GitHub shouldn't allow username reuse
Title is a little bit hyperbolic.  I get that it's a real issue that needs fixing, but a GitHub URL is not a secure package identifier, it was never designed this way, and it's an unfortunate hack that it's become a defacto standard.<p>What we really need is for language-level package managers to support signed immutable packages, and for that to start being taken seriously above the OS-level.<p><i>Edit: author changed the title, it used to say something about a "GitHub's security facepalm"</i>