Re:Git 3.0's upcoming SHA-256 default will be a costly mistake
by tremon on Friday October 02, 2026 @05:45AM
(#49931658)
The actual thing you'd attack with a hash collision is the blob object, not the tree object, right? The tree object has a rigid structure and git will throw a fit if you add non-functional data to modify its hash. Source code files have comments which make it much easier to manipulate the hash.
[ Parent
| on HN ]
Re:Git 3.0's upcoming SHA-256 default will be a costly mistake
by orf on Friday October 02, 2026 @06:29AM
(#49931920)
you're right, i worded that poorly. what i meant to imply was that a blob hash collision causes any tree referencing it to be malicious, which cascades down to many different commits/tags (potentially all of them, if the tree is untouched since repo creation).
Re:Git 3.0's upcoming SHA-256 default will be a costly mistake
by kazinator on Friday October 02, 2026 @02:43PM
(#49937051)
Maybe you could make a valid tree object with the same hash and different content; the details about which graph node at which level is used as a target do not seem that important.