Linus' reply on Git and SHA-1 collision
Pertinent facts for the worried:<p>1) Git doesn&#x27;t rely on SHA-1 for security. It relies on HTTPS, and a web of trust.<p>2) Even if git did rely on SHA-1, there&#x27;s no imminent threat.  What happened today was a SHA-1 collision, not a preimage attack.  If a collision costs 2^n, a preimage attack costs 2^(2n).<p>3) Even if someone managed to pull off a preimage attack, creating a &quot;poisonous&quot; version of one your git repository&#x27;s objects, they&#x27;d still have to convince you pull from their repo. This requires trust.<p>4) Even if you pulled it in, your git client would simply ignore their &quot;poison&quot; object, because it would say, &quot;oh, no thanks, I already have that object&quot;.  At worst, the code simply wouldn&#x27;t work.  No harm would be done.<p>When it comes to git, an attacker&#x27;s time is better spent creating a secret buffer overflow than wasting millions of dollars on a SHA-1 collision.