Re: [gentoo-dev] git security (SHA-1)

2014-09-15 Thread Duy Nguyen
On Tue, Sep 16, 2014 at 5:11 AM, Gordon Pettey petteyg...@gmail.com wrote: On Mon, Sep 15, 2014 at 7:02 AM, hasufell hasuf...@gentoo.org wrote: hasufell: * there is no known SHA-1 collision afais * calculating one isn't that hard. NSA might be able to do it in reasonable time *

Re: [gentoo-dev] git security (SHA-1)

2014-09-15 Thread Duy Nguyen
On Tue, Sep 16, 2014 at 5:41 AM, Duy Nguyen pclo...@gmail.com wrote: Even if you wanted to burn the money to find that magical collision that actually contains working code, you've still got to somehow propagate that to other repositories, since they'll just ignore it for having the same hash

Re: [gentoo-dev] The infinite git migration

2014-06-11 Thread Duy Nguyen
On Wed, Jun 11, 2014 at 4:38 PM, Sergey Popov pinkb...@gentoo.org wrote: 11.06.2014 04:48, Duy Nguyen пишет: On Wed, Jun 11, 2014 at 5:59 AM, Patrick Lauer patr...@gentoo.org wrote: Another part: Git wasn't ready. The first migration attempt failed after consuming nearly 100GB of RAM! When

Re: [gentoo-dev] The infinite git migration

2014-06-10 Thread Duy Nguyen
On Wed, Jun 11, 2014 at 5:59 AM, Patrick Lauer patr...@gentoo.org wrote: Another part: Git wasn't ready. The first migration attempt failed after consuming nearly 100GB of RAM! When it did work it took obscene amounts of time, and the result was unusably large (e.g. initial checkout would take