The logout link is rendered with the token in its query string

Wouldn't this still allow logging in without consent if they aren't logged in?

It does. We haven't rolled out the fix that Nick described (https://news.ycombinator.com/item?id=11178922) because it will probably break a bunch of the third party apps and scrapers that give people alternative interfaces to HN. Those have value and I'd rather not make their lives more difficult unless/until it's necessary.

Finally, some clarification on which hacker news it is. I care less about the hacker news with the "the"

I have implemented CSRF for the public API I work on and all PUT/POST requests require the CSRF token, not GET requests. In this case, the login form uses a POST request and thus must require a CSRF token to avoid an attack on users that aren't logged in.

What stops an attacker from requesting the CSRF token?

Same-origin policy.

That only applies to browsers. I can request it from my server just fine. See https://news.ycombinator.com/item?id=11178922