I was reading http://blog.zorinaq.com/?e=74 which is about a Windows kernel developer. The developer proves that he is an actual developer by posting the SHA1 hash of a particular revision of a file. The actual hash values have been redacted, but I would like to know how knowledge of the hash would prove this.
$\begingroup$
$\endgroup$
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
1
It doesn't really prove it, and isn't meant to. If he really does know the hash, it's most likely that he has access to the source tree, which almost certainly means he knows more about Microsoft's corporate culture than the average person, which is the most important bit (if he's a Microsoft dev, he also has little incentive to claim to be a kernel dev if he's, say, a UI dev; either one gives him some authority on the subject). The issue is that only another person with source access can verify the hash, but it means that if he made up the hash, someone with source access could go "No, the hash is this instead" -- that's not something subjective, so it wouldn't just be a difference of opinion.
The hash specifically gives some piece of information that strongly implies he has access to the full file (and the full source tree), without actually giving out the file (which is a trade secret). It's not much different than saying "revision 102 had this timestamp," or "the combo to the supply closet last year was 1-2-3-4-5," or (leaving aside privacy) "here's my business card." It doesn't, and isn't intended to, provide a real proof; it just makes it a bit more likely he has some idea what he's talking about, which is the real goal.
-
$\begingroup$ I would disagree that it gives any credence whatsoever that he has access to the file. I say this because I have access to that file at that revision, and the SHA1 hash is actually
fc4df56ce275e7981ee93a0c3138bfc68aa1d97a. $\endgroup$ Jan 19, 2015 at 21:19