Vicent Martí(@vmg):Scott is right. The SHA256 default in Git 3 is an extremely expensive piece of security theater. My advice: when Git 3 ships, stay the fuck away from SHA256 repositories because they are _not_ going to work at launch, and it'll be many years until they do.

2026.10.01 14:36

Scott is right. The SHA256 default in Git 3 is an extremely expensive piece of security theater. My advice: when Git 3 ships, stay the fuck away from SHA256 repositories because they are _not_ going to work at launch, and it'll be many years until they do.

Scott Chacon@chacon

2026.10.01 14:00

Working on the Git Merge conf videos and watching @nasamuffin's excellent SHA-256 talk, I was again filled with the dread of Git 3.0's upcoming hashing default switch. I wrote up why I feel this is a huge mistake and why I think it shouldn't be done:

Forward to community