[mpyne]

That's true, and AFAIK Linus says much the same. SHA1 is used for practical purposes and not security in the face of a determined attacker with cryptanalytic ability.