Login
You're viewing the assemblag.es public feed.
  • Oct 7, 2026, 5:06 PM

    @GFD @platinumtulip For this reason I do something a little silly: Instead of running curl | bash i do curl > file; sh file. I *could* look at the file before running it, but most such scripts are a few hundred lines long, and if the "evil" line is 100 in I wouldn't recognize it. The one small thing this gets me is I can preserve the script I ran somewhere and if something evil turns out to be in there later, there's a record.

    💬 1🔄 0⭐ 0

Replies

  • Oct 7, 2026, 5:06 PM

    @GFD @platinumtulip In conclusion, git should transition to a secure hash function instead of SHA1. I will not be explaining this comment.

    💬 1🔄 0⭐ 0
  • 💬 1🔄 1⭐ 0
  • 💬 1🔄 0⭐ 0
  • Oct 7, 2026, 10:13 PM
    The article does make some relevant points. But I would still like to see version control using a stronger hash than SHA1.

    I am wondering why SHA256 would be the new default. Why not SHA384? SHA384 offers higher security than SHA256, and on 64 bit CPUs SHA384 is also faster than SHA256.

    One more thing I would like to see in commit hashes is that the actual cryptographic hash is prefixed with a commit depth such that if you do an alphanumeric sorting of commit hashes you will always have descendants listed after their ancestors.
    💬 0🔄 0⭐ 0