GitHub shouldn't allow username reuse
Title is a little bit hyperbolic.  I get that it's a real issue that needs fixing, but a GitHub URL is not a secure package identifier, it was never designed this way, and it's an unfortunate hack that it's become a defacto standard.What we really need is for language-level package managers to support signed immutable packages, and for that to start being taken seriously above the OS-level.Edit: author changed the title, it used to say something about a "GitHub's security facepalm"