Here is a repository on Github. Look at the commit hashes — they count!
This was fairly easily accomplished. In constructing the commit hash, git uses
the full timestamp (alas, second precision only) as well as the commit message.
Meanwhile, the default abbreviated hash is seven hexadecimal digits long. So,
if we just guess \(\sim 3 \times 10^8\) different times and commit messages
(while holding the actual content of the commit fixed), we’ll probably find one
that yields a hash that begins with the desired seven digits.
Some care is required. If we demand that all 7 digits be the desired value and
don’t change the commit message, then we may need to shift the commit date by
several years. We either control only the first few characters of the hash, or
we must accept changing something about the commit itself (probably the
Variations on this trick are possible, with a bit more effort. For instance,
one can take an existing repository and shift commits forward or backward by a
few seconds, in order to get the first couple characters of the hashes to be
desired values. The repository would look perfectly normal in all other
respects, but would encode a secret message (hence “git steganography”).
More interestingly, this sort of trick can be used maliciously! Suppose you’re
preparing a large changeset for a popular repository that does merges, not
rebases. The commits you prepare will be in the repository for all time. It’s
computationally cheap to tweak the first byte of every hash to encode a desired
message (“Henry’s marriage to Anne Boleyn is invalid”). However, it’s
expensive (in a different sense) to remove that message. All people who are
watching the repository will have to force-pull. This makes people suspicious,
and so the circumstances must be explained. The censorship cannot be