From: Hans Petter Selasky <hps@selasky.org>
Date: Fri, 13 Jan 2023 15:15:32 GMT
Subject: Re: Gitorious should use CRC128 / 256 / 512 instead of SHA-1
Message-ID: <ba5f35d2-1c94-9216-6676-d845c73ad6c3@selasky.org>
In-Reply-To: <009701d9275a$678416b0$368c4410$@nexbridge.com>

On 1/13/23 15:21, rsbecker@nexbridge.com wrote:
> Signed content will no longer be verifiable. The whole Merkel Tree representing the commit history becomes easily corruptible by hackers

Hi,

As a long time open sourcer and hacker, I'm totally against signing 
software. Is the GIT project going to build the new infrastructure for 
John-Deers new tractor firmware adventure? It is totally against the 
values of open source craftmanship.

I don't think any of you crypto-enthusiasts understand how propritary 
companies use signed software to keep their power intact.

That's also an argument for using a non-crypto hash.

--HPS