I quite agree. Not every GitHub account is mission critical. Some are created only to submit homework or to segregate one's online identity. Adding mandatory 2FA is an additional burden, especially if Microsoft ever decide to enforce the use of mobile numbers.

It's more shocking that you can even create accounts at all without MFA in this day and age, especially something like GitHub.

Not everything needs to be treated as a mission-critical account of the highest importance. I recently had an app for a home appliance ask me to set up 2FA. Yeah, sure, because my IoT dishwasher or plant monitor is such a critical respurce worth protecting.

If someone really knows what they are doing, let them not use 2FA. GitHub is different from Facebook, in that we're supposed to know what we're doing with technology. Let hacking sort out the stragglers.

"knows what they're doing" doesn't have anything to do with it. If you don't have MFA, your account is going to get compromised by one of the billion bots trying to get it. Tell me you don't understand basic security without telling me you don't understand basic security.

That's not how it works. I have strong randomly-generated passwords for most sites, and store them in a password manager that I only ever load on ~3 devices that I completely trust and own. Short of typing the password in on a compromised machine, a "forgot password" reset (via the website or customer support), or being incautious enough to log in via a phishing form, I see no way that my accounts can be compromised.

And as I said, for some accounts, there are no consequences if they are compromised.

I have a few accounts I view as valuable enough to enable 2FA on.

This change in Github will just lead to me either being more annoyed or storing the TOTP generator code in my password manager.