📅 Original date posted:2013-04-01
📝 Original message:The threat of a SHA1 collision attack to insert a malicious pull request
are tiny compared with the other threats - e.g. github being compromised,
one of the core developers' passwords being compromised, one of the core
developers going rogue, sourceforge (distribution site) being compromised
etc etc... believe me there's a lot more to worry about than a SHA1
attack...
Not meaning to scare, just to put things in perspective - this is why we
all need to peer review each others commits and keep an eye out for
suspicious commits, leverage the benefits of this project being open source
and easily peer reviewed.
Will
On 1 April 2013 23:52, Melvin Carvalho <melvincarvalho at gmail.com> wrote:
>
>
>
> On 1 April 2013 20:28, Petr Praus <petr at praus.net> wrote:
>
>> An attacker would have to find a collision between two specific pieces of
>> code - his malicious code and a useful innoculous code that would be
>> accepted as pull request. This is the second, much harder case in the
>> birthday problem. When people talk about SHA-1 being broken they actually
>> mean the first case in the birthday problem - find any two arbitrary values
>> that hash to the same value. So, no I don't think it's a feasible attack
>> vector any time soon.
>>
>> Besides, with that kind of hashing power, it might be more feasible to
>> cause problems in the chain by e.g. constantly splitting it.
>>
>
> OK, maybe im being *way* too paranoid here ... but what if someone had
> access to github, could they replace one file with one they had prepared at
> some point?
>
>
>>
>>
>> On 1 April 2013 03:26, Melvin Carvalho <melvincarvalho at gmail.com> wrote:
>>
>>> I was just looking at:
>>>
>>> https://bitcointalk.org/index.php?topic=4571.0
>>>
>>> I'm just curious if there is a possible attack vector here based on the
>>> fact that git uses the relatively week SHA1
>>>
>>> Could a seemingly innocuous pull request generate another file with a
>>> backdoor/nonce combination that slips under the radar?
>>>
>>> Apologies if this has come up before ...
>>>
>>>
>>> ------------------------------------------------------------------------------
>>> Own the Future-Intel® Level Up Game Demo Contest 2013
>>> Rise to greatness in Intel's independent game demo contest.
>>> Compete for recognition, cash, and the chance to get your game
>>> on Steam. $5K grand prize plus 10 genre and skill prizes.
>>> Submit your demo by 6/6/13. http://p.sf.net/sfu/intel_levelupd2d
>>> _______________________________________________
>>> Bitcoin-development mailing list
>>> Bitcoin-development at lists.sourceforge.net
>>> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>>>
>>>
>>
>
>
> ------------------------------------------------------------------------------
> Own the Future-Intel® Level Up Game Demo Contest 2013
> Rise to greatness in Intel's independent game demo contest.
> Compete for recognition, cash, and the chance to get your game
> on Steam. $5K grand prize plus 10 genre and skill prizes.
> Submit your demo by 6/6/13. http://p.sf.net/sfu/intel_levelupd2d
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20130402/85ab62f9/attachment.html>;
Will [ARCHIVE] /
npub1xe…zrjrx
2023-06-07 11:42:40
in reply to nevent1q…5utf
Author Public Key
npub1xe4sg9zgsm90v8ge3r0h29jmwjuudcldxfwczaazuph5y5020jvqpzrjrxPublished at
2023-06-07 11:42:40Event JSON
{
"id": "3efe45f546771d917cf4f27e9989fbfa92c511b8c7ef70f92ed10ee57fe7588e",
"pubkey": "366b04144886caf61d1988df75165b74b9c6e3ed325d8177a2e06f4251ea7c98",
"created_at": 1686138160,
"kind": 1,
"tags": [
[
"e",
"376915607cf28908297a49c1e3bfa7d2a09a4c98505d9700468cfd7dda18d84b",
"",
"root"
],
[
"e",
"a0137e91f24e3a2aba2ec7252d6e9b6f1c640b7d9b764f05e2f6757a1eae59e8",
"",
"reply"
],
[
"p",
"e316966328c4cb66c34719ef9a7b3bc54ef601663ad4ab06185991237735aa19"
]
],
"content": "📅 Original date posted:2013-04-01\n📝 Original message:The threat of a SHA1 collision attack to insert a malicious pull request\nare tiny compared with the other threats - e.g. github being compromised,\none of the core developers' passwords being compromised, one of the core\ndevelopers going rogue, sourceforge (distribution site) being compromised\netc etc... believe me there's a lot more to worry about than a SHA1\nattack...\n\nNot meaning to scare, just to put things in perspective - this is why we\nall need to peer review each others commits and keep an eye out for\nsuspicious commits, leverage the benefits of this project being open source\nand easily peer reviewed.\n\nWill\n\n\nOn 1 April 2013 23:52, Melvin Carvalho \u003cmelvincarvalho at gmail.com\u003e wrote:\n\n\u003e\n\u003e\n\u003e\n\u003e On 1 April 2013 20:28, Petr Praus \u003cpetr at praus.net\u003e wrote:\n\u003e\n\u003e\u003e An attacker would have to find a collision between two specific pieces of\n\u003e\u003e code - his malicious code and a useful innoculous code that would be\n\u003e\u003e accepted as pull request. This is the second, much harder case in the\n\u003e\u003e birthday problem. When people talk about SHA-1 being broken they actually\n\u003e\u003e mean the first case in the birthday problem - find any two arbitrary values\n\u003e\u003e that hash to the same value. So, no I don't think it's a feasible attack\n\u003e\u003e vector any time soon.\n\u003e\u003e\n\u003e\u003e Besides, with that kind of hashing power, it might be more feasible to\n\u003e\u003e cause problems in the chain by e.g. constantly splitting it.\n\u003e\u003e\n\u003e\n\u003e OK, maybe im being *way* too paranoid here ... but what if someone had\n\u003e access to github, could they replace one file with one they had prepared at\n\u003e some point?\n\u003e\n\u003e\n\u003e\u003e\n\u003e\u003e\n\u003e\u003e On 1 April 2013 03:26, Melvin Carvalho \u003cmelvincarvalho at gmail.com\u003e wrote:\n\u003e\u003e\n\u003e\u003e\u003e I was just looking at:\n\u003e\u003e\u003e\n\u003e\u003e\u003e https://bitcointalk.org/index.php?topic=4571.0\n\u003e\u003e\u003e\n\u003e\u003e\u003e I'm just curious if there is a possible attack vector here based on the\n\u003e\u003e\u003e fact that git uses the relatively week SHA1\n\u003e\u003e\u003e\n\u003e\u003e\u003e Could a seemingly innocuous pull request generate another file with a\n\u003e\u003e\u003e backdoor/nonce combination that slips under the radar?\n\u003e\u003e\u003e\n\u003e\u003e\u003e Apologies if this has come up before ...\n\u003e\u003e\u003e\n\u003e\u003e\u003e\n\u003e\u003e\u003e ------------------------------------------------------------------------------\n\u003e\u003e\u003e Own the Future-Intel\u0026reg; Level Up Game Demo Contest 2013\n\u003e\u003e\u003e Rise to greatness in Intel's independent game demo contest.\n\u003e\u003e\u003e Compete for recognition, cash, and the chance to get your game\n\u003e\u003e\u003e on Steam. $5K grand prize plus 10 genre and skill prizes.\n\u003e\u003e\u003e Submit your demo by 6/6/13. http://p.sf.net/sfu/intel_levelupd2d\n\u003e\u003e\u003e _______________________________________________\n\u003e\u003e\u003e Bitcoin-development mailing list\n\u003e\u003e\u003e Bitcoin-development at lists.sourceforge.net\n\u003e\u003e\u003e https://lists.sourceforge.net/lists/listinfo/bitcoin-development\n\u003e\u003e\u003e\n\u003e\u003e\u003e\n\u003e\u003e\n\u003e\n\u003e\n\u003e ------------------------------------------------------------------------------\n\u003e Own the Future-Intel\u0026reg; Level Up Game Demo Contest 2013\n\u003e Rise to greatness in Intel's independent game demo contest.\n\u003e Compete for recognition, cash, and the chance to get your game\n\u003e on Steam. $5K grand prize plus 10 genre and skill prizes.\n\u003e Submit your demo by 6/6/13. http://p.sf.net/sfu/intel_levelupd2d\n\u003e _______________________________________________\n\u003e Bitcoin-development mailing list\n\u003e Bitcoin-development at lists.sourceforge.net\n\u003e https://lists.sourceforge.net/lists/listinfo/bitcoin-development\n\u003e\n\u003e\n-------------- next part --------------\nAn HTML attachment was scrubbed...\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20130402/85ab62f9/attachment.html\u003e",
"sig": "abee9c17164224a1d25c50a12911d6d5b0434a779cd8f03714f47ae947fc6dc123139b0c6647d9305120ae0bf169fa6126b5a0faf285f6b15749c723f0f0a544"
}