That's what I originally assumed, but is this actually ever successful with companies like that?
I honestly doubt it's successful for anyone. No matter the size of the site, the amount of money you would pay a DDoS mitigation provider, either on a full-time basis or just to stop a current attack, would generally be considerably less than the ransom asked for, with the bonus of having your site be available much more often.
Sounds like that's successful for the DDoS mitigation provider.
does github really count as a startup still? they're not inducted into programmatic canon yet?
I suppose they're past the startup phase; you're right - I just never noticed the transition from 'startup' to 'company,' because the culture has stayed the same (as well as development pace, and quality).