Really now? Mind if I challenge you?
I have on my machine a git repo with commit '75eb4e3b1369706a4dcd61cc80e49660ac341ea4'.
If you can give me a second git repo with such a commit containing different contents, I'll happily send you $10k USD, or donate it to a charity of your choice.
Calculating that SHA1 collision is going to be a bit more expensive than $10k, by a couple of orders of magnitude.
Finding it in the wild is improbable, but calculating it is definitely possible, and has been done before. http://shattered.io/
SHA1 is certainly insecure at this point, but not even close to trivially so.
We know it's theoretically possible. And we also know that this theoretical possibility is within the reach of a couple of countries.
In contrast, this "challenge" stuff is just chasing outage endorphins and internet points.
Think it through, and it's pointless. Any refusal or negative result is utterly compromised and confounded by things like: How trustworthy you appear; whether the amount is reasonable; whether the random commenter has the skillset, free time, and financial assets to try; whether they're part of a larger group they can recruit; etc.
"In certain scenarios I could be a ninja": it means absolutely nothing without proving that I actually have the skills and I could actually use them.
It is not pointless, but if you claim something show the proof.
Do you not accept those? What would you accept as a proof of concept?
_That is enough to distribute malicious code though, at least in certain scenarios. Someone might create a setup where reviewers check/sign one version of the source code, and what gets distributed is another version with the same hash._
Here's the easiest to explain way: Upload the malicious version of the file to github. Send an innocuous patch to the kernel devs that creates a file with the same hash. It gets accepted, and anyone that downloads the kernel from github gets the malicious version. Done. That's a small fraction of linux downloaders, but this is just the proof of concept.
And with the current surge of GPU's even collisions are realistic now. The H100's are not doing much when not in training.
Further up in contribution tree there is additional signing. Would that further complicate the insertion of a false commit? I am not convinced that signing is used all the way down to every contribution.
Preimage attacks are very different from collision attacks.
Where did you get this number from? I was under impression that this is completely infeasible (just like we can generate a collision good md5 in seconds, but we still can't do a preimage attack).