When they improve their netops chops. Their recent junior-level mistakes (like improper spanning tree settings) are an indication of the level of their skill in this area.

I thought spanning trees were elected/discovered automatically by the routers themselves instead of being manually set up.

Yes and no :)

The tree is built up automatically but you can weight the paths and also which is the start node of the tree. There are also a lot of settings that may or may not completely fuck you over or fix a problem.

Also you really want to disable STP on ports going to servers as this will 1) speed up recovery 2) prevent any malicious packets going out from them.

Not everybody has the Google-like resources to maintain thousands of fallback servers, and failing that often there isn't much one can do against a well distributed DDoS.

Questions in case of Github remain: Who and why Its not like DDoSing a target of this size is totally 'free'.

We should first now the size of the attack and how many zombies are participating.

With all the exploits out there coming out on a nearly daily basis it's not exactly either as if having an army of a few tens of thousands of zombies was expensive...