Git 3.0's upcoming SHA-256 default will be a costly mistake

Re:Git 3.0's upcoming SHA-256 default will be a costly mistake by lxgr on Friday October 02, 2026 @08:59AM (#49933060)

You are again talking about a fictional alternate reality in which git commit signatures do something like GPG_Sign(GPG_Signature_Hash(git commit || all objects referenced by commit))), instead of ours where it's GPG_Sign(GPG_Signature_Hash(git commit))), and the git commit is in turn some metadata and a git hash of a bunch of objects.

In our reality, the git hash is load bearing. You can disagree with that design choice, but you can't pretend to live in that alternate reality and design your solutions for this reality according to that.

[ Parent | on HN ]

Re:Git 3.0's upcoming SHA-256 default will be a costly mistake by kazinator on Friday October 02, 2026 @02:41PM (#49937024)

> You are again talking about a fictional alternate reality

> can't pretend to live in that alternate reality

Discussions about solutions that don't exist or requirements not implemented are everyday occurrences and necessary.

I mean, if you're talking with a contractor about how your bathroom should look, that is a "fictional alternate reality", but you're not pretending to be living in it now.

I don't understand the purpose of the above engagement style, but it doesn't look like a great fit for HackerNews.

[ Parent | on HN ]

Re:Git 3.0's upcoming SHA-256 default will be a costly mistake by lxgr on Friday October 02, 2026 @06:32PM (#49939436)

There's a difference between talking about a hypothetical path forward and a hypothetical different past. The latter can be intellectually interesting but is rarely part of normal project planning.

[ Parent | on HN ]

Re:Git 3.0's upcoming SHA-256 default will be a costly mistake by kazinator on Friday October 02, 2026 @08:07PM (#49940143)

[delayed]

[ Parent | on HN ]