News for hackers. Stuff that matters.

A comment on Git 3.0's upcoming SHA-256 default will be a costly mistake. Parent comment

Re:Git 3.0's upcoming SHA-256 default will be a costly mistake by knorker on Friday October 02, 2026 @02:34PM (#49936949)
And I should add: not just github compromise, but supply chain / original author replacing the contents.

Absolutely the SHA-1 is treated as "authenticating". Cargo.lock (for regular crates.io dependencies) are confirmed using SHA-256.

[ Parent | on HN ]

There are no comments on this comment yet.