From: Santiago Torres <santiago@nyu.edu>
Date: Fri, 24 Feb 2017 22:53:51 GMT
Subject: Re: SHA1 collisions found
Message-ID: <20170224225350.xb7rudyhowmsqdbc@LykOS.localdomain>
In-Reply-To: <9cedbfa5-4095-15d8-639c-0e3b9b98d6b9@gmail.com>

On Fri, Feb 24, 2017 at 11:47:46PM +0100, Jakub Narębski wrote:
> I have just read on ArsTechnica[1] that while Git repository could be
> corrupted (though this would require attackers to spend great amount
> of resources creating their own collision, while as said elsewhere
> in this thread allegedly easy to detect), putting two proof-of-concept
> different PDFs with same size and SHA-1 actually *breaks* Subversion.
> Repository can become corrupt, and stop accepting new commits.  

From what I understood in the thread[1], it was the combination of svn +
git-svn together. I think Arstechnica may be a little bit
sensationalistic here.

Cheers!
-Santiago.

[1] https://bugs.webkit.org/show_bug.cgi?id=168774#c27