Or Java where you get 80 char of namespaces that may or may not change because the library moved to be an eclipse project.

Or at least have a strong convention that all project namespaces be url-like. That's what Java did decades ago, and it remains one of the ecosystems which care the most about traceability.

Sure, the actual url may drift from the namespace, but at least you've got a much more google-able starting point than "lxml" or whatever.

It's trivial to sign a malicious package with a signature.

The problem is to check and make sure it's signed with the signature

Depends cannot be resolved offline, and time becomes a factor for the correctness of code (i.e. you fetch a dependency, code against it, dependency changes public API, coworker fetches your code, fetches the dependency, build is now inexplicably broken).

Not to mention DNS hijacking, BGP, caching, locality, etc. can all affect how dependencies are fetched. Further, not using a registry makes in-house mirrors a nightmare due to having to re-route DNS requests all the time.

It's an all around _terrible_ feature in my opinion and I am very careful to distance myself from any project claiming otherwise.

    import (
     "fmt"
     "github.com/dimuska139/go-email-normalizer"
    )
    
    func main() {
     fmt.Println(emailnormalizer.NewNormalizer().Normalize("[email protected]"))
    }

The package name is only the same as the last part of the URL in go by convention, and importing a package can put an arbitrary package identifier into your package scope.

    import (
            "fmt"

            emailnormalizer "github.com/dimuska139/go-email-normalizer"
    )

You can pip install from a github URL, preferably with a branch rather than master.

I would also guess many packages would be hosted on github: `pip install popular-org.github.io/package` which could be typo-squatted by creating a similar sounding github user `pip install poplar-org.github.io/package`.