Your decision makes me sad. GitHub is doing something the world needs: putting better security on a huge chunk of the open source software that is shared and r

Your decision makes me sad. GitHub is doing something the world needs: putting better security on a huge chunk of the open source software that is shared and relied upon by literally all of humanity. Any repo, anywhere, has the chance to become a part of the open source ecosystem. Strongly authenticated developer accounts on those repos is critical for everyone's security. It sucks that we are here, but here we are. Password managers are almost enough to save us, but not quite. I think it is fair to complain about particular factors of 2FA (e.g. TOTP or Yubikey or iPhone Passkey or SMS or whatever). And it's fair to complain that the session timeout on a strongly authenticated persistent session cookie should be user-managed (30 days? no problem! 90 days? I trust my device enough for an API key, why not a cookie?). And all your command-line stuff is already API key-based on GitHub... But good 2FA offers real security against a lot of threats. I hope more people embrace it.