SHA1 collisions found

http://public-inbox.org/git/20170226004657.zowlojdzqrrcalsm@sigill.intra.peff.net/T/#t

My takeaway from all that – the git project is internally taking steps to mitigate vulnerabilities from this particular attack (making it harder to insert the arbitrary binary data necessary into git metadata), but a) is just throwing up their hands at the problem of projects that store binary blobs like image data in their repos, and b) is not taking this as a signal that more serious sha-1 attacks are on the horizon and they should speed up their hash-replacement efforts.

This latter leads into the problems with Linus’ positions in particular. In that thread, does not take seriously the threats that this poses to the broader git userbase, because he only seems to care about the kernel use-case: trusted hosting infrastructure at kernel.org (itself an iffy assumption, given previous hacks and the use of mirrors), and the exclusive storage of human-readable text in the repo which makes binary garbage harder to sneak in. These do not apply to most users of git. His rather extreme public position (paraphrased, “our security doesn’t depend on SHA1”) is even more troubling – it absolutely does depend on SHA1, this just isn’t (yet) a strong enough attack to absolutely screw over the kernel. A stronger collision attack (eg a chosen-prefix as opposed to identical-prefix, or godforbid a pre-image attack) would absolutely invalidate the whole git security model.

Tornado warning update 

http://maps.google.com/maps?f=q&q=(38.70445251464844,-76.53721618652344)&z=15

A Tornado Warning REMAINS IN EFFECT UNTIL 330 PM EST FOR SOUTH CENTRAL ANNE ARUNDEL…NORTHWESTERN CALVERT…SOUTHEASTERN PRINCE GEORGES AND NORTHEASTERN CHARLES COUNTIES… At 312 PM EST, a severe thunderstorm capable of producing a tornado was located near Waldorf, moving northeast at 50 mph.

HAZARD…Tornado.

SOURCE…Radar indicated rotation.

IMPACT: For those in the direct path of a tornado touchdown, flying debris will be dangerous to those caught without shelter.

Damage to roofs, siding, and windows may occur. Mobile homes may be damaged or destroyed. Tree damage is likely.

This dangerous storm will be near… Chesapeake Beach, Breezy Point and Dunkirk around 330 PM EST. Other locations impacted by this tornadic thunderstorm include Lower Marlboro, Baden, Aquasco, Sunderland, White Plains, Bryantown, Friendship, Mount Harmony, Eagle Harbor and Owings.

TORNADO…RADAR INDICATED HAIL…<.75IN

Why I hate bing as a search engine…

Alexa needs a little work and bing is not helping. 

Try it yourself: 3/5

“Alexa, which United States presidents are still alive?”

“The US presidents that I know are alive are Barack Obama, George W. Bush, and Bill Clinton.”

********

“Alexa, list the living U.S. Presidents.”

“Alive US Presidents include Donald Trump, Barack Obama, Jimmy Carter, Franklin D. Roosevelt, and Ronald Reagan.”

Welcome to my wall scrawls.