[lmm]

It's not just the hosting, it's decoupled from where the project is hosted. Some packages do just use an arbitrary groupId. The reversed-domain-name convention makes sure you'll never get two different groups claiming the same name, and aligns with the convention for how code is namespaced in Java, but it is ultimately only a convention.

[M2Ys4U]

>The reversed-domain-name convention makes sure you'll never get two different groups claiming the same name

Surely that's only true at any one instant? Domain names change hands all the time.

For example: All non-EU citizens in the UK that have .eu domain will have them forcibly de-registered at the end of the year. What happens to a eu.example.foo package then?

[lmm]

True, but it's hard to imagine a developer accidentally buying a domain that had previously been used by an unrelated developer and wanting to release packages under the same namespace.