It could be the stack that most people will use (instead of NimBLE or
the
native one), but it shouldn't be the only option because it shares
almost
1M LoC from Zephyr and poses a huge security risk due to the
monoculture
effect: a CVE found on Zephyr ZBlue would disrupt all their devices on
the
field and also all NuttX devices using zblue.
I think this logic is somewhat flawed. You are right that if NuttX uses
Zephyr's ZBlue stack then any CVE found in it will affect both Zephyr
and NuttX devices. However, if rejecting the stack based on this leads
to NuttX not having anything usable, then all devices in the field will
be Zephyr-based and any CVE still affects everything (assuming the
manufacturer is only choosing between Zephyr and NuttX.)
To note - I am not advocating for any of the proposed choices here. I
just think it was worth mentioning that not using ZBlue is likely going
to lead to the monoculture anyway. The Windows/Linux situation is
actually an example of this - Linux desktop implementation is completely
independent of any Windows code and yet the monoculture is definitively
there.
