git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: Gitorious should use CRC128 / 256 / 512 instead of SHA-1

From
Hans Petter Selasky <hps@selasky.org>
Date
Jan 16, 2023, 07:21 UTC
Message-ID
<02e6b8f4-ac5f-fdf5-cea8-58013a3f693d@selasky.org>
In-Reply-To
<Y8NB21PExmifhyeQ@tapette.crustytoothpaste.net>
On 1/15/23 00:59, brian m. carlson wrote:
Show 15 quoted lines
>> 3) Illicit contents may be present in binary blobs, which in the future may
>> be need to be removed without warrant and the only way to do that is by
>> rebasing and force pushing, which will break "everything". It can be
>> everything from child-porn to expired distribution licenses.
> This is a problem in every Merkle tree-like system.  Most repositories
> have some sort of code review or access control that prevents people
> from generally pushing inappropriate content.  For example, if somebody
> proposed to push any sort of pornography or other inappropriate content
> (e.g., a racist screed) to one of my repositories or one of my
> employer's, I'd refuse to approve or merge such a change, because
> that wouldn't be appropriate for the repository.
> 
> I don't feel this is enough of a problem that using a Merkle tree-like
> construction is a bad idea, given the benefits it offers.
> 

Yeah, right. And of course you have all the tools to decode those megabyte big firmware blobs from intel supporting wireless cards all over the place to see what is actually inside there, that they are not using some 3rd party code which licence will expire at some point, and then you need to remove those binaries.

--HPS
Previous: demerphqNext: Hans Petter Selasky
Message 5 of 16 in “Gitorious should use CRC128 / 256 / 512 instead of SHA-1”
  1. Hans Petter SelaskyJan 13, 2023
  2. brian m. carlsonJan 14, 2023
  3. Junio C HamanoJan 15, 2023
  4. demerphqJan 15, 2023
  5. Hans Petter SelaskyJan 16, 2023
  6. Hans Petter SelaskyJan 16, 2023
  7. rsbecker@nexbridge.comJan 16, 2023
  8. Hans Petter SelaskyJan 16, 2023
  9. Junio C HamanoJan 16, 2023
  10. Michal SuchánekJan 15, 2023
  11. Hans Petter SelaskyJan 16, 2023
  12. Michal SuchánekJan 16, 2023
  13. Hans Petter SelaskyJan 16, 2023
  14. rsbecker@nexbridge.comJan 16, 2023
  15. Hans Petter SelaskyJan 16, 2023
  16. Michal SuchánekJan 16, 2023

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.