Follow

Back in 2005, John Gilmore and Zooko (both are well-known cypherpunks) told Linus Torvalds he should avoid using SHA-1 in git right now before it's too late, since it was already theoretically unsound. Linus completely rejected this suggestion. :blobfacepalm: He said the attack is theoretical, and git's hash is not meant for security anyway - if you want to use git securely, you should only trust your local tree and never pull code from a public server. :blobfacepalm:

This decision basically summarizes the upstream kernel community's historical attitude on security mitigations...

RT @bascule@twitter.com: 2005 John Gilmore vs Linus Torvalds on SHA1 "debate" in a nutshell metzdowd.com/pipermail/cryptog

RT @zooko@twitter.com: I, too, begged Linus not to use SHA1 and he (indirectly) mocked me for it. IIRC I suggested that they use Tiger-192 instead. If they had, it would still be working fine and would not require an upgrade.

@niconiconi would you mind to ELI5 why SHA-1 is a security risk if it's only used for referencing a commit and what this has to do with Linux the kernel?

@arielcostas it makes it possible to forge parts of signed commits, which is bad

@arielcostas See "A new hash algorithm for Git" at LWN lwn.net/Articles/811068/

And speaking of the Linux kernel, it's not technically related, I was talking about the culture. The kernel historically (and some would say even now) had a culture for not giving special priority to security, Linus Torvalds famously said:

> I personally consider security bugs to be just "normal bugs". [...] I don't think some spectacular security hole should be glorified or cared about as being any more "special" than a random spectacular crash

And the kernel had a reluctant attitude on accepting innovative exploit mitigation features. Quote the Kernel Self Protection Project, an official kernel project created in response to this problem.

> These kinds of protections have existed for years [...] For various social, cultural, and technical reasons, they have not made their way into the upstream kernel,

Until KSPP, many techniques developed in the early 2000s were still not mainlined even after 10 or 15 years.

Sign in to participate in the conversation
Cybrespace

cybrespace: the social hub of the information superhighway jack in to the mastodon fediverse today and surf the dataflow through our cybrepunk, slightly glitchy web portal support us on patreon or liberapay!