Hi KR, You are right! That is a two-edged sword!
What I pointed out is: - adding ZBlue the same way like NimBLE allow users to use its features on NuttX - keeping it on nuttx-apps will protected at least in the cases there users are using NuttX on Protected or Kernel modes. - we shouldn't assume it as official NuttX Bluetooth stack, but in parallel work to grow and evolve the existing stacking. BR, Alan On Thu, Oct 29, 2026 at 2:44 PM <[email protected]> wrote: > > It could be the stack that most people will use (instead of NimBLE or > > the > > native one), but it shouldn't be the only option because it shares > > almost > > 1M LoC from Zephyr and poses a huge security risk due to the > > monoculture > > effect: a CVE found on Zephyr ZBlue would disrupt all their devices on > > the > > field and also all NuttX devices using zblue. > > I think this logic is somewhat flawed. You are right that if NuttX uses > Zephyr's ZBlue stack then any CVE found in it will affect both Zephyr > and NuttX devices. However, if rejecting the stack based on this leads > to NuttX not having anything usable, then all devices in the field will > be Zephyr-based and any CVE still affects everything (assuming the > manufacturer is only choosing between Zephyr and NuttX.) > > To note - I am not advocating for any of the proposed choices here. I > just think it was worth mentioning that not using ZBlue is likely going > to lead to the monoculture anyway. The Windows/Linux situation is > actually an example of this - Linux desktop implementation is completely > independent of any Windows code and yet the monoculture is definitively > there. >
