Hacker News new | ask | show | jobs
by CGamesPlay 283 days ago
Why not by SHA?
1 comments

Dates make pinning easier than looking up a SHA
Easier for humans to parse, but introduces the threat vector of malicious attackers modifying the history and force submitting malicious code at or before a pinned time. That's why lock files exist.

SHA is still the way to go for those who are security sensitive.

Fair. If we're talking about documenting this feature, we should point out that SHA is immutable, while branches, tags, and dates are mutable references.