I would say it seems Github thought it would make a difference, based on their request for 48 more hours.
Why do you think it won't make a difference to them in light of them specifically requesting 48 more hours?
Why do you think it won't make a difference to them in light of them specifically requesting 48 more hours?
> Github responds and mentions that they won't be disabling the vulnerable commands by 2020-11-02. They request an additional 48 hours, not to fix the issue, but to notify customers and determine a "hard date" at some point in the future.
The issue isn't really with GitHub not making the fix available, but the issue is that if they turn it off now they will break legions of builds. I think the Project Zero disclosure issue for them then is more for pointy haired manager appearances ("Oh no! Github has a disclosed Project Zero vuln!") than for any real difference in security.