Git 3.0's SHA-256 switch is a costly mistake, argues GitButler founder
Git 3.0's upcoming SHA-256 default will be a costly mistake
Git 3.0 plans to switch its default hash from SHA-1 to SHA-256, but this change is a costly global train wreck with little practical benefit. SHA-1 collisions are impractical to exploit, and real attacks target trust in sources, not hashes. The migration will force the entire industry to spend time and money for negligible security gains.
I really think people should not consider the sha1 the "security". The real security is in distribution.