mirrors/git-annex
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions

comment

Browse source
This commit is contained in:
Joey Hess 2020-07-15 10:08:37 -04:00
parent 1bc015bff4
commit 360dc386e7
No known key found for this signature in database
GPG key ID: DB12DB0FF05F8F38
1 changed files with 16 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
doc/todo/external_backends/comment_8_e3c66820da36fe255d07059226690ca4._comment Normal file
View file

@ -0,0 +1,16 @@
[[!comment format=mdwn
username="joey"
subject="""re: verifying and external backends"""
date="2020-07-15T13:55:15Z"
content="""
It seems reasonable to assume the user trusts the backend program as much
as they do the git-annex program, when it comes to whether a hash is
cryptographically secure. They're both programs the user has decided to
use, which could do far more mischief than pretending that md5 is secure.
The suggestion that this could be used for
[[todo/option_to_add_user-specified_string_to_key]] raises its own security
concerns. (Although git's sha1 collision hardening probably will survive
until git sha256, so git-annex's attempts to prevent sha1 collisions via
user-supplied data in the content of keys are probably unncessary.)
"""]]