16 ms·

Reverse Engineering Bambu Connect

532 points by pabs3 2y ago

ClassyJacket 2y ago
I'm so happy Bambu is getting what's coming to them after screwing us so badly <3
- BWStearns 2y ago
  What did they do?
  - adenta 2y ago
    They are locking down their software so you have to use it
  - bradfitz 2y ago
    https://hackaday.com/2025/01/17/new-bambu-lab-firmware-update-adds-mandatory-authorization-control-system/ https://hackaday.com/2025/01/17/new-bambu-lab-firmware-updat... has a summary that caught me up. I feel like it must be missing some of the story though.
  - bdcravens 2y ago
    They used a plugin to communicate print jobs (and other integrations), so that third party software could be used pretty seamlessly. Now they're moving to a new authentication model, and will be requiring users to send files to a separate print app. (Bambu Connect) It adds friction to the process, especially for those who were looking to run print jobs at scale, using "print farm" software or building their own solutions.
    - c0nsumer 2y ago
      I do wonder how much friction it'll really add, since the slicers can send the data to Connect via a protocol handler. It also means that Connect could act as a farm / queueing system as well, more like a print driver vs. individual printer support within the app.
      - intothemild 2y ago
        Its pretty much this, nothing seems to be blocking any third party slicer like Orca from working with bambu printers as they are now.. just the print button would now send the file to Bambu Connect, where you would most likely only press an extra button.. Getting info from the printer or AMS? MQTT still works. They specifically said they are not touching that. Sadly the usual groups of people are screaming, and the open printer people are laughing. But at worst.. this is just friction. Anyone pointing this out seems to get downvoted. But its all there in the bambu press statement and subsequent pages. Those that are upset seemed to have not read those, and instead just read or watched something inflammatory.
        c0nsumer 2y ago
        Did you happen to see this? Interesting development, they are basically going to keep the current wide-open-barely-auth'd state and call it a developer mode. And submitted a PR to make Orca Slicer work with the new auth: https://blog.bambulab.com/updates-and-third-party-integration-with-bambu-connect/ https://blog.bambulab.com/updates-and-third-party-integratio... And yeah, I'm realizing that about the downvotes. It's sad the state of things, but SKY-IS-FALLING-GET-PITCHFORKS wins the day over technical analysis, even on purportedly technical forums. But alas, that's an aside. I'm really looking forward to this rolling out, as I want to monitor my printer with Home Assistant but I /really/ don't like how much control the current (non-beta, non-future) state gives HA. I /want/ auth of some sort when submitting jobs, and it looks like I'll have that. (I also really want the slicer decoupled from the print management stuff, because I tend to keep a few slicers open and experiment.)
        bdcravens 2y ago
        My understanding is that the "addition" of the developer mode (basically the current status quo) is the result of the feedback/pitchforking. I don't believe that was originally planned.
        autoexec 2y ago
        > just the print button would now send the file to Bambu Connect, where you would most likely only press an extra button.. Today it's just one extra button press. In 5-10 years when they shut down the servers for Bambu Connect nobody would be able to print anything at all. It's only because people were vocal in their complaints that their unsupported dev mode was made an option that would let people continue to use what they paid for
- adenta 2y ago
  The A1 mini was my first printer and it just works. Is there another brand that is idiot proof?
  - bdcravens 2y ago
    Not yet, but other brands are stepping up their quality. I just bought a Creality K2 Plus, and it's almost on par with my X1C (and has some features I prefer, like the CFS, their version of the AMS)
  - 0_____0 2y ago
    I've been using a Prusa Mk2 for years no with no real issues. Doesn't have the bells and whistles but it does, like, consistently work. Eventually I'll get a used FormLabs setup. Once I have a shop space set up.
  - sho_hn 2y ago
    If you buy a Prusa in non-kit form, it's not any harder to unbox or operate, and more reliable, while generally achieving somewhat better results. Without phoning home and while maintaining the software Bambu forked theirs from. A recent review coming to a similar conclusion was Maker Muse' review of bedslingers. It's a channel I respect a lot, because he has over the years relentlessly disclosed emails of companies trying to bribe or lean on him, or threaten him, and refused to play along. Most other 3D printing content is essentially paid advertising -- including, I suspect, the carefully constructed brand narrative of Bambu as the first "fire and forget" printers, as if they somehow elevated the art form, when really the user experience is not substantially different. You do not need to tinker or problem-solve with other modern well-reviewing printers, nor do they fail more prints. My MK4 hasn't failed a single print in a year (i.e. since I bought it), and I haven't had to do any sort of maintenance.
    - MindSpunk 2y ago
      And they cost 3x as much. Which is a pretty tough sell IMO.
      - 2y ago
throwaway48476 2y ago
If 3D printing isn't kept open source there's going to be laws about what you can and can't print that will kill innovation.
- s0rce 2y ago
  The bambu printers haven't been open source.
- franga2000 2y ago
  I can't imagine the printers being open source or not mattering for that, nor can I see any reasonable government banning printing of specific things. If something is illegal to own or manufacture, that already applies to 3D printers just as much as it did to CNC machines or any other method.
  - floating-io 2y ago
    Are you so sure? https://www.nysenate.gov/legislation/bills/2025/A2228?utm_campaign=subscriptions&utm_content=new_amendment&utm_medium=email&utm_source=ny_state_senate https://www.nysenate.gov/legislation/bills/2025/A2228?utm_ca... Not quite the same, and hopefully likely to fail if it hasn't already, but it shows that interest exists in regulating 3D printers. When enough interest exists, things will happen. JMHO.
    - kube-system 2y ago
      If NY state did require a background check to buy a 3D printer, you'd have to get one regardless of whether you're buying a prusa or a bambu printer.
      - floating-io 2y ago
        ...and? Applying to all brands equally doesn't make it okay.
        2y ago
c0nsumer 2y ago
I've been following along with a lot of this, because having picked up one of their printers about a month ago, I was immediately very nonplussed with the security. It took some work to get it running isolated on an IoT VLAN, yet still usable from my main machine. Thus, on first blush, I welcome security improvements from them, but I'm also anxious to see what they hold. I do wonder where this is going with the keys, because I've seen a lot of "OH LOOK WE HAVE THE KEYS" but nothing about what the keys are used for or how they are useful. Or if they are even useful. Hopefully there'll be more interesting news about this soon and some solid, technical info.
- lvturner 2y ago
  My understanding is that if I want to print via LAN, I have to auth against Bambu's internet servers, which is most definitely something I don't want. Actually for my use case this doesn't work at all -- my printers are region locked to China, but I'm not currently in China so I can't connect to those servers -- meaning (I think!) if I upgrade their firmware, I can't print via LAN on my own local network... which just leaves a bad taste in my mouth. These are great printers, but there's no need for that.
  - c0nsumer 2y ago
    Can you link to some specific detail on that, because I keep seeing that claim, but without any technical info. I have a P1S which currently can print completely isolated from the internet. Unfortunately (or maybe not?) the new firmware isn't available for my printer, so I can't dig into it myself yet. But I'd really like to see some sort of "when I try to do X it tries to connect to Y" or "I used to be able to do X, and now Y is required as demonstrated here". Something more than the current hearsay and pitchforks echo chamber.
    - lvturner 2y ago
      From their blog post: https://blog.bambulab.com/firmware-update-introducing-new-authorization-control-system-2/ https://blog.bambulab.com/firmware-update-introducing-new-au... "Critical Operations That Require Authorization The following printer operations will require authorization controls: Binding and unbinding the printer. Initiating remote video access. Performing firmware upgrades. Initiating a print job (via LAN or cloud mode). Controlling motion system, temperature, fans, AMS settings, calibrations, etc." Now, PERHAPS, I can do that authentication locally... but given the plugin required for OrcaSlicer it doesn't seem likely
spaceguillotine 2y ago
Bambu should be working on scaling their consumables and customer service, it takes weeks to resolve any tickets, 8 days to a first response has been normal for them.
- freefruit 2y ago
  What can't you fix? All the issues I've had you could find a video on YouTube on what to do.
- dawnerd 2y ago
  It’s kind of a joke they think they’re ready to roll out a print farm subscription when they can’t even keep basic filament in stock, or like you said even provide basic support. They’ve grown far too quickly.
NelsonMinar 2y ago
I am angry at the bait-and-switch Bambu is pulling. I bought one of their printers in the Black Friday sale on the understanding it was reasonably hackable and open. Now they're trying to lock it down so I can't print on my own printer without using their approved software and DRM chain. It's outrageous. More info on the hacking (the first in what may be a long stupid fight): https://hackaday.com/2025/01/19/bambu-connects-authentication-x-509-certificate-and-private-key-extracted/ https://hackaday.com/2025/01/19/bambu-connects-authenticatio...
- gjsman-1000 2y ago
  > standing it was reasonably hackable and open Not sure where you got this idea from. Despite the hacking, print from SD Card remains an option, and the device does not need an internet connection for initial setup. Version 01.08.02.00 is the first firmware version that supports offline updating, even if it is also the latest version.
- nialv7 2y ago
  bait-and-switch? We, those who advocate for open source 3D printers, saw it coming from miles away. This has very very clearly been their plan all along, they themselves said as much (e.g. they are doing the "apple model"). They have been very transparent about this, yet people still fell for it.
  - hooverd 2y ago
    Open source didn't compete on quality for price. I could pay 2k plus 40 hours of my time for a Voron or buy something that just works. I think Prusa only put out their CoreXY offering after they realized Bambu was eating their lunch. The Apple model works because people want to print rather than tinker.
    - nialv7 2y ago
      I paid ~$750 for my 350mm Voron 2.4 kit (and, sure, 40 hours of my time. But look, you want to do 3D printing, 40 hours are just a small initial investment).
bhhaskin 2y ago
I think people are making a big nothing burger out of this. Bambu is patching a security issue. Personally I don't want any device or application to send any old G-code to my printer. Like say command the printer to basically destroy itself. Could this lead to completely locking it down in the future? Yes. But they could do that anyways. I think this is a way to stop getting their pants sued off. If they really wanted to lock it down they could just make it so everything has to go through their servers and require files to be signed before being read from SD cards. But instead we really have a half ass attempt.
- myself248 2y ago
  "Security" on behalf of the user is a complete red herring. You can't print to my 2d printer or my 3d printer, but I can, with "any old device or application". Because they're on my network, not public on the internet.
  - bhhaskin 2y ago
    I disagree. These devices can easily burn down people's homes if given bad G-code. Then they would be sued into the dirt for a security whole a mile wide. Looking at the changes this is about liability.
    - dawnerd 2y ago
      How is an electron app that just adds another step solving the problem? They should have just secured their api properly instead of using security as an excuse to cut out third party software that will get around an inevitable subscription.
      - bhhaskin 2y ago
        Because authenticated commands removes the liability issue. Hacking the device vs we knowingly let anything send g-code. This is basically the equivalent to having passwords on a MySQL database or redis server. Why on earth would they add a subscription? That makes absolutely no sense business wise. No one would buy their printers, and they don't have a captured market to strong arm anyone.
userbinator 2y ago
I'm not surprised that 3D printers are turning out to be as hostile as 2D ones. As usual these days, "security" is the excuse.
- goda90 2y ago
  There's so much open source software, firmware, and hardware out there for FDM 3D printers, I doubt they'll ever get as bad as regular printers. It's much more a tinkerers world than 2D printing ever would be.
  - jopsen 2y ago
    Are regular printers that bad, if buy brother? I bought a B/W laser printer and have been generally impressed with the lack of BS that came a long with it. It did ask for toner once, so I bought something from a third-party.
    - DrBenCarson 2y ago
      Yep laser printers are the equivalent of modern CoreXY printers with solid auto calibration
      - Filligree 2y ago
        Could you name one? Other than the X1. I think I might be in the market for a new printer, but I don’t want to lose quality.
        jopsen 2y ago
        Prusa core one, but given the lack of features I can see why people might choose X1.
    - wongarsu 2y ago
      I've only made good experiences with laser printers, from very small ones to full-sized copy machines. Some of the more expensive inkjet printers are reportedly also quite good. You are still stuck with the usual horror show that is software from hardware companies, but otherwise it's not so bad. And the occasional paper jam, but 3d printers are no better in terms of reliability The bad reputation is just from HP's tactic to sell printers cheaper than everyone else, in more stores than anyone else, then make the money back with the scummiest tactics imaginable.
whatever1 2y ago
You thought you would be able to print copies of commercial things in the comfort of your home? RIAA would like a word with you.
mvdtnz 2y ago
Author could start with what this actually is. "An Electron App with Security through Obscurity principles" doesn't tell me much.
dangus 2y ago
I personally think the outrage I've seen on this issue is generally not justified. In general people are just scared of change and on top of that are playing telephone on the details of the change, assuming the worst intentions from Bambu like they're trying to be the next HP. I have seen a lot of misinformation on this topic, and I think that in that sense it's a good idea to read the actual announcement details to get a better read on Bambu's intentions: https://blog.bambulab.com/firmware-update-introducing-new-authorization-control-system-2/ https://blog.bambulab.com/firmware-update-introducing-new-au... A voice in Bambu's defense on this issue would say: 1. The new firmware isn't out, it's still in beta, and the new connect software is also in beta. This stuff isn't done and nobody has been forced to use it or even had it presented as an OTA update yet. The problems highlighted in this wiki page are very possibly problems that Bambu is aware of and intends to fix before release. 2. Bambu in their blog article stated that they are working on integration code so that third party slicers like Orca Slicer can more directly interface with Bambu Connect (see the FAQ section) 3. There are multiple statements on this blog page where Bambu acknowledges the workflow disruption and emphasizes the things they intend to do and do not intend to do, such as "It’s important to note that this update is not intended to restrict third-party software use. In fact, we’ve actively collaborated with third-party print farm management software providers in the past and continue to support such partnerships. To further improve the user experience, we are introducing a new software solution that will address these limitations and enhance overall print farm management capabilities." 4. People who don't run huge print farms don't seem to be impacted by this. Remember that Bambu claims to be a consumer tech company, right there in the "About Us" section. They are trying to make printers that are easy to use and require minimal tinkering. For a normal person, sending a slice file from Orca Slicer to a separate app (adding literally one step) is not a big deal, you're doing that once per print in a world where typical prints take hours to complete. And with that in mind, Bambu is still saying they intend to provide an integration solution to Orca Slicer in the future to streamline that process. Whether not the software design is a good architecture is an entirely different issue, and as a beta product I'm not sure we can judge that quite yet. Perhaps they should have hardened their network API more rather than introducing a new app? Perhaps they shouldn't have announced this so publicly before they had a solution for third-party integrations ready?
- 2y ago
hamandcheese 2y ago
Does anyone know what this key is actually used for, and what it enables?
onemoresoop 2y ago
I got an A1 mini about a month ago and so far it’s been decent as a beginners printer. I transfer models to the printer via the microSD card and refused to install their networking software on my machine because I don’t trust it’s safe enough. Im also very reluctant to get updates whenever they’re pushed. Maybe im spooked by past bricked devices so I keep all my devices dumb and offline as much as I can.
franga2000 2y ago
I was very against Bambu in the beginning for their lack of proper network (not cloud!) support. Then they added LAN mode and I actually considered getting one. Luckily I was lazy and never got around to it. What the fuck Bambu?? Security, really? Not even HP dares to make that excuse...
- moooo99 2y ago
  I mean, I technically see why authentication may be something they want to consider, especially for the less technically inclined users that Bambu is very obviously targeting. However, this can be easily achieved without bricking every single third party integration. That should simple be a toggle in the settings that works entirely local
- iamsaitam 2y ago
  HP just straight locks you out of your printer unless you pay ransom every month..
  - JoshTriplett 2y ago
    All HP printers still give you the option of paying full price for ink cartridges and owning the printer. The rental model is one they try very hard to steer you into, with lots of dark patterns, but you can still use HP printers with no account and no subscription ink model.
- jdietrich 2y ago
  Bambu Lab have been quite explicit about this. Their consumer-grade printers rely on a cloud service; for people who want or need printing over a private LAN, they offer the X1E. https://store.bambulab.com/products/x1e https://store.bambulab.com/products/x1e
  - nullc 2y ago
    That hasn't been true for years, the regular X1C has an officially supported lan mode and works fine without any of the cloud stuff. (I believe the smaller ones do too, but I haven't used them so I can't speak to them).
ChrisArchitect 2y ago
> Bambu Lab is a Chinese tech company that designs and manufactures 3D printers https://en.wikipedia.org/wiki/Bambu_Lab https://en.wikipedia.org/wiki/Bambu_Lab
- wongarsu 2y ago
  They disrupted the 3d printer market with printers that just work out-of-the-box at at price points where you typically only get enthusiast products that require a lot of tinkering. A lot of their business model is seemingly based on making long-term sales from consumables. Their solution for multi-color printing is more convenient to use with filament sold by them because they embed information about the filament on proprietary RFID tags. A couple days ago they announced locking down the API for their most expensive line of printers, locking most API calls to only their own software because of "security". Users are obviously upset. Rumours for the reasons range from protecting themselves from user mods that replicate the RFID functionality on any filament by configuring the printer via API calls, to Bambu Labs wanting to launch some kind of subscription service for print farms.
  - imtringued 2y ago
    Bambu Lab filament pricing is very similar to Sunlu pricing if you purchase the same minimum quantities as Sunlu, but Bambu Lab has a wider variety of filament that people actually want. The only thing that really helps them make more money is wasteful multi-color printing.
    - hn8726 2y ago
      Reportedly it's Sunlu who's supplying filament for Bambu. But Bambu's version still has RFID tags which make it much easier to work with multicolor. > The only thing that really helps them make more money is wasteful multi-color printing. They're slow to make improvements in this area, but they recently introduced some options to reduce the waste, like longer retraction before the color change. Plus as a user you can reduce the waste further by tuning flushing amounts, and you're left with the waste inherent to single-extruder multicolor printing. Overall yes multicolor can be wasteful, but to me it's impressive that it exists in the first place
ThouYS 2y ago
I wish Prusa weren't asleep at the wheel, then we would have bought a core one (that is, the hypothetical variant with large build volume and same quality as bambulab). Instead, we bought a P1S, which is, technically speaking, a fantastic machine.
- teruakohatu 2y ago
  Not really asleep at the wheel. More like they invented the wheel, produced the open source slicer (a fork of the original slicer but vastly improved), which was then used by Bambu who could manufacture a printer for less in China rather than in the EU. Prusa themselves run 600 printers. They are commercial grade. If I was using a printer for commercial design or prototyping I would go with Prusa. Not only because I would prefer my designs were not sent overseas by an always cloud connected printer.
  - Netcob 2y ago
    I got my first 3d printer, an MK3S+ a year ago. Pretty late in its lifecycle, but I wanted to spend more time printing than fixing issues. And it definitely worked! I got the kit and built it within 10h or so (very enjoyable time actually, like building LEGO as a kid) and have printed lots of stuff ever since. During that entire year I only had a clogged extruder one time and had to take that apart a bit. Any other issues I've had were either due to bad filaments or my own errors (not taking long overhangs or low adhesion seriously while slicing). And all this time I have been using it completely offline with OctoPrint on an RPi.
  - the_mitsuhiko 2y ago
    > which was then used by Bambu who could manufacture a printer for less in China rather than in the EU. I'm not at all convinced that Prusa's main issue is the cost. Yes, cost is a huge part of it, but the other one is also just usability. When the X1C launched and later the A1, there was a huge difference in usability between what Prusa and Bambu had. Prusa is catching up and that is good. But they will have to do more on that front still, and the higher cost is less of a concern. It becomes a problem when the more expensive printer is worse too.
KennyBlanken 2y ago
> Unpacking app.asar without fixing it first will result in an encrypted main.js file and 100 GB of decoy files generated, don't try it. I know it's not exactly a zip bomb, but it's kinda close, and goddamn, that's obnoxious.
mikelovenotwar 2y ago
Commentary on the situation from Louis Rossmann https://www.youtube.com/watch?v=aIyaDD8onIE https://www.youtube.com/watch?v=aIyaDD8onIE
dgrabla 2y ago
I have Bambu, Qidi and Creality printers. Qidi is a good compromise between open and 'print-quality-out-of-the-box'. My Q1 pro is easy to hack, but I have not done anything to it because it prints pretty much as well as Bambu.
MezzoDelCammin 2y ago
I'm kinda curious what will this lockdown do to the efforts to replace their controller and/or firmware with something more open. Something like [1] It's nice to have a private key to their cloud authentication, but ultimately it's the printers firmware that's the issue. While Bambu owns and updates that, they can change the keys basically anytime they decide that they had enough of the alternative Bambu Connect servers that people will inevitably create with the current keys. [1] https://github.com/ChazLayyd/Bambu-Lab-Klipper-Conversion https://github.com/ChazLayyd/Bambu-Lab-Klipper-Conversion
xyst 2y ago
I’m not familiar with the 3D printing space, but seems like this reverse engineering was inspired by the companies move to clamp down on security of these devices. [1] From what I understand, this new auth system would make third party integrations (ie, “OrcaSlicer”) obsolete and users would be limited to controlling the device via Bambu Connect. This update impacts users who control the device via HomeAssistant and “print farm management” users. I guess first party support for users with fleets of these printers is dogshit, thus the need for third party software. Seems after 3 days of community feedback/outrage, the company is backtracking on the Bambu Connect only route. Instead offering a “Developer Mode” option in firmware which on the surface seems to be what the impacted users need. [2] > In response, we’ve made the decision to implement an optional LAN mode feature, to provide advanced users with more control and flexibility. > Standard Mode (Default): By default, LAN mode will include an authorization process that ensures robust security > Developer Mode (Optional): For advanced users of the X1, P1, A1, and A1 Mini who prefer full control over their network security, an option will be available to leave the MQTT channel, live stream, and FTP open. This feature must be manually enabled on the printer, and users who select this option will assume full responsibility for securing their local network environment. Please note that Bambu Lab will not be able to provide customer support for this mode, as the communication protocols are not officially supported. Seems this resolves the community concerns. Or am I missing something? [1] https://blog.bambulab.com/firmware-update-introducing-new-authorization-control-system-2/ https://blog.bambulab.com/firmware-update-introducing-new-au... [2] https://blog.bambulab.com/updates-and-third-party-integration-with-bambu-connect/ https://blog.bambulab.com/updates-and-third-party-integratio...
- modderation 2y ago
  That's a useful step, but the options are still Full Cloud Dependency or DIY with Zero Security. Why haven't they implemented rudimentary access control with printer-side Basic Auth (or the equivalents auth for MQTT and FTP). Add optional SSL support to prevent tampering/MITM on a potentially hostile network, and the unauthenticated access concerns listed in [1] should disappear. Any problems related to potentially damaging instructions should be best-effort mitigated by the firmware and otherwise indemnified by a "your own fault for using a third-party slicer" clause in the EULA. Bambu Labs shouldn't need to be in the authentication/authorization path, unless we're actively using their cloud environment.
deleted 2y ago
[deleted]
asah 2y ago
Their response: https://blog.bambulab.com/updates-and-third-party-integration-with-bambu-connect/ https://blog.bambulab.com/updates-and-third-party-integratio...
- hn8726 2y ago
  Honestly, the response is not that great. Right off the bat they're just going on the defensive, enumerating "false claims" that printer will require subscription etc. But the concern wasn't that Bambu _will_ do that, but that they _could_ do that, and generally that inserting Bambu's infrastructure as a mandatory step in the printing pipeline is _not great_. Then, the first point in their `truth about the update` section: > This is NOT about limiting third-party software. We're creating Bambu Connect specifically to ensure continued third-party integration while enhancing security. We're actively working with developers like Orca Slicer to implement this integration. The `we're actively working` with Orca was already addressed by the OrcaSlicer developer [0] > Bambu informed me of this change two days before their announcement. and Bambu's idea of "working with" is helping to implement redirect from Orca to their own software that would actually start the print. Seems like limiting third-party software to me. > This is beta testing, not a forced update. The choice is yours. This is bizarre, surely beta firmware is intended to be release firmware at some point? If anything, the community outrage proved beta track to work as intended. > About Panda Touch. We reached out to BTT as soon as we became aware of their product. We warned them that using exploited MQTT protocols... Also addressed by BQ in [1], tl;dr they tried to work with Bambu but didn't get much response, only a warning that the MQTT might stop working in a future update. So technically Bambu _reached out_, but only to say "don't improve our product". In the end, Bambu is screwing over their customers more than BQ Further down they still go and defend their decision > When using third-party slicing software like Orca Slicer, the difference in users experience is not much. and proceed to demonstrate that Orca Slicer will _easily_ open the new app which will be able to start the printing. Which is exactly what the community complained about, and doesn't address things like missing Linux support. Finally, they're presenting a diagram showing how the new flow looks like. Except the diagram is missing any details about what the new software does — it doesn't show how, when and why the new software communicates with the cloud. For someone with even cursory understanding of security, the changes just don't make much sense, and Bambu is not doing much to explain the security protocols they're trying to implement. For all I know they just slapped a private certificate somewhere in the Bambu Connect app and started signing requests to the printer, which doesn't improve security at all if the private key is already public [0] https://github.com/SoftFever/OrcaSlicer/issues/8063#issuecomment-2599603543 https://github.com/SoftFever/OrcaSlicer/issues/8063#issuecom... [1] https://old.reddit.com/r/BIGTREETECH/comments/1i5lzzf/latest_update_for_panda_touch/m859z7c/ https://old.reddit.com/r/BIGTREETECH/comments/1i5lzzf/latest...
elcapitan 2y ago
As a precaution, I've blocked my A1 mini from Internet access on the router, and will not apply any firmware updates anymore. I will also not update Bambu Studio anymore (or completely switch to Orcaslicer). I was already using LAN mode exclusively. Kind of annoying, but I'm not desperately waiting for Firmware updates, everything works fine so far.
05 2y ago
RMS was right
shul 2y ago
Bambu sent out a clarification in their blog, you should read it
- broadsidepicnic 2y ago
  no need linking it, tho
blutack 2y ago
I'm interested what others think of their existing design and whether there are any fundamental security issues that will be resolved by their proposed change. They are proposing requiring a secret signed certificate to carry out any actions beyond monitoring for both the cloud and local (on printer) MQTT servers. These certificates would be issued at the discretion of Bambu by their CSR, currently only for "Bambu Studio" their slicer, Bambu Handy (their mobile app) and "Bambu Connect" which will enable upload G-Code generated by third party slicer (a workaround for existing functionality being removed). This "secret" certificate has already been extracted from the Bambu Connect application as per the article as their new security model requires embedded this certificate into desktop applications. The current design: https://github.com/Doridian/OpenBambuAPI/blob/main/mqtt.md https://github.com/Doridian/OpenBambuAPI/blob/main/mqtt.md Connecting to their cloud MQTT requires a username and token already. These details are obtained via a HTTPS request to their login server using your bambu account (which requires a valid email & possibly captcha) to obtain a token. The cloud MQTT is TLS secured, although this is just to encrypt the traffic (aka HTTPS), it is not mutual authentication. Connecting to the MQTT server hosted on the printer (aka LAN mode) requires a fixed username and a local access token (a random 8 digit number). This can be found via the physical display of the printer in a menu (or apparently cloud MQTT!?). This access token can be refreshed via a menu option again physically at the printer. To be clear, this token only allows to you connect directly to the local MQTT server running on the IP address of the printer, so in most environments this should only be the local network. This is also the password for the FTP server that can be used to upload/download sliced 3mf/gcode files. Personally - this design seems ok to me? With an MQTT service properly configured to isolate user accounts from each other, this is a pattern widely deployed for embedded devices (Azure IoT, AWS IoT etc). I don't see how the "DDOS" related issues they are claiming would be related to this specific design. If the issue is in the login server - well, that's prior to authentication anyway so nothing they are doing here will fix that. If it's problems with your cloud MQTT service not being properly isolated - maybe fix that? If the DDOS is at L2, auth isn't going to help. You require logins tied to an email, you can block clients that misbehave once they are logged in. Nobody is brute forcing the local MQTT server via XSS or something, because JS doesn't allow for raw TCP connections. Are they concerned about malicious software already on the network? Then rate limiting on the printer side or switch to a random length alphanum LAN token to increase keyspace. I'm curious what more qualified people think, I cannot see any justications for their proposed design improving security. So either; a) They've decided they are incapable of properly securing their MQTT cloud stuff and instead of fixing that just want to assume every client connected to their cloud MQTT servers is fully trusted. I'm sure that'll work great. Doesn't justify adding this to the local MQTT servers on the printers - if anything that reduces security, as to roll certificates you now have a long tail of printer firmware updates. b) It's not about security
vanillax 2y ago
This is all nonsense. I just got a a1, and its my first 3d printer. I dont have any expertise. Ive been able to use the Bambu App and Maker world and basically control+P. Ive print about 10 things so far in the first week. I dont see why people are mad. They made the apple of printers. It just works(tm). I dont need anything else. People just get so upset over nothing.
- mmorriso 2y ago
  I tend to agree. I've built a Prusa previously and my P1S is just so much more reliable, it's the first printer I've been able to recommend to friends and colleagues who I wouldn't expect to enjoy tinkering with a printer but would enjoy printing. I have simply not had a failed print, it's incredible. I have so much confidence in the unit that I now keep two rolls of the same colour loaded and if I find a cool model while out and about, I just print it with full trust it'll be waiting for me by the time I get home. Amazing progress.
nirav72 2y ago
I've been on the fence about purchasing a Bambu. But given the amount of time I've spent over the past few years having to tweak my ender 3 V2 and CR-10- I was leaning towards finally splurging on a X1C. Question to those more familiar with the bambu software ecosystem - do these recent changes to authentication require a constant online connection to print anything from a machine on the LAN? I'm assuming printing via microSD will still be possible?
- d1str0 2y ago
  I’m not familiar with Bambu, I’m a Prusa user, but if I had to guess you would always be able to print via microSD. It would be wildly unpopular to disable local printing.
- mmorriso 2y ago
  Currently, LAN mode and local SD card printing does not require an internet connection. I have my printer in a bottom of the yard bungalow, without internet, and it works fine.
jchw 2y ago
I bought a Bambu Lab printer recently, and made the decision that if I did connect it to LAN, I'd make damn sure that it did not have an Internet connection, even though there is a LAN mode toggle in the firmware it shipped with. Although I am definitely paranoid about Internet-of-Shit bait'n'switch techniques, at the time I was mostly thinking in terms of geopolitical bullshit rather than capitalistic shenanigans. No particular reason to distrust Bambu Lab themselves at the time, at least more than any other company. Obviously, hingsight is 20:20, but it's just a reminder: your cynicism is warranted. Don't trust anyone any more than you absolutely have to.
DoctorOetker 2y ago
according to [0] the ipcam is logging video even when the camera is disabled. I suggest we collectively print Tiananmen Square Tank Man scenes. [0] https://www.reddit.com/r/BambuLab/comments/1i548m9/comment/m86t7g1/ https://www.reddit.com/r/BambuLab/comments/1i548m9/comment/m...
- buckle8017 2y ago
  these printers have spaghetti detection so it actually makes sense the camera is always on
  - DoctorOetker 2y ago
    it does not make sense: spaghetti can be detected without logging it, just process and evaluate frames, and if necessary accumulate multiple evaluations (not images) to achieve better signal to noise ratio.
  - wpm 2y ago
    Spaghetti detection is supposed to happen on-device.
    - buckle8017 2y ago
      Yes? the reddit guy is saying the device is always saving pictures on the device.
- bigiain 2y ago
  > I suggest we collectively print Tiananmen Square Tank Man scenes. Anyone got a link to a good .stl?
  - DoctorOetker 2y ago
    we will have to make one, I suggest we also use machine translation to include the historical background into the print in their own language.
whatevermang 2y ago
Maybe I'm the exception here, but I slice my files and then load them to an SD card and walk them over to my printer. It's not high tech, but since you can't clear the build plate without physically being there, I don't see much of a change. If I really wanted to monitor the build I suppose I could just point a webcam at it rather than use the existing one. But since it prints flawlessly most of the time it seems unnecessary.
- GuB-42 2y ago
  > you can't clear the build plate without physically being there BambuLabs printers may not support this but some people do it. The idea is to use the print head to knock the part out of the bed and into a bin. Probably not worth the hassle for personal use and you may need to design the part a certain way to make it possible, but it is useful for mass production.
dlgeek 2y ago
What I don't get...BambuSlicer is open source. And, not only is it open source, it's a fork of PrussaSlicer, so Bambu doesn't have the ability to re-license it. It's licensed under the Affero GPL which is very strict about the licensing of derived works. That license requires Bambu to include the source code to any additions they make, including all of the logic, keys, etc. that they're baking into any binary distributions. If they don't, they're violating the copyright rights of Prussa and many others. So, either Bambu has to open source all of this, which defeats the purpose (given that it's already leaked, that's gonna happen anyway) or they have to route everything through a separate program for their own slicer.
- whatsthatabout 2y ago
  BambuConnect is not part of BambuStudio - That's intentional, so BambuLab does not need to share/open-source it. The current implementation (the Bambu network plugin thingy) isn't a part of it either, it's downloaded by the client when BambuStudio is opened.
  - dlgeek 2y ago
    They claimed that studio wouldn't need connect. I don't know AGPL well enough to know if a plugin is considered a derived work but it sure seems to imply it: > For example, Corresponding Source includes interface definition files associated with source files for the work, and the source code for shared libraries and dynamically linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those subprograms and other parts of the work.

532 points by pabs3 2y ago

ClassyJacket 2y ago

I'm so happy Bambu is getting what's coming to them after screwing us so badly <3

BWStearns 2y ago
What did they do?
- adenta 2y ago
  They are locking down their software so you have to use it
- bradfitz 2y ago
  https://hackaday.com/2025/01/17/new-bambu-lab-firmware-update-adds-mandatory-authorization-control-system/ https://hackaday.com/2025/01/17/new-bambu-lab-firmware-updat... has a summary that caught me up. I feel like it must be missing some of the story though.
- bdcravens 2y ago
  They used a plugin to communicate print jobs (and other integrations), so that third party software could be used pretty seamlessly. Now they're moving to a new authentication model, and will be requiring users to send files to a separate print app. (Bambu Connect) It adds friction to the process, especially for those who were looking to run print jobs at scale, using "print farm" software or building their own solutions.
  - c0nsumer 2y ago
    I do wonder how much friction it'll really add, since the slicers can send the data to Connect via a protocol handler. It also means that Connect could act as a farm / queueing system as well, more like a print driver vs. individual printer support within the app.
    - intothemild 2y ago
      Its pretty much this, nothing seems to be blocking any third party slicer like Orca from working with bambu printers as they are now.. just the print button would now send the file to Bambu Connect, where you would most likely only press an extra button.. Getting info from the printer or AMS? MQTT still works. They specifically said they are not touching that. Sadly the usual groups of people are screaming, and the open printer people are laughing. But at worst.. this is just friction. Anyone pointing this out seems to get downvoted. But its all there in the bambu press statement and subsequent pages. Those that are upset seemed to have not read those, and instead just read or watched something inflammatory.
      - c0nsumer 2y ago
        Did you happen to see this? Interesting development, they are basically going to keep the current wide-open-barely-auth'd state and call it a developer mode. And submitted a PR to make Orca Slicer work with the new auth: https://blog.bambulab.com/updates-and-third-party-integration-with-bambu-connect/ https://blog.bambulab.com/updates-and-third-party-integratio... And yeah, I'm realizing that about the downvotes. It's sad the state of things, but SKY-IS-FALLING-GET-PITCHFORKS wins the day over technical analysis, even on purportedly technical forums. But alas, that's an aside. I'm really looking forward to this rolling out, as I want to monitor my printer with Home Assistant but I /really/ don't like how much control the current (non-beta, non-future) state gives HA. I /want/ auth of some sort when submitting jobs, and it looks like I'll have that. (I also really want the slicer decoupled from the print management stuff, because I tend to keep a few slicers open and experiment.)
        bdcravens 2y ago
        My understanding is that the "addition" of the developer mode (basically the current status quo) is the result of the feedback/pitchforking. I don't believe that was originally planned.
      - autoexec 2y ago
        > just the print button would now send the file to Bambu Connect, where you would most likely only press an extra button.. Today it's just one extra button press. In 5-10 years when they shut down the servers for Bambu Connect nobody would be able to print anything at all. It's only because people were vocal in their complaints that their unsupported dev mode was made an option that would let people continue to use what they paid for
adenta 2y ago
The A1 mini was my first printer and it just works. Is there another brand that is idiot proof?
- bdcravens 2y ago
  Not yet, but other brands are stepping up their quality. I just bought a Creality K2 Plus, and it's almost on par with my X1C (and has some features I prefer, like the CFS, their version of the AMS)
- 0_____0 2y ago
  I've been using a Prusa Mk2 for years no with no real issues. Doesn't have the bells and whistles but it does, like, consistently work. Eventually I'll get a used FormLabs setup. Once I have a shop space set up.
- sho_hn 2y ago
  If you buy a Prusa in non-kit form, it's not any harder to unbox or operate, and more reliable, while generally achieving somewhat better results. Without phoning home and while maintaining the software Bambu forked theirs from. A recent review coming to a similar conclusion was Maker Muse' review of bedslingers. It's a channel I respect a lot, because he has over the years relentlessly disclosed emails of companies trying to bribe or lean on him, or threaten him, and refused to play along. Most other 3D printing content is essentially paid advertising -- including, I suspect, the carefully constructed brand narrative of Bambu as the first "fire and forget" printers, as if they somehow elevated the art form, when really the user experience is not substantially different. You do not need to tinker or problem-solve with other modern well-reviewing printers, nor do they fail more prints. My MK4 hasn't failed a single print in a year (i.e. since I bought it), and I haven't had to do any sort of maintenance.
  - MindSpunk 2y ago
    And they cost 3x as much. Which is a pretty tough sell IMO.
    - 2y ago

throwaway48476 2y ago

If 3D printing isn't kept open source there's going to be laws about what you can and can't print that will kill innovation.

s0rce 2y ago
The bambu printers haven't been open source.
franga2000 2y ago
I can't imagine the printers being open source or not mattering for that, nor can I see any reasonable government banning printing of specific things. If something is illegal to own or manufacture, that already applies to 3D printers just as much as it did to CNC machines or any other method.
- floating-io 2y ago
  Are you so sure? https://www.nysenate.gov/legislation/bills/2025/A2228?utm_campaign=subscriptions&utm_content=new_amendment&utm_medium=email&utm_source=ny_state_senate https://www.nysenate.gov/legislation/bills/2025/A2228?utm_ca... Not quite the same, and hopefully likely to fail if it hasn't already, but it shows that interest exists in regulating 3D printers. When enough interest exists, things will happen. JMHO.
  - kube-system 2y ago
    If NY state did require a background check to buy a 3D printer, you'd have to get one regardless of whether you're buying a prusa or a bambu printer.
    - floating-io 2y ago
      ...and? Applying to all brands equally doesn't make it okay.
      - 2y ago

c0nsumer 2y ago

I've been following along with a lot of this, because having picked up one of their printers about a month ago, I was immediately very nonplussed with the security. It took some work to get it running isolated on an IoT VLAN, yet still usable from my main machine. Thus, on first blush, I welcome security improvements from them, but I'm also anxious to see what they hold. I do wonder where this is going with the keys, because I've seen a lot of "OH LOOK WE HAVE THE KEYS" but nothing about what the keys are used for or how they are useful. Or if they are even useful. Hopefully there'll be more interesting news about this soon and some solid, technical info.

lvturner 2y ago
My understanding is that if I want to print via LAN, I have to auth against Bambu's internet servers, which is most definitely something I don't want. Actually for my use case this doesn't work at all -- my printers are region locked to China, but I'm not currently in China so I can't connect to those servers -- meaning (I think!) if I upgrade their firmware, I can't print via LAN on my own local network... which just leaves a bad taste in my mouth. These are great printers, but there's no need for that.
- c0nsumer 2y ago
  Can you link to some specific detail on that, because I keep seeing that claim, but without any technical info. I have a P1S which currently can print completely isolated from the internet. Unfortunately (or maybe not?) the new firmware isn't available for my printer, so I can't dig into it myself yet. But I'd really like to see some sort of "when I try to do X it tries to connect to Y" or "I used to be able to do X, and now Y is required as demonstrated here". Something more than the current hearsay and pitchforks echo chamber.
  - lvturner 2y ago
    From their blog post: https://blog.bambulab.com/firmware-update-introducing-new-authorization-control-system-2/ https://blog.bambulab.com/firmware-update-introducing-new-au... "Critical Operations That Require Authorization The following printer operations will require authorization controls: Binding and unbinding the printer. Initiating remote video access. Performing firmware upgrades. Initiating a print job (via LAN or cloud mode). Controlling motion system, temperature, fans, AMS settings, calibrations, etc." Now, PERHAPS, I can do that authentication locally... but given the plugin required for OrcaSlicer it doesn't seem likely

spaceguillotine 2y ago

Bambu should be working on scaling their consumables and customer service, it takes weeks to resolve any tickets, 8 days to a first response has been normal for them.

freefruit 2y ago
What can't you fix? All the issues I've had you could find a video on YouTube on what to do.
dawnerd 2y ago
It’s kind of a joke they think they’re ready to roll out a print farm subscription when they can’t even keep basic filament in stock, or like you said even provide basic support. They’ve grown far too quickly.

NelsonMinar 2y ago

I am angry at the bait-and-switch Bambu is pulling. I bought one of their printers in the Black Friday sale on the understanding it was reasonably hackable and open. Now they're trying to lock it down so I can't print on my own printer without using their approved software and DRM chain. It's outrageous. More info on the hacking (the first in what may be a long stupid fight): https://hackaday.com/2025/01/19/bambu-connects-authentication-x-509-certificate-and-private-key-extracted/ https://hackaday.com/2025/01/19/bambu-connects-authenticatio...

gjsman-1000 2y ago
> standing it was reasonably hackable and open Not sure where you got this idea from. Despite the hacking, print from SD Card remains an option, and the device does not need an internet connection for initial setup. Version 01.08.02.00 is the first firmware version that supports offline updating, even if it is also the latest version.
nialv7 2y ago
bait-and-switch? We, those who advocate for open source 3D printers, saw it coming from miles away. This has very very clearly been their plan all along, they themselves said as much (e.g. they are doing the "apple model"). They have been very transparent about this, yet people still fell for it.
- hooverd 2y ago
  Open source didn't compete on quality for price. I could pay 2k plus 40 hours of my time for a Voron or buy something that just works. I think Prusa only put out their CoreXY offering after they realized Bambu was eating their lunch. The Apple model works because people want to print rather than tinker.
  - nialv7 2y ago
    I paid ~$750 for my 350mm Voron 2.4 kit (and, sure, 40 hours of my time. But look, you want to do 3D printing, 40 hours are just a small initial investment).

bhhaskin 2y ago

I think people are making a big nothing burger out of this. Bambu is patching a security issue. Personally I don't want any device or application to send any old G-code to my printer. Like say command the printer to basically destroy itself. Could this lead to completely locking it down in the future? Yes. But they could do that anyways. I think this is a way to stop getting their pants sued off. If they really wanted to lock it down they could just make it so everything has to go through their servers and require files to be signed before being read from SD cards. But instead we really have a half ass attempt.

myself248 2y ago
"Security" on behalf of the user is a complete red herring. You can't print to my 2d printer or my 3d printer, but I can, with "any old device or application". Because they're on my network, not public on the internet.
- bhhaskin 2y ago
  I disagree. These devices can easily burn down people's homes if given bad G-code. Then they would be sued into the dirt for a security whole a mile wide. Looking at the changes this is about liability.
  - dawnerd 2y ago
    How is an electron app that just adds another step solving the problem? They should have just secured their api properly instead of using security as an excuse to cut out third party software that will get around an inevitable subscription.
    - bhhaskin 2y ago
      Because authenticated commands removes the liability issue. Hacking the device vs we knowingly let anything send g-code. This is basically the equivalent to having passwords on a MySQL database or redis server. Why on earth would they add a subscription? That makes absolutely no sense business wise. No one would buy their printers, and they don't have a captured market to strong arm anyone.

userbinator 2y ago

I'm not surprised that 3D printers are turning out to be as hostile as 2D ones. As usual these days, "security" is the excuse.

goda90 2y ago
There's so much open source software, firmware, and hardware out there for FDM 3D printers, I doubt they'll ever get as bad as regular printers. It's much more a tinkerers world than 2D printing ever would be.
- jopsen 2y ago
  Are regular printers that bad, if buy brother? I bought a B/W laser printer and have been generally impressed with the lack of BS that came a long with it. It did ask for toner once, so I bought something from a third-party.
  - DrBenCarson 2y ago
    Yep laser printers are the equivalent of modern CoreXY printers with solid auto calibration
    - Filligree 2y ago
      Could you name one? Other than the X1. I think I might be in the market for a new printer, but I don’t want to lose quality.
      - jopsen 2y ago
        Prusa core one, but given the lack of features I can see why people might choose X1.
  - wongarsu 2y ago
    I've only made good experiences with laser printers, from very small ones to full-sized copy machines. Some of the more expensive inkjet printers are reportedly also quite good. You are still stuck with the usual horror show that is software from hardware companies, but otherwise it's not so bad. And the occasional paper jam, but 3d printers are no better in terms of reliability The bad reputation is just from HP's tactic to sell printers cheaper than everyone else, in more stores than anyone else, then make the money back with the scummiest tactics imaginable.

whatever1 2y ago

You thought you would be able to print copies of commercial things in the comfort of your home? RIAA would like a word with you.

mvdtnz 2y ago

Author could start with what this actually is. "An Electron App with Security through Obscurity principles" doesn't tell me much.

dangus 2y ago

I personally think the outrage I've seen on this issue is generally not justified. In general people are just scared of change and on top of that are playing telephone on the details of the change, assuming the worst intentions from Bambu like they're trying to be the next HP. I have seen a lot of misinformation on this topic, and I think that in that sense it's a good idea to read the actual announcement details to get a better read on Bambu's intentions: https://blog.bambulab.com/firmware-update-introducing-new-authorization-control-system-2/ https://blog.bambulab.com/firmware-update-introducing-new-au... A voice in Bambu's defense on this issue would say: 1. The new firmware isn't out, it's still in beta, and the new connect software is also in beta. This stuff isn't done and nobody has been forced to use it or even had it presented as an OTA update yet. The problems highlighted in this wiki page are very possibly problems that Bambu is aware of and intends to fix before release. 2. Bambu in their blog article stated that they are working on integration code so that third party slicers like Orca Slicer can more directly interface with Bambu Connect (see the FAQ section) 3. There are multiple statements on this blog page where Bambu acknowledges the workflow disruption and emphasizes the things they intend to do and do not intend to do, such as "It’s important to note that this update is not intended to restrict third-party software use. In fact, we’ve actively collaborated with third-party print farm management software providers in the past and continue to support such partnerships. To further improve the user experience, we are introducing a new software solution that will address these limitations and enhance overall print farm management capabilities." 4. People who don't run huge print farms don't seem to be impacted by this. Remember that Bambu claims to be a consumer tech company, right there in the "About Us" section. They are trying to make printers that are easy to use and require minimal tinkering. For a normal person, sending a slice file from Orca Slicer to a separate app (adding literally one step) is not a big deal, you're doing that once per print in a world where typical prints take hours to complete. And with that in mind, Bambu is still saying they intend to provide an integration solution to Orca Slicer in the future to streamline that process. Whether not the software design is a good architecture is an entirely different issue, and as a beta product I'm not sure we can judge that quite yet. Perhaps they should have hardened their network API more rather than introducing a new app? Perhaps they shouldn't have announced this so publicly before they had a solution for third-party integrations ready?

2y ago

hamandcheese 2y ago

Does anyone know what this key is actually used for, and what it enables?

onemoresoop 2y ago

I got an A1 mini about a month ago and so far it’s been decent as a beginners printer. I transfer models to the printer via the microSD card and refused to install their networking software on my machine because I don’t trust it’s safe enough. Im also very reluctant to get updates whenever they’re pushed. Maybe im spooked by past bricked devices so I keep all my devices dumb and offline as much as I can.

franga2000 2y ago

I was very against Bambu in the beginning for their lack of proper network (not cloud!) support. Then they added LAN mode and I actually considered getting one. Luckily I was lazy and never got around to it. What the fuck Bambu?? Security, really? Not even HP dares to make that excuse...

moooo99 2y ago
I mean, I technically see why authentication may be something they want to consider, especially for the less technically inclined users that Bambu is very obviously targeting. However, this can be easily achieved without bricking every single third party integration. That should simple be a toggle in the settings that works entirely local
iamsaitam 2y ago
HP just straight locks you out of your printer unless you pay ransom every month..
- JoshTriplett 2y ago
  All HP printers still give you the option of paying full price for ink cartridges and owning the printer. The rental model is one they try very hard to steer you into, with lots of dark patterns, but you can still use HP printers with no account and no subscription ink model.
jdietrich 2y ago
Bambu Lab have been quite explicit about this. Their consumer-grade printers rely on a cloud service; for people who want or need printing over a private LAN, they offer the X1E. https://store.bambulab.com/products/x1e https://store.bambulab.com/products/x1e
- nullc 2y ago
  That hasn't been true for years, the regular X1C has an officially supported lan mode and works fine without any of the cloud stuff. (I believe the smaller ones do too, but I haven't used them so I can't speak to them).

ChrisArchitect 2y ago

> Bambu Lab is a Chinese tech company that designs and manufactures 3D printers https://en.wikipedia.org/wiki/Bambu_Lab https://en.wikipedia.org/wiki/Bambu_Lab

wongarsu 2y ago
They disrupted the 3d printer market with printers that just work out-of-the-box at at price points where you typically only get enthusiast products that require a lot of tinkering. A lot of their business model is seemingly based on making long-term sales from consumables. Their solution for multi-color printing is more convenient to use with filament sold by them because they embed information about the filament on proprietary RFID tags. A couple days ago they announced locking down the API for their most expensive line of printers, locking most API calls to only their own software because of "security". Users are obviously upset. Rumours for the reasons range from protecting themselves from user mods that replicate the RFID functionality on any filament by configuring the printer via API calls, to Bambu Labs wanting to launch some kind of subscription service for print farms.
- imtringued 2y ago
  Bambu Lab filament pricing is very similar to Sunlu pricing if you purchase the same minimum quantities as Sunlu, but Bambu Lab has a wider variety of filament that people actually want. The only thing that really helps them make more money is wasteful multi-color printing.
  - hn8726 2y ago
    Reportedly it's Sunlu who's supplying filament for Bambu. But Bambu's version still has RFID tags which make it much easier to work with multicolor. > The only thing that really helps them make more money is wasteful multi-color printing. They're slow to make improvements in this area, but they recently introduced some options to reduce the waste, like longer retraction before the color change. Plus as a user you can reduce the waste further by tuning flushing amounts, and you're left with the waste inherent to single-extruder multicolor printing. Overall yes multicolor can be wasteful, but to me it's impressive that it exists in the first place

ThouYS 2y ago

I wish Prusa weren't asleep at the wheel, then we would have bought a core one (that is, the hypothetical variant with large build volume and same quality as bambulab). Instead, we bought a P1S, which is, technically speaking, a fantastic machine.

teruakohatu 2y ago
Not really asleep at the wheel. More like they invented the wheel, produced the open source slicer (a fork of the original slicer but vastly improved), which was then used by Bambu who could manufacture a printer for less in China rather than in the EU. Prusa themselves run 600 printers. They are commercial grade. If I was using a printer for commercial design or prototyping I would go with Prusa. Not only because I would prefer my designs were not sent overseas by an always cloud connected printer.
- Netcob 2y ago
  I got my first 3d printer, an MK3S+ a year ago. Pretty late in its lifecycle, but I wanted to spend more time printing than fixing issues. And it definitely worked! I got the kit and built it within 10h or so (very enjoyable time actually, like building LEGO as a kid) and have printed lots of stuff ever since. During that entire year I only had a clogged extruder one time and had to take that apart a bit. Any other issues I've had were either due to bad filaments or my own errors (not taking long overhangs or low adhesion seriously while slicing). And all this time I have been using it completely offline with OctoPrint on an RPi.
- the_mitsuhiko 2y ago
  > which was then used by Bambu who could manufacture a printer for less in China rather than in the EU. I'm not at all convinced that Prusa's main issue is the cost. Yes, cost is a huge part of it, but the other one is also just usability. When the X1C launched and later the A1, there was a huge difference in usability between what Prusa and Bambu had. Prusa is catching up and that is good. But they will have to do more on that front still, and the higher cost is less of a concern. It becomes a problem when the more expensive printer is worse too.

KennyBlanken 2y ago

> Unpacking app.asar without fixing it first will result in an encrypted main.js file and 100 GB of decoy files generated, don't try it. I know it's not exactly a zip bomb, but it's kinda close, and goddamn, that's obnoxious.

mikelovenotwar 2y ago

Commentary on the situation from Louis Rossmann https://www.youtube.com/watch?v=aIyaDD8onIE https://www.youtube.com/watch?v=aIyaDD8onIE

dgrabla 2y ago

I have Bambu, Qidi and Creality printers. Qidi is a good compromise between open and 'print-quality-out-of-the-box'. My Q1 pro is easy to hack, but I have not done anything to it because it prints pretty much as well as Bambu.

MezzoDelCammin 2y ago

I'm kinda curious what will this lockdown do to the efforts to replace their controller and/or firmware with something more open. Something like [1] It's nice to have a private key to their cloud authentication, but ultimately it's the printers firmware that's the issue. While Bambu owns and updates that, they can change the keys basically anytime they decide that they had enough of the alternative Bambu Connect servers that people will inevitably create with the current keys. [1] https://github.com/ChazLayyd/Bambu-Lab-Klipper-Conversion https://github.com/ChazLayyd/Bambu-Lab-Klipper-Conversion

xyst 2y ago

I’m not familiar with the 3D printing space, but seems like this reverse engineering was inspired by the companies move to clamp down on security of these devices. [1] From what I understand, this new auth system would make third party integrations (ie, “OrcaSlicer”) obsolete and users would be limited to controlling the device via Bambu Connect. This update impacts users who control the device via HomeAssistant and “print farm management” users. I guess first party support for users with fleets of these printers is dogshit, thus the need for third party software. Seems after 3 days of community feedback/outrage, the company is backtracking on the Bambu Connect only route. Instead offering a “Developer Mode” option in firmware which on the surface seems to be what the impacted users need. [2] > In response, we’ve made the decision to implement an optional LAN mode feature, to provide advanced users with more control and flexibility. > Standard Mode (Default): By default, LAN mode will include an authorization process that ensures robust security > Developer Mode (Optional): For advanced users of the X1, P1, A1, and A1 Mini who prefer full control over their network security, an option will be available to leave the MQTT channel, live stream, and FTP open. This feature must be manually enabled on the printer, and users who select this option will assume full responsibility for securing their local network environment. Please note that Bambu Lab will not be able to provide customer support for this mode, as the communication protocols are not officially supported. Seems this resolves the community concerns. Or am I missing something? [1] https://blog.bambulab.com/firmware-update-introducing-new-authorization-control-system-2/ https://blog.bambulab.com/firmware-update-introducing-new-au... [2] https://blog.bambulab.com/updates-and-third-party-integration-with-bambu-connect/ https://blog.bambulab.com/updates-and-third-party-integratio...

modderation 2y ago
That's a useful step, but the options are still Full Cloud Dependency or DIY with Zero Security. Why haven't they implemented rudimentary access control with printer-side Basic Auth (or the equivalents auth for MQTT and FTP). Add optional SSL support to prevent tampering/MITM on a potentially hostile network, and the unauthenticated access concerns listed in [1] should disappear. Any problems related to potentially damaging instructions should be best-effort mitigated by the firmware and otherwise indemnified by a "your own fault for using a third-party slicer" clause in the EULA. Bambu Labs shouldn't need to be in the authentication/authorization path, unless we're actively using their cloud environment.

deleted 2y ago

[deleted]

asah 2y ago

Their response: https://blog.bambulab.com/updates-and-third-party-integration-with-bambu-connect/ https://blog.bambulab.com/updates-and-third-party-integratio...

hn8726 2y ago
Honestly, the response is not that great. Right off the bat they're just going on the defensive, enumerating "false claims" that printer will require subscription etc. But the concern wasn't that Bambu _will_ do that, but that they _could_ do that, and generally that inserting Bambu's infrastructure as a mandatory step in the printing pipeline is _not great_. Then, the first point in their `truth about the update` section: > This is NOT about limiting third-party software. We're creating Bambu Connect specifically to ensure continued third-party integration while enhancing security. We're actively working with developers like Orca Slicer to implement this integration. The `we're actively working` with Orca was already addressed by the OrcaSlicer developer [0] > Bambu informed me of this change two days before their announcement. and Bambu's idea of "working with" is helping to implement redirect from Orca to their own software that would actually start the print. Seems like limiting third-party software to me. > This is beta testing, not a forced update. The choice is yours. This is bizarre, surely beta firmware is intended to be release firmware at some point? If anything, the community outrage proved beta track to work as intended. > About Panda Touch. We reached out to BTT as soon as we became aware of their product. We warned them that using exploited MQTT protocols... Also addressed by BQ in [1], tl;dr they tried to work with Bambu but didn't get much response, only a warning that the MQTT might stop working in a future update. So technically Bambu _reached out_, but only to say "don't improve our product". In the end, Bambu is screwing over their customers more than BQ Further down they still go and defend their decision > When using third-party slicing software like Orca Slicer, the difference in users experience is not much. and proceed to demonstrate that Orca Slicer will _easily_ open the new app which will be able to start the printing. Which is exactly what the community complained about, and doesn't address things like missing Linux support. Finally, they're presenting a diagram showing how the new flow looks like. Except the diagram is missing any details about what the new software does — it doesn't show how, when and why the new software communicates with the cloud. For someone with even cursory understanding of security, the changes just don't make much sense, and Bambu is not doing much to explain the security protocols they're trying to implement. For all I know they just slapped a private certificate somewhere in the Bambu Connect app and started signing requests to the printer, which doesn't improve security at all if the private key is already public [0] https://github.com/SoftFever/OrcaSlicer/issues/8063#issuecomment-2599603543 https://github.com/SoftFever/OrcaSlicer/issues/8063#issuecom... [1] https://old.reddit.com/r/BIGTREETECH/comments/1i5lzzf/latest_update_for_panda_touch/m859z7c/ https://old.reddit.com/r/BIGTREETECH/comments/1i5lzzf/latest...

elcapitan 2y ago

As a precaution, I've blocked my A1 mini from Internet access on the router, and will not apply any firmware updates anymore. I will also not update Bambu Studio anymore (or completely switch to Orcaslicer). I was already using LAN mode exclusively. Kind of annoying, but I'm not desperately waiting for Firmware updates, everything works fine so far.

05 2y ago

RMS was right

shul 2y ago

Bambu sent out a clarification in their blog, you should read it

broadsidepicnic 2y ago
no need linking it, tho

blutack 2y ago

I'm interested what others think of their existing design and whether there are any fundamental security issues that will be resolved by their proposed change. They are proposing requiring a secret signed certificate to carry out any actions beyond monitoring for both the cloud and local (on printer) MQTT servers. These certificates would be issued at the discretion of Bambu by their CSR, currently only for "Bambu Studio" their slicer, Bambu Handy (their mobile app) and "Bambu Connect" which will enable upload G-Code generated by third party slicer (a workaround for existing functionality being removed). This "secret" certificate has already been extracted from the Bambu Connect application as per the article as their new security model requires embedded this certificate into desktop applications. The current design: https://github.com/Doridian/OpenBambuAPI/blob/main/mqtt.md https://github.com/Doridian/OpenBambuAPI/blob/main/mqtt.md Connecting to their cloud MQTT requires a username and token already. These details are obtained via a HTTPS request to their login server using your bambu account (which requires a valid email & possibly captcha) to obtain a token. The cloud MQTT is TLS secured, although this is just to encrypt the traffic (aka HTTPS), it is not mutual authentication. Connecting to the MQTT server hosted on the printer (aka LAN mode) requires a fixed username and a local access token (a random 8 digit number). This can be found via the physical display of the printer in a menu (or apparently cloud MQTT!?). This access token can be refreshed via a menu option again physically at the printer. To be clear, this token only allows to you connect directly to the local MQTT server running on the IP address of the printer, so in most environments this should only be the local network. This is also the password for the FTP server that can be used to upload/download sliced 3mf/gcode files. Personally - this design seems ok to me? With an MQTT service properly configured to isolate user accounts from each other, this is a pattern widely deployed for embedded devices (Azure IoT, AWS IoT etc). I don't see how the "DDOS" related issues they are claiming would be related to this specific design. If the issue is in the login server - well, that's prior to authentication anyway so nothing they are doing here will fix that. If it's problems with your cloud MQTT service not being properly isolated - maybe fix that? If the DDOS is at L2, auth isn't going to help. You require logins tied to an email, you can block clients that misbehave once they are logged in. Nobody is brute forcing the local MQTT server via XSS or something, because JS doesn't allow for raw TCP connections. Are they concerned about malicious software already on the network? Then rate limiting on the printer side or switch to a random length alphanum LAN token to increase keyspace. I'm curious what more qualified people think, I cannot see any justications for their proposed design improving security. So either; a) They've decided they are incapable of properly securing their MQTT cloud stuff and instead of fixing that just want to assume every client connected to their cloud MQTT servers is fully trusted. I'm sure that'll work great. Doesn't justify adding this to the local MQTT servers on the printers - if anything that reduces security, as to roll certificates you now have a long tail of printer firmware updates. b) It's not about security

vanillax 2y ago

This is all nonsense. I just got a a1, and its my first 3d printer. I dont have any expertise. Ive been able to use the Bambu App and Maker world and basically control+P. Ive print about 10 things so far in the first week. I dont see why people are mad. They made the apple of printers. It just works(tm). I dont need anything else. People just get so upset over nothing.

mmorriso 2y ago
I tend to agree. I've built a Prusa previously and my P1S is just so much more reliable, it's the first printer I've been able to recommend to friends and colleagues who I wouldn't expect to enjoy tinkering with a printer but would enjoy printing. I have simply not had a failed print, it's incredible. I have so much confidence in the unit that I now keep two rolls of the same colour loaded and if I find a cool model while out and about, I just print it with full trust it'll be waiting for me by the time I get home. Amazing progress.

nirav72 2y ago

I've been on the fence about purchasing a Bambu. But given the amount of time I've spent over the past few years having to tweak my ender 3 V2 and CR-10- I was leaning towards finally splurging on a X1C. Question to those more familiar with the bambu software ecosystem - do these recent changes to authentication require a constant online connection to print anything from a machine on the LAN? I'm assuming printing via microSD will still be possible?

d1str0 2y ago
I’m not familiar with Bambu, I’m a Prusa user, but if I had to guess you would always be able to print via microSD. It would be wildly unpopular to disable local printing.
mmorriso 2y ago
Currently, LAN mode and local SD card printing does not require an internet connection. I have my printer in a bottom of the yard bungalow, without internet, and it works fine.

jchw 2y ago

I bought a Bambu Lab printer recently, and made the decision that if I did connect it to LAN, I'd make damn sure that it did not have an Internet connection, even though there is a LAN mode toggle in the firmware it shipped with. Although I am definitely paranoid about Internet-of-Shit bait'n'switch techniques, at the time I was mostly thinking in terms of geopolitical bullshit rather than capitalistic shenanigans. No particular reason to distrust Bambu Lab themselves at the time, at least more than any other company. Obviously, hingsight is 20:20, but it's just a reminder: your cynicism is warranted. Don't trust anyone any more than you absolutely have to.

DoctorOetker 2y ago

according to [0] the ipcam is logging video even when the camera is disabled. I suggest we collectively print Tiananmen Square Tank Man scenes. [0] https://www.reddit.com/r/BambuLab/comments/1i548m9/comment/m86t7g1/ https://www.reddit.com/r/BambuLab/comments/1i548m9/comment/m...

buckle8017 2y ago
these printers have spaghetti detection so it actually makes sense the camera is always on
- DoctorOetker 2y ago
  it does not make sense: spaghetti can be detected without logging it, just process and evaluate frames, and if necessary accumulate multiple evaluations (not images) to achieve better signal to noise ratio.
- wpm 2y ago
  Spaghetti detection is supposed to happen on-device.
  - buckle8017 2y ago
    Yes? the reddit guy is saying the device is always saving pictures on the device.
bigiain 2y ago
> I suggest we collectively print Tiananmen Square Tank Man scenes. Anyone got a link to a good .stl?
- DoctorOetker 2y ago
  we will have to make one, I suggest we also use machine translation to include the historical background into the print in their own language.

whatevermang 2y ago

Maybe I'm the exception here, but I slice my files and then load them to an SD card and walk them over to my printer. It's not high tech, but since you can't clear the build plate without physically being there, I don't see much of a change. If I really wanted to monitor the build I suppose I could just point a webcam at it rather than use the existing one. But since it prints flawlessly most of the time it seems unnecessary.

GuB-42 2y ago
> you can't clear the build plate without physically being there BambuLabs printers may not support this but some people do it. The idea is to use the print head to knock the part out of the bed and into a bin. Probably not worth the hassle for personal use and you may need to design the part a certain way to make it possible, but it is useful for mass production.

dlgeek 2y ago

What I don't get...BambuSlicer is open source. And, not only is it open source, it's a fork of PrussaSlicer, so Bambu doesn't have the ability to re-license it. It's licensed under the Affero GPL which is very strict about the licensing of derived works. That license requires Bambu to include the source code to any additions they make, including all of the logic, keys, etc. that they're baking into any binary distributions. If they don't, they're violating the copyright rights of Prussa and many others. So, either Bambu has to open source all of this, which defeats the purpose (given that it's already leaked, that's gonna happen anyway) or they have to route everything through a separate program for their own slicer.

whatsthatabout 2y ago
BambuConnect is not part of BambuStudio - That's intentional, so BambuLab does not need to share/open-source it. The current implementation (the Bambu network plugin thingy) isn't a part of it either, it's downloaded by the client when BambuStudio is opened.
- dlgeek 2y ago
  They claimed that studio wouldn't need connect. I don't know AGPL well enough to know if a plugin is considered a derived work but it sure seems to imply it: > For example, Corresponding Source includes interface definition files associated with source files for the work, and the source code for shared libraries and dynamically linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those subprograms and other parts of the work.