Git 3.0 is set to change its default content hashing algorithm from SHA-1 to SHA-256, a shift described by Scott Chacon on GitButler as an 'incomprehensibly expensive and ultimately valueless and avoidable global nightmare.' He notes that the change will affect every new repository created with `git init`, which will use SHA-256 unless explicitly overridden.
This image supports the article's point that changing Git's default hash algorithm will affect every new repository created with `git init`, requiring users to make an informed choice that most may not understand.
Chacon argues that despite SHA-1 showing theoretical weaknesses to collision attacks (such as the SHAttered demonstration), exploiting those weaknesses would require astronomical computational resources—estimates suggest billions of years even with massive GPU farms—and that real-world attacks on version control systems rely not on hash collisions but on compromising trusted distribution channels, echoing Linus Torvalds' view that 'the real security is in distribution.'
The practical fallout, according to the post, is that repositories initialized with SHA-256 cannot be pushed to GitHub or similar hosts until those platforms add explicit support, forcing a split where projects must commit to one hash algorithm or the other, potentially breaking existing tooling, build scripts, and workflows that assume SHA-1 hashes, all for what Chacon sees as negligible security gain.
This image illustrates the article's claim that repositories initialized with SHA-256 cannot be pushed to GitHub or similar hosts until support is added, potentially breaking existing workflows and build scripts that assume SHA-1 hashes.