> While the Java ecosystem tends to get a lot of criticism, this is one thing they got right: fetching a package name from a public repository involves prefixi

> While the Java ecosystem tends to get a lot of criticism, this is one thing they got right: fetching a package name from a public repository involves prefixing the name with the reverse-DNS name of the uploader (the "group ID" in Java/maven parlance). Uploaders can only submit packages after they've proven they have control over the domain. That doesn't really solve the fundamental problem, though. Domains can and do change hands by various means and for various reasons having little to do with Java packaging, meaning that control of those packages can be transferred as well. It's just shifting the problem to a different place is all.