Gemnasium is acquired by GitLab
gemnasium.com
gemnasium.com
They don’t explain what they think GitHub should, or even could, have done instead. Should GitHub have stopped improving their product, even in ways like the ones mentioned (package distribution, minimal issue management, security scanning) that were obvious and in-demand years ago?
To me, the post doesn’t acknowledge that GitHub did nothing wrong or even unpredictable, and Gemnasium accepts full responsibility for the outcome.
Another way to write the GitHub-related part of this post would be “We had years to make this a business before GitHub acted on customer requests for things that customers obviously wanted. GitHub actually moved slowly enough that we had more time than any reasonable entrepreneur might have expected. We couldn’t.”
However, if your business can be pretty much wiped out by another company simply adding a new feature to their own product, well, one could argue that you didn't really have much of a product to begin with.
Just because GitHub offers a minimal version of something doesn't mean all others will become "useless just a few month later." It means the partner product will need to be more sophisticated, or provide a better customer experience, or obtain additional distribution/direct access to their customers, or solve some other problem too, or accept a smaller addressable market. Basically, compete.
If your statement was true, every AWS product would have made every other competitor "useless." For example, Amazon SES would have obsoleted Sendgrid, Postmark, and many other high-volume email delivery providers. While SES certainly made other vendors adapt, it didn't become impossible to succeed at email delivery. GitHub didn't make it impossible to succeed at dependency security management, either.
It would be fair for Gemnasium to say that Gemnasium tried to build a business that depended almost entirely on GitHub for distribution, and that turned out to be a poor risk. That was Gemnasium's choice, though, not GitHub's.