Many people appear to be accusing the author of being hyperbolic, saying "well, you shouldn't be relying on github urls being real." This is true, but it misses the point: whether they should have or not, people ARE using the technology in this way. GitHub can either take an ideological stand and continue allowing people to be unknowingly exposed to an attack surface, or they can make a reasonable effort to defend against malicious usage of their service. Perhaps there are material reasons why it would be wrong or prohibitively difficult for them to change their username policy, but if it isn't, I don't think it's unreasonable to request this of them while simultaneously admonishing people who assuming data from github will always be accurate.

Put another way, I would _also_ upvote an article that said "The Go package manager is insecure because it assumes github URLs never change owners."