News for hackers. Stuff that matters.

A comment on Git 3.0's upcoming SHA-256 default will be a costly mistake. Parent comment

Re:Git 3.0's upcoming SHA-256 default will be a costly mistake by deknos on Friday October 02, 2026 @07:24AM (#49932267)
> Git hashes are not supposed to be a security mechanism.

That you are wrong. Many people and orgs rely on this.

Does not matter if you think it's stupid, for them it is. live with it.

[ Parent | on HN ]
Re:Git 3.0's upcoming SHA-256 default will be a costly mistake by hylaride on Friday October 02, 2026 @09:49AM (#49933500)
Exactly! The recommended way to use GitHub actions is to use their deploy hash as the version to prevent hijackings. It was never the intention (nor would this have been envisioned when git was created), but security needs to be applied to the way tech is used.
[ Parent | on HN ]