Embedded into .Net monolith app to replicate MSSQL data into it and do queries around this data, because MSSQL is SLOW on those queries =)

Even if it costs zero to create. How do You force people to pull from Your repo?

The XZ incident would have been so much worse if it would have involved a collision, pushing one object variant to github.com, and one variant to git.tukaani.org.

Then you would have security researchers making conflicting claims depending on which repository they first pulled from, even though they are on the same git commit hash.

Wait maybe I’m missing something, but are you saying the temporary confusion while people realize they have different versions would be the primary downside? I feel like that’s an acceptable loss. It seems likely that the data in both commits, while one healthy and the other corrupt, will still have to be very different in order to produce the same hash. It’s not like you can reasonably find same-hash commits that just change line19 execute_hack from true to false.

The commit message is part of the hash. You could have quite a lot of entropy there which wouldn’t get much notice until the postmortem.

The XZ incident was using binary files checked into git. When you successfully collide this file, one with the trigger, one without the trigger, they get the same git blob-object hash (assuming the chosen-prefix includes the git blob-object header). Because of this, any git tree-object referring to this file is valid for either variant (no further collision needed). This tree-object can itself be part of another tree-object, which can be referred to by a commit-object. Signing this commit with ed25519+sha256 doesn't fix the fact that the tree-object underneath is ambiguous.

People assume sha1 git is cryptographically sound, and a git commit is a secure identifier to reason about source code, whether you and me like it or not.

In GitHub, fork networks are represented as one repo on disk (this is the main optimization that makes community pull requests possible at all). So you could fork a repo and then push an object with a hash collision to it to change a file in the original, in theory.

(In practice this is harder, as the article mentions, because the new forged object would have to be a valid gzipped git object of the same length. And GitHub probably knows about this type of attack and might just, for example, prevent existing objects from being overwritten)

You also have to trick the code git added to detect and block shattered-style attacks.

Still, eliminating the risk is a good idea.

Hack into the system holding a trusted repository, and swap in your variant with same signature?

That variant would likely not even compile?

You can put your entropy in comments and strings

And commit messages.

And the date. And hidden headers in the commit that you'd only see if you use `--pretty=raw`.

Social engineering?

DNS cache poisoning?

They already do. Look for top comments from commenters that require exact historical answers

So it will not usable to do anything with hardening Your own site.... I'm so tired of this. I just want adjust cookie behavior of own site...

Of course it can harden your own site.

And end up with 3k lines of code + conversation history?

Because most of the new feature are not connected to each other. Take a gravition coil. It's like in Half Life - but You can only use with very limited set of objects, that were added in same update as gravition coil. Make it useless and not fun...

Yep. Fable implemented 2FA login. Declined to review own code in same session.

You can request for Cyber Verification Program (CVP) access from Anthropic

This requires submitting a photo ID to Persona, something no one should be comfortable doing. There are very real privacy concerns with Persona, so much so that Discord dropped them as their provider.

> So don't do that, unless you're like.. idk terminally ill and die tomorrow or something like that.

Or You are from Iran, Russia or North Korea and you don't care much USA laws.