Linus' reply on Git and SHA-1 collision
Pertinent facts for the worried:<p>1) Git doesn't rely on SHA-1 for security. It relies on HTTPS, and a web of trust.<p>2) Even if git did rely on SHA-1, there's no imminent threat.  What happened today was a SHA-1 collision, not a preimage attack.  If a collision costs 2^n, a preimage attack costs 2^(2n).<p>3) Even if someone managed to pull off a preimage attack, creating a "poisonous" version of one your git repository's objects, they'd still have to convince you pull from their repo. This requires trust.<p>4) Even if you pulled it in, your git client would simply ignore their "poison" object, because it would say, "oh, no thanks, I already have that object".  At worst, the code simply wouldn't work.  No harm would be done.<p>When it comes to git, an attacker's time is better spent creating a secret buffer overflow than wasting millions of dollars on a SHA-1 collision.