Hello :),
Le sam. 28 mars 2026 à 09:08, Bob Proulx <[email protected]> a écrit :
>
> Laurent Lyaudet wrote:
> > > > and no security problem...
> > >
> > > Security problems? Please say more!
> >
> > Just to make someone think he's safe because he uses HTTPS,
> > and instead it is just HTTP, and someone makes a man in the middle
> > on the uncrypted dataflow in HTTP in the network,
> > and then people install, compile, execute compromised software
> > thinking it was secure free software coming from the FSF, etc.
>
> Every commit in git is a sha1 digest. If this introduces a security
> vulnerability then please debate that with upstream git not here. If
> you want to suggest using --object-format=sha256 that would be
> defendable. I admit I don't know the compatibility matrix there.
>
> Note that we intentionally maintain the http:// protocols for people
> behind restrictive firewalls which block https. They arguably need
> access to free software the most.
I didn't took into account the sha1 of git commits, since it is not
cryptographically secure.
It must have been broken as a secure hash something like ten years ago
by a team at Google.
But the POC by Google was with text that was "not controlled regarding
its content",
if I remember well.
It is very probable that research by black and white hats continued on that,
more or less behind the scenes.
On a paranoiac note,
I thought that all the Bitcoin scheme with so many capabilities in
computing hash functions had this kind of goal under the hood.
Now take into account that the IA bubble is like 100 times the Bitcoin
bubble in terms of compute power.
(I said 100 times because I don't know the exact number,
but all the stratospheric money numbers gave us an idea.)
So redirect part of all this immense parallel compute power
to forge code that has subtle flaws plus whitespaces or so to match the sha1,
and Jackpot for the assholes ! XD
More or less I think that we cannot change much,
and that the velocity at which civilizations will crash against one or
many walls will be high.
But as Torvalds said it more or less "We don't change sha1 to
something else more secure, because it would bring false illusion of
security.".
In theory, https should be more secure for the transport part at least.
Best regards,
Laurent Lyaudet
