This might not be a feasible reaction to the attacks, but in my mind the people who are "unsuspecting attackers" aren't necessarily trying to access GitHub in t

This might not be a feasible reaction to the attacks, but in my mind the people who are "unsuspecting attackers" aren't necessarily trying to access GitHub in the first place. So, what if they set up automated rule to block all IPs (for a period of time) who show traffic patterns that indicate they are part of the attack, and then for all those IPs who are trying to reach GitHub purposefully but are currently blocked, give them explicit instructions on how to tunnel to regain access to GitHub while the attack continues. This way only those who are (a) part of the attack, and (b) want to access resources on GitHub need to do anything special. My guess is the number who would truly be affected by this are a tiny fraction of the total number of people who are part of the attack.