89
Git 3.0's upcoming SHA-256 default will be a costly mistake (blog.gitbutler.com)
submitted 4 days ago by to c/programming@programming.dev
25 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 3 days ago (1 child)

I still like md5 for collision detection, but every damn security scanner flags it. So then you have to add the exception, then explain to auditors about the exception. It's not worth the hassle for the increased performance.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 4 points 3 days ago

    There's no reason to use md5 if you don't care about security and only want speed. Non-cryptographic hashes are incredibly fast to calculate and there are far faster hashing algorithms if you want to go that route. Using md5 is a "I don't want to think hard" answer, and if you don't want to think hard, then you might as well be secure in your default answer.

  • permalink
  • fedilink
  • source
  • parent