But to your comment: I'm not arguing the same, I'm arguing that the results are the same. If I'm consuming packages from a repo, and I care about the security of the thing I'm running, I need to think about how I know I'm getting legitimate code that does what I expect it to do. One of the risks to that is malicious developers at the package level (either outright malicious or stolen publish credentials). Another is malicious substitution by the package repo. The detection strategies and next steps are different but as a consumer of code, bad code is a risk regardless of who injects it.
Think about all of the organisational structures you know of.
Then ask yourself how is a cooperative fundamentally untrustworthy?
Again, a domain name is pretty minor in the scope of this whole fiasco, and I wouldn't have bothered with bringing up this point, but on balance I agree with it.
Can you explain what the issue is?
Honestly, after "tweet" caught on as a verb, I've given up on thinking that we have any sort of crystal ball when it comes to names.
https://en.wikipedia.org/wiki/Cooperative
It's a word that nicely captures their objectives.
Gaslight much? "coop" implies intention and direction...you know, that thing that rubygems.org could have used?
