Sure, someone could hack your computer and get access to your GitHub, but if they're already on your computer, they can just change the code and do a git push too.
Probably feasible for most users of HN, but prohibitively expensive for millions around the world. Using a phone for 2FA is not great:
1. You can lose it. 2. If you're backing up 2FA to the cloud, then it's not 2FA any more. 3. If you use a password manager on your phone, then both factors are the same, it's not really 2FA.
And it significantly degrades the user experience by requiring you have both devices available when you create an account to have any kind of backup.
the end result will be that i won't be contributing code on github anymore but rather copy the project elsewhere and tell the developers where to pull my patches from.
And for people that are unable or refuse to use a secondary device, there's no technical reason you can't run a TOPT app on your desktop.
Clearly communicating a bunch of different options would be helpful for people.
Personally, I have 2 yubikeys, Authy synced to multiple devices, and the backup codes. There a bunch of options with different tradeoffs.
2FA doesn't mean only SMS or smartphone app.
I personally have 2 yubikeys registered as the second factor and it works great. They last years w/o any problem.
The backup codes have a "nearly never used" issue: since they're nearly never used, it's easy to forget where you put that piece of paper (I vaguely know where mine might be located, but I'd have to lose some time searching for it if I ever needed it).
And there's also the risk that the "something bad" affects both the TOTP device and the backup codes. If your home is flooded, for instance, you might lose to water damage both the piece of paper where the backup codes are and your mobile phone.