Git 3.0 will give new repositories 64-character SHA-256 object IDs in place of 40-character SHA-1, while existing repositories keep their format. Scott Chacon disputes the security payoff, and his own breakage list shows which scripts need changes.
Reality
- Evidence42
- Adoption8
- Hype gap+30
- Incentives
- Insufficient
- Confidence38
One team's half-day audit found seven places where its tooling hardcodes the 40-character SHA-1 hash length, ahead of an expected SHA-256 default in Git 3.0. SHA-256 hashes are 64 characters, so the fix is code that accepts both lengths and asks Git which format a repo uses.
Reality
- Evidence45
- Adoption
- Insufficient
- Hype gap+5
- Incentives
- Insufficient
- Confidence45
GitHub's page on removing sensitive data tells teams to revoke and rotate first, and says the extra work of rewriting history often is not warranted when clones, forks and cached SHA-1 views keep the old commit anyway.
Reality
- Evidence72
- Adoption
- Insufficient
- Hype gap−10
- Incentives60
- Confidence70
A developer's Play-delivered build returned nothing at all from Sign in with Google, because the fingerprint buttons on Play Console's app signing page no longer describe the certificate that signs the app.
Reality
- Evidence45
- Adoption12
- Hype gap+12
- Incentives25
- Confidence50
A dev.to guide reads the 2024-25 ICO record as a demonstrability test: over 12 million pounds in fines landed on breached organisations that could not show their controls. The arithmetic lands in the backlog.
Reality
- Evidence36
- Adoption
- Insufficient
- Hype gap+31
- Incentives
- Insufficient
- Confidence34
A 40-character SHA-1 string printed in Slovak certification paperwork matches an entry in Russia's state register of measuring instruments. The comparison cost nothing to run.
Publishers:zive.aktuality.sk
Reality
- Evidence70
- Adoption48
- Hype gap+12
- Incentives62
- Confidence60