Yes I read the article. I don’t agree with all the conclusions.

Now is the best time to change to a new algo. SHA1 is not completely broken yet. It most probably will be at some point.

Also AFAIK they will have compatibility tools for SHA1 repos in git. I don’t see the big deal with the path they chose.

We will probably nor agree on that one. I think the hashes are important and that they are mutable right new with effort and later without. It’s okay that we don’t agree though. The git maintainers have made their decision anyways.

I have. In some languages you can use git repos as dependencies. It’s good practice to use hashes instead if tags because tags are not immutable. SHA1 hashes are better than tags but better hases would be even better.

Also traceability. You can build a chain from your commit over ci to the artifact if you do it right. If you can change the files to a hash you can destroy that trust chain. Sha256 makes that impossible.

People use the hashes in ways you might not. It wasn’t meant as a trust anchor but it became one. And that is now being addressed. I also think that the git maintainers have put a lot of thought into backward compatability and making the change as painless as possible.

You are exactly doing what I described. You are saying “your using it wrong” instead of acknowledging that’s how people use it and and then improving that. You might not need this feature because you are “using it correctly” but that doesn’t matter. For the lived reality of many people sha256 is the correct move.

Even if it’s not the purpose it can fulfill it. Hashes are used for all kinds of things like traceability or for pinning versions. They are used in a context where people depend on that a hash always has the same code behind it and SHA1 can not guarantee that anymore. A better hashing algo is needed to keep the way how people use git secure.

It’s not enough to say “you shouldn’t use it that way”. We have to accept the reality of how git is used and adapt.

I played the VR games “I Expect You To Die” 1-3. They were the first VR games that actually hooked me and the intros are absolutely phenomenal. When I started with the first one and saw the intro I thought to myself that the intro went way too hard for a VR game. And the next two only went harder. The gameplay is very fun and engaging.

Then I played through Goodnight Universe in one evening. It was a beautiful experience. I even shed a few tears. Highly recommend.

Currently I am playing the Gothic Remake. It’s not very beginner friendly and I’m not sure if I like it yet.