https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7596
--- Comment #12 from Kevin A. McGrail <[email protected]> --- (In reply to RW from comment #11) > (In reply to Kevin A. McGrail from comment #2) > > New Policy from yesterday, not yet linked publicly: > > > > > Details: > > > > Recently, a successful penetration of SHA-1 was verified, and SHA-1 is no > > longer considered safe for crypto hashes > > This is an exaggeration, Google demonstrated a successful collision attack. > > A collision attack against a release would require that both the legitimate > tarball and the fake be created together, so only one of you lot could pull > it off. And you'd need hardware that's orders of magnitude faster than > Google's to avoid some very suspicious behaviour. Bill, I did not write that policy. I am relaying it. The SA project is superbly protected anyway because we ALSO cryptographically sign our releases as well. So there is not huge urgency to switch to sha-256+ but we should move forward with the policy that sha1 is becoming less safe to rely on. -- You are receiving this mail because: You are the assignee for the bug.
