https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7596
RW <[email protected]> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |[email protected] --- Comment #11 from RW <[email protected]> --- (In reply to Kevin A. McGrail from comment #2) > New Policy from yesterday, not yet linked publicly: > > Details: > > Recently, a successful penetration of SHA-1 was verified, and SHA-1 is no > longer considered safe for crypto hashes This is an exaggeration, Google demonstrated a successful collision attack. A collision attack against a release would require that both the legitimate tarball and the fake be created together, so only one of you lot could pull it off. And you'd need hardware that's orders of magnitude faster than Google's to avoid some very suspicious behaviour. -- You are receiving this mail because: You are the assignee for the bug.
