We鈥檙e definitely off-topic @kyrofa but I鈥檒l remark that Canonical (you) is deciding what to support and what not. Alias Robotics volunteered to put the resources (our time
) to support these projects. To drive them and to continue bringing value to the community as reasoned at REQUEST: Add project Robot Vulnerability Database (RVD) 路 Issue #6 路 ros-security/community 路 GitHub. You鈥檙e just discarding efforts because it simply doesn鈥檛 align with your interests! With Ubuntu鈥檚 interests.
I think nobody expects you to get involved. In a group, there are different projects, led by different sub-groups (look at how it鈥檚 happening elsewere). It鈥檇 certainly be great to get more and more people interested in looking for security flaws in ROS code, and beyond running a static analyzer and filing PRs (
), reasoning about PoCs, priorizing tickets based on severity and/or eventually (I hope), accelerating the mitigation of the many security flaws existing in ROS.
After so many years contributing to ROS, I鈥檓 surprised see how groups like the Security WG (which by the way, Alias has been pushing since earlier you even joined) are being lobbied by a single company this way. There has never been an open discussion about our contributions to the group and proposals. And frankly, you鈥檙e coming up with rules on-the-go.
Worse, the WG is now halving now its activity, decreasing more and more! But you (yourself) get to decide what鈥檚 worth maintaining and what鈥檚 not? Come on!
Wanna make things right? Start accepting contributions, bring things up to proper group discussions and encourage contributions in other directions, not just in the one that you鈥檙e lobbying for.