Hacker News Reader

Comment by YesThatTom2 | Hacker News Reader

GitHub won’t feel any heat about this until Microsoft salespeople start demanding it.

I’ve added to my todo list a reminder to raise this issue with mine. In fact, I’m going to give them a deadline for when we will start evaluating competitors that do support SHA256.

I suspect that most people on HN do not interact with their MS account team. That relationship is probably managed by your CIO or IT department. They probably have monthly or quarterly “business review” meetings. You should get this issue on the agenda of that meeting.

View on HN

Just the other day, I was actually forced to downgrade the file hash used in the product I'm working on to sha1 in order to interact with GitHub's APIs efficiently (to avoid having to download the entire file just to recompute a sha256 for matching).

Luckily I've versioned the internal hash so the upgrade path back to sha256 should be as smooth as the downgrade was. I'm still bitter about it though.

Is there something special about GitHub on this? This seems like a Git issue and not a GitHub issue to me; unless I'm missing something.

They don't accept pushes of repositories in that format.

The article says "none of the Git hosting providers appear to be supporting SHA-256", and while GH is not mentioned by name (and I applaud them for indeed not strengthening this "git == github-the-brand" trap), I can't imagine GH was left out of scope when checking the major hosting providers.

as the article says, you can create a local git repository with SHA-256 hashes today, and it should work fine...but the moment you try to push your repo up to Github, you'll hit a brick wall.

Gitlab also appears to be lacking support [0], and the same with Gitea [1].

so it's a grey area where Git itself supports SHA-256-based repos, but without the major Git hosting services also supporting them, the support in core Git is somewhat useless.

0: https://gitlab.com/groups/gitlab-org/-/epics/794

1: https://github.com/go-gitea/gitea/issues/13794

Thank you.

Git is not GitHub and GitHub is not Git. This article is about Git, the software, not GitHub, the Git hosting service.

Did you skip the bit that discusses hosting providers?

Git supports it, GitHub doesn't. People use forges, therefore they are mislead to believe Git doesn't support it.

Forges?

I also found that confusing in the article. I actually listened to it using text-to-speech and thought it was some brand, like sourceforge. But now I think they just mean any git hosting service.

Code hosting was called a forge. Thus codeforge, etc.

Code hosting services are still called forges. It's a useful generic term with a small syllable count.

Forge is the general term for Git service providers such as gitlab, GitHub, sourcehut, bitbucket et al

Reply on news.ycombinator.com