Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linus' reply on Git and SHA-1 collision

marc.info

Post reply on HN
Print view View original

61–70 of 273 posts

Re: Linus' reply on Git and SHA-1 collision

#61

Post by tanderson92 »

flukus wrote: post #58
tanderson92 wrote: post #34

Earlier quoted context omitted.

Specifically, during the war the engineers took a Bayesian approach and put armor on the bombers in locations where bombers which came back did not have damage. Reason being that hits in those sections of the planes were more likely than not resulting in fatalities. Smart thinking.

AA hits planes on the bottom, presumably they weren't adding all the armor to the top?

Does it? AA explodes at predetermined altitudes which may be above or below the plane. The resulting shrapnel....

It's not like a rifle bullet.

Re: Linus' reply on Git and SHA-1 collision

#62

Post by hermitdev »

DiabloD3 wrote: post #31
zkms wrote: post #21

Earlier quoted context omitted.

> "what if a meteorite hit my plane while it was in flight - maybe I should add three inches of high-tension armored steel around the plane, so that my passengers would be protected" I think this is a shockingly good example of how smart people get security questions utterly wrong. The right analogy when it comes to security has to involve some type of adversary, not just random, unmotivated natural phenomena -- as l…

The A-10 isn't a plane, it's a gun with a plane wrapped around it. And it hunts tanks.

I'm sad that the AF wants to retire this plane. This plane was defined with one purpose: build a plane around this gun, that being a 30mm autocannon firing depleted uranium shells (not radioactive) that fires at such a rate that it retards the velocity of the plane carrying the gun, and would melt the gun if it fired from full to empty continuously.

The plane was built for survivability. It can withstand an engine being shot off (why the engines are external on "pods"). The cockpit is (I think) surrounded by a 2 inch titanium tub.

I'm not sure the JSF, i.e. F-35 will be capable of taking over this role, as is intended.

Re: Linus' reply on Git and SHA-1 collision

#64

Post by coliveira »

hzhou321 wrote: post #48

What exactly is the security issue on a repository?

I think this is an important point. If you depend on a source control tool to handle security, you have bigger problems in life. There are way too many things to worry about when designing a source control tool to believe that security will be handled properly.

Re: Linus' reply on Git and SHA-1 collision

#65

Post by braveo »

zkms wrote: post #21
paulddraper wrote: post #16

Linus has toned down a lot from a decade ago. > You are _literally_ arguing for the equivalent of "what if a meteorite hit my plane while it was in flight - maybe I should add three inches of high-tension armored steel around the plane, so that my passengers would be protected". > That's not engineering. That's five-year-olds discussing building their imaginary forts ("I want gun-turrets and a mechanical horse one mi…

> "what if a meteorite hit my plane while it was in flight - maybe I should add three inches of high-tension armored steel around the plane, so that my passengers would be protected" I think this is a shockingly good example of how smart people get security questions utterly wrong. The right analogy when it comes to security has to involve some type of adversary, not just random, unmotivated natural phenomena -- as l…

What's shocking is how badly people understand the purpose of an analogy.

It's to communicate an idea to another person in a way that can also convey subtleties, and not just the literal words being conveyed.

In this case, he was trying to convey the idea that the risk is so small and so remote that it really isn't worth spending a lot of time on.

You understood the point, I understood the point, and everyone else understood the point. Which means the analogy was successful.

So please, stop trying to pull the conversation on some tangent so you expound on why smart people should spend more time on the perfect analogy that you approve of.

Re: Linus' reply on Git and SHA-1 collision

#66

Post by hermitdev »

protomyth wrote: post #38
DiabloD3 wrote: post #31

Earlier quoted context omitted.

The A-10 isn't a plane, it's a gun with a plane wrapped around it. And it hunts tanks.

I am told the gun is also quite good at shooting ground troops. A relative of mine had an A-10 stay with his group most of the night. Every time the enemy decided to go after them the A-10 came back and made them rethink their actions.

The A-10 delivers rounds at a rate that the individual shots are indistinguishable to the the human ear.

Another story that I've heard is that a B-1 flying at operational altitude (200 ft above ground level, mach 2) was often as effective as dropping munitions.

Re: Linus' reply on Git and SHA-1 collision

#67

Post by mcbits »

In 20 years, the $100,000 attack will be a $100 attack (or perhaps a $1 attack), but programmers of the day will be overwhelmed with fixing all the 32-bit timestamps that everyone ignored for 50 years because the clearly forecast problem hadn't blown up in their faces quite yet.

Re: Linus' reply on Git and SHA-1 collision

#68

Post by mrtesthah »

stickfigure wrote: post #25

Several years ago I worked on a security product that used git as a sort of tripwire-type database. Since SHA1 was considered inadequate for Real Security, we had to hack jgit to use SHA256. It took a stupid amount of work - the 160-bit hash size was scattered all over the codebase in countless magic numbers. But it worked. The product was cancelled. I always wondered if the patch would be of any use to anyone.

You could have simply truncated the 256-bit hashes to 160-bit, exactly as Linus is suggesting in this post.

Re: Linus' reply on Git and SHA-1 collision

#69

Post by flukus »

tanderson92 wrote: post #61
flukus wrote: post #58

Earlier quoted context omitted.

AA hits planes on the bottom, presumably they weren't adding all the armor to the top?

Does it? AA explodes at predetermined altitudes which may be above or below the plane. The resulting shrapnel.... It's not like a rifle bullet.

There's the shell itself that can still hit a plane, also proximity mines, which I guess would be more likely to go off on the way app (unless there is a delay after the proximity is triggers). The air force would also know the approximate limit of the enemies AA fire and site above it if possible.

Re: Linus' reply on Git and SHA-1 collision

#70

Post by M_Grey »

braveo wrote: post #65
zkms wrote: post #21

Earlier quoted context omitted.

> "what if a meteorite hit my plane while it was in flight - maybe I should add three inches of high-tension armored steel around the plane, so that my passengers would be protected" I think this is a shockingly good example of how smart people get security questions utterly wrong. The right analogy when it comes to security has to involve some type of adversary, not just random, unmotivated natural phenomena -- as l…

What's shocking is how badly people understand the purpose of an analogy. It's to communicate an idea to another person in a way that can also convey subtleties, and not just the literal words being conveyed. In this case, he was trying to convey the idea that the risk is so small and so remote that it really isn't worth spending a lot of time on. You understood the point, I understood the point, and everyone else un…

Well you said it... it's not a misunderstanding, it's a podium.
Post reply on HN