The technology community still uses SHA-1 for many things. One of the most concerning implications of this team’s technique is that it implies attacks against Git, which uses SHA-1 for every commit. Imagine if you had a tag (a SHA-1 sum) that referred to two different sets of changes: a benign changeset on your machine and a malicious changeset on GitHub. Then you deploy that tag and the malicious code runs instead of the code you expected.
As far as I know, such an attack on Git hasn’t been demonstrated yet, but in theory, I think you could replace a SHA-1 commit as I described. I bet someone will demonstrate that someday. (Think of padding files with bogus comments until you get the checksum you want.) It would be difficult (though not impossible) to switch Git to SHA-256, but I don’t know of any efforts to do that — though Git 2.11 is starting to acknowledge that abbreviated SHA-1 checksums do collide in practice.
Will such an attack happen today or tomorrow? Probably not; it takes a huge amount of resources right now. However, computation is cheaper than ever; I bet attackers will start to use services like Travis CI for computations like this, like I’ve heard is starting to be done with Bitcoin mining in pull requests on open source projects.
The best mitigation I’m currently aware of is cryptographically signing your commits, and this may be a catalyst for that to become standard practice.
1 package wild rice
3 tablespoons olive oil
1 onion, diced
Spices, to taste
1 pound extra firm tofu, drained and cubed
1 package mushrooms
1 (16 ounce) can black beans, drained
1 package spinach or kale
Cook rice according to package directions.
Heat oil in frying pan or wok over medium heat. Add onion and spices.
Add tofu and sauté.
Add mushrooms and black beans once tofu begins to brown.
Add kale or spinach.
Combine rice with the tofu mixture and simmer briefly.
This entry comes by popular request. A lot of people have been asking what they can do to use less oil, and reduce demand for the sticky stuff ruining beaches everywhere. Here’s my top ten, feel free to add to it in comments:1. Carpool, cycle or use public transport to go to work.2. Choose, when possible, products packaged …
Plug-in vehicle sales un the US hit an all-time record of 159,000 units in 2016. That’s encouraging, but we are still in early days with EVs representing less than 1 percent of the new car market. It’s hard to know if the upward trend will continue, especially considering the many unpredictable factors, most notably gas prices. But what unfortunately seems very likely in the coming years is a systematic attempt to reverse incentives and other legislation that supports cleaner transportation.
I recently picked up a 1st generation Nook for $20. I was a little weary of the age of the battery (6 or so years old?), but it turns out that this Nook is one of the few consumer electronics released in recent memory that was built to be repairable. (The battery was meant to be replaced! There are even official instructions.) This is in stark contrast to my 2nd generation Amazon Kindle which had hardware problems and became unusable right after the warranty period ended. That experience soured me on the Kindle, understandably.