threads / discuss / 66474

Hash function transition page links to hijacked domain

Subject: Hash function transition page links to hijacked domain

## tl;dr

A reader reported that the SHAttered link in the technical docs now leads to unrelated content, and a fix pointing to a Web Archive snapshot has been posted. Read the story.

replies: 2people: 3as markdown or json

Mae Eckert· Oct 6, 2026, 14:49 UTC · lore

Hello!

I'm a mortal so I don't know how to contribute this fix myself, so I figured this might be the right place to ask.

https://git-scm.com/docs/hash-function-transition (2.55.0) links to https://shattered.io (which used to be the SHA-1 paper), but now it's some cybersecurity editorial thing trying to ride off the SEO I assume.

web.archive.org caught the domain being parked in May 03 2026 at https://web.archive.org/web/20260503225438/https://shattered.io/

The last good snapshot seems to be at https://web.archive.org/web/20260207211148/https://shattered.io/, the link should be swapped out.

Cheers,

Mae

D. Ben Knoble· Oct 6, 2026, 17:17 UTC · re: Mae Eckert · lore

[PATCH] doc: fix shattered.io link

Since we published this document the domain has been taken over and no longer reflects the original content. Link to the last good Web Archive snapshot so folks can still retrieve the SHAttered information.

Suggested-by: Mae Eckert <mae.eckert@albellus.de>
Signed-off-by: D. Ben Knoble <ben.knoble@gmail.com>
---
 Documentation/technical/hash-function-transition.adoc | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/Documentation/technical/hash-function-transition.adoc b/Documentation/technical/hash-function-transition.adoc
index 241d2f763d..f6b38ddd50 100644
--- a/Documentation/technical/hash-function-transition.adoc
+++ b/Documentation/technical/hash-function-transition.adoc
@@ -29,7 +29,8 @@ advantages:
 
 Over time some flaws in SHA-1 have been discovered by security
 researchers. On 23 February 2017 the SHAttered attack
-(https://shattered.io) demonstrated a practical SHA-1 hash collision.
+(https://web.archive.org/web/20260207211148/https://shattered.io/)
+demonstrated a practical SHA-1 hash collision.
 
 Git v2.13.0 and later subsequently moved to a hardened SHA-1
 implementation by default, which isn't vulnerable to the SHAttered

-- 
2.53.0

Junio C Hamano· Oct 6, 2026, 21:50 UTC · re: D. Ben Knoble · lore

Re: [PATCH] doc: fix shattered.io link

"D. Ben Knoble" <ben.knoble@gmail.com> writes:

Show 21 quoted lines

> Since we published this document the domain has been taken over and no
> longer reflects the original content. Link to the last good Web Archive
> snapshot so folks can still retrieve the SHAttered information.
>
> Suggested-by: Mae Eckert <mae.eckert@albellus.de>
> Signed-off-by: D. Ben Knoble <ben.knoble@gmail.com>
> ---
>  Documentation/technical/hash-function-transition.adoc | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/Documentation/technical/hash-function-transition.adoc b/Documentation/technical/hash-function-transition.adoc
> index 241d2f763d..f6b38ddd50 100644
> --- a/Documentation/technical/hash-function-transition.adoc
> +++ b/Documentation/technical/hash-function-transition.adoc
> @@ -29,7 +29,8 @@ advantages:
>  
>  Over time some flaws in SHA-1 have been discovered by security
>  researchers. On 23 February 2017 the SHAttered attack
> -(https://shattered.io) demonstrated a practical SHA-1 hash collision.
> +(https://web.archive.org/web/20260207211148/https://shattered.io/)
> +demonstrated a practical SHA-1 hash collision.

Thanks.  Will queue.

>  
>  Git v2.13.0 and later subsequently moved to a hardened SHA-1
>  implementation by default, which isn't vulnerable to the SHAttered