Sha1 Code Collissions in Practice
It’s one thing to find *a* collision, it’s quite another to:
1. Find a collision for the sha1 of harmless.c which I know you use,
and replace it with evil.c.2. Somehow make evil.c compile so that it actually does something
useful and nefarious, and doesn’t just make the C compiler puke.If finding one arbitrary collision costs $43K in 2021 dollars
getting past this point is going to take quite a large multiple of
$43K.3. Somehow inject the new evil object into your repository, or
convince you to re-clone it / clone it from somewhere you usually
wouldn’t.At some point in the early days of Git Linus went on a rant to this
effect either on this list or on the LKML.