> so long as the namespaces guarantee uniqueness in the package identity

There are existing issues from this not being the case. Uniqueness of names can only be guaranteed in a single repository and this causes many problems for people pulling from multiple enterprise repos (because everyone packages their own ruby for example).

> Many people like Nix, but many people also don't understand how it works, and thus it will work until it doesn't, and then you'll be stuck.

Considering git still uses sha1 and just about all of web cryptography uses sha1 or sha256 for signatures, block deduplication uses typically 128b hashes, etc., we'll have other problems way before this becomes a problem for nix.

Basically you're worried about a collision in nix, when the whole stack of 10 different things leading to you even reading an article about nix already relies on no collisions.

This will not be an accidental issue within multiples of our lifetimes, and malicious actors will not 0day some nix package in public.