Sourceforge Attack: Full Report

Posted Feb 1, 2011 12:02 UTC (Tue) by dpotapov (guest, #46495)
In reply to: Sourceforge Attack: Full Report by rbrito
Parent article: Sourceforge Attack: Full Report

> are other DVCSes the same way as git, with hashes and so on?

Mercurial uses SHA1 hashes in the same way as git, and both of them borrowed this idea from Monotone. Bazaar also uses SHA1 for integrity checking, but it relies UUIDs to identify revisions. If you signed your revisions in Bazaar (with gpg), they cannot be forged, but I don't know Bazaar well enough to tell what happens with non-signed revisions.