256 default will be a costly mistake by nulld3v on Thursday October 01, 2026 @11:48PM (#49929643)
It is already known to be true for repos that are forks or have been forked: https://trufflesecurity.com/blog/anyone-can-access-deleted-a...
[ Parent | on HN ]
Re:Git 3.0's upcoming SHA-256 default will be a costly mistake by computerfriend on Friday October 02, 2026 @12:30AM (#49929849)
That's per-repo. The claim is that user/repo/commit is flattened to just the commit. Your counterpoint (which I agree with and is well-known) is that it's flattened to repo/commit (dropping the user).
[ Parent | on HN ]
Re:Git 3.0's upcoming SHA-256 default will be a costly mistake by nulld3v on Friday October 02, 2026 @01:19AM (#49930077)
Ah right, though I think it is rather unlikely Github flattens across multiple repos given that Github has already blogged about how their repo storage backend (Spokes) works, and it seems to operate entirely on whole repositories.
[ Parent | on HN ]
Re:Git 3.0's upcoming SHA-256 default will be a costly mistake by computerfriend on Friday October 02, 2026 @02:46AM (#49930517)
Yeah, I also don't believe it.
[ Parent | on HN ]
Re:Git 3.0's upcoming SHA-256 default will be a costly mistake by jb1991 on Friday October 02, 2026 @06:24AM (#49931883)
I also don't believe it.
[ Parent | on HN ]