Re: [julia-users] git SSL problems with METADATA.jl

[Ivar Nesje]

You don't need a hash collision to change data in a git pull connection. The 
only thing you need to do is to send your own hash when the client asks for the 
current HEAD sha of master. It will be detected next time you update, if the 
attacker is not still there and remember the lies he told you, because git will 
warn that the history changed.