Git 3.0's SHA-256 Shift: Unnecessary Upheaval for Minimal Gains

The upcoming Git 3.0 release plans to switch its default hashing algorithm from SHA-1 to SHA-256, a move the author argues is unwarranted. SHA-1, while theoretically vulnerable to collision attacks, has never had a practical security issue in Git’s 20-year history. The author contends that the risk of actual exploits is extremely low, and the transition will cause significant disruption for little benefit. They emphasize that trust in Git is based more on source control management practices than cryptographic hashing. The author argues that the focus should remain on existing security measures rather than overhauling the hashing algorithm.