Hash Collision Security

I believe this is only an issue if you can produce collisions for the underlying hash function. SHA256 is still considered safe against that.

There's no point in using a hashing algorithm that can be maliciously collided.

Can you elaborate? Are you thinking of intentional SHA-1 has collisions? Would that work in practice?

No, this is far too glib, and the last part is wrong. See https://www.hashcollision.org/brainfudge/ instead.

You can’t efficiently create hash collisions in a cryptographic hash

…and if so, do they mitigate against hash collision attacks?

SHA1 collision was never much of a reason to change it in the first place; there is no practical attack that arises from it.

MD5 hash collisions are unlikely to happen at random. The defect was that you can make it happen purposefully, making it useless for security.

It is often declared that SHA-1 is broken, but in fact still nobody can take code A and find a different code B that hashes to the same SHA1 value, which is what git is concerned about. Even long ridiculed and buried MD5 is still perfectly secure in that sense.

Is it better? The suggestion is vulnerable to a sha256 collision attack.