Post by @stefano
@bularator@norden.social @rqm@exquisite.social @littlefedi_official@littleone.littlefedi.social SHA-1 is used here for deterministic UUIDv5 identifiers, as specified by the standard. Signatures and token hashes already use SHA-256. Given that specific use, I don’t consider this a serious security issue, though the collision weaknesses are something to keep in mind.
@stefano @rqm @littlefedi_official you just stop using obsolete hashes & ciphers, out of principle. Last not least for grepability. I mean, why even sha1 then? Why not rc4 or plain old cksum?
On the other hand you can just use sha256 as a direct 1:1 replacement and lose nothing.