> Again, hashes are by definition, insecure. I.e. you don't have a guarantee that the hash references the same commit, just a (very, very strong) probability that it does. This doesn't seem to be a useful definition.…
> However, if I see that you pushed commit abcd134, and then I can build and push a colliding commit... You cannot do that. This is called a second-preimage attack, which has not been demonstrated even against MD5, let…
> Again, hashes are by definition, insecure. I.e. you don't have a guarantee that the hash references the same commit, just a (very, very strong) probability that it does. This doesn't seem to be a useful definition.…
> However, if I see that you pushed commit abcd134, and then I can build and push a colliding commit... You cannot do that. This is called a second-preimage attack, which has not been demonstrated even against MD5, let…