Namespaces for the Python Package Index

I once heard the theory that typosquatting is largely not a problem in the Java ecosystem because these reverse DNS group names make artifact names so long that on one actually types them out; people copy them from elsewhere (e.g. search.maven.com, Github, etc) which makes it much harder to trick people into copying wrong artifact names. And there are probably way to many potential typos to attempt typosquatting on Maven Central.

I actually really like the Java naming system; I think it's one of the few things Java really got right from the start. I believe it helps to manage trust because you can selectively delegate trust along the namespace hierarchy. It also supports routing in proxy repositories: You can summarily accept certain root namespaces into your proxy repository, require manual verification for others (e.g. the whole io.github hierarchy), and make sure that your own "com.example.your-company.internal" packages never get resolved from a public repository.

It also moves load off maintainers in a central repository: Sonatype can afford a comparatively strict and cumbersome application process, because they only check group names once, whereas moderation on PyPi or crates.io has no chance but to check each and every package.

All this is somewhat impossible to do with flat packaging as in Rust or Python. Sure these names are harder to type out, but that's what tooling exists for, in my opinion.