You are right. However this cost should really be imposed on the multi-billion-dollar business and not on the author of the hobby app.

How should that work? Nobody knows who is using which part from which repo. And it's not just about big business. There are all kind of small communities and little apps, extensions, etc. with some small communities. Most of them don't even make money, but are juicy targets for some small fast money.

Forcing everyone to raise their security and gain awareness about those things is a huge win for everyone, and only a little problem for the individual user. And it seems to be only a phase anyway, as most people & services are moving to more comfortable solutions over time.

Billion-dollar businesses can pay full-time professionals for support. They can hire staff or contract with a vendor. They can audit the free software they use or, like the good old days, pay for software whose vendors maintain it.

Or they can use hobbyist-written software for free, which is just fine, but don’t expect the hobbyist to support it for free.

> How should that work?

By the users of the software I publish noticing the license that states that while I hope this software is useful to them, it is provided with `"NO WARRANTY, NOT EVEN FOR FITNESS OF PURPOSE" and planning accordingly.

If you're an entity that wants to ensure that software you use from a source that you have approximately zero power over (and has explicitly provided NO warranty for that software) is and continues to be fit for purpose, you're going to have to inspect that software at a point in time, determine if it is fit for your purposes, and carefully inspect every future version of that software that you're considering using.

There really are no shortcuts. Requiring one to drink a Confirmation Can to log in doesn't change the math here.

> How should that work?

Fork and change the readme to reflect that this version is hardened for big business.

So implement those tighter security controls when they make sense. Don't force them on everyone when only a small fraction of cases are worthwhile.

Why should a multi-billion dollar business or a million other projects trust my code simply because GitHub made me 2FA to sign in? I may well decide the next push rewrites half the project in a breaking way on a whim or get an offer for $100k to give control of the project to the bad actor or just decide I don't like big corp anyway and be the bad actor myself.

Turning providing source code into promising you'll follow other's desires on how it should be worked on is a recipe for disaster while simultaneously not really making hobby projects low risk to rely on anyways.

I think it's more about GitHub's image and its self-imposed viewpoint that it needs to keep the software landscape secure. Requiring 2fa drastically reduces the number of ways a repo that is a building block for x% of a country's GDP gets compromised - now the only path is if the author intentionally hands over the repo/their account to a bad actor or e.g. posts their 2fa secrets on the internet for anyone to use.

There are also plenty more ways for it get compromised which don't involve the owner handing over anything - say simply accepting a merge which adds a cool feature while still compromising the other users of the project. Github still gets the same marginal image impact risk because ultimately the security of billions of dollars or X% of a country's GDP isn't protected by requiring a hobby developer to 2FA their afternoon code changes. You can't make them interested in protecting your billions via secure account login. Instead it's done by the billion dollar companies or countries themselves because they are the only ones with resources large enough to protect that much asset in a useful way. All this ignoring the same impact can be had by the author simply having a mistake and not fixing it over holiday vacation, no malicious actors required in the first place.