Earlier quoted context omitted.
As I mentioned, my comment is meant as an exercise. If we were to take the numbers more seriously, due diligence is necessary. That said, if we assume that one incident does not affect the other, then the Poisson nature falls out as a natural consequence of that independence and the assumption of a constant rate (our Null hypothesis). As long as the incidents are spaced out enough, that the possibility of one inciden…
But why even start with an assumption that is so likely to be wrong? We know that incidents are frequently correlated. We know that scale and complexity add fragility. We know that GitHub has gotten bigger and more complex. The chance of the probability distribution holding constant over 5 years of major growth is basically zero.
Strictly speaking, when looked at through a fine toothed comb, yes the assumptions are very likely wrong. All models are wrong [0], but some of them are useful.
The question is can we get some useful conclusions from such a simple model. In my experience I have been surprised by how often low failure rates are captured well by Poisson processes. Yes the assumptions could be wrong, but are they very likely to lead to wrong conclusions ? Empirical experience and math says otherwise.
There are sound reasons for why this happens. If you are interested, you can pick that up from Feller. These [1] [2] links might also help.
Given the data that we have, its a plenty good first cut, but that's what it is -- a first cut. With more data one can do a more refined analysis.
[0] https://en.wikipedia.org/wiki/All_models_are_wrong
[1] https://en.wikipedia.org/wiki/Poisson_point_process#Approxim...
[2] https://en.wikipedia.org/wiki/Poisson_point_process#Converge...