10 ms·
Bambu Lab - Setting the Record Straight About Our Security Update
- pmichaud 2y agoI'm pretty pissed that they baited and switched me--I bought a bambu printer on holiday sale under the previous terms, and they are now going to change the terms. Feels fraudulent.
- Jackosas 2y ago[dead]
- ChrisArchitect 2y agoRelated: BambuLab new firmware to cut access to third-party API and tools https://news.ycombinator.com/item?id=42760491 https://news.ycombinator.com/item?id=42760491
- dang 2y agoThis also? Reverse Engineering Bambu Connect - https://news.ycombinator.com/item?id=42764602 https://news.ycombinator.com/item?id=42764602 - Jan 2025 (316 comments)
- louwrentius 2y agoMeanwhile Jeff Geerling already put a video out on his second channel that he won’t recommend a bambu lab printer anymore although he was happy with his printer. And this update didn’t convince him to change his mind. “Developer mode” isn’t a solution. You buy hardware and it should work 100% without cloud connectivity. Otherwise it’s not your hardware.
- sitkack 2y agoAbsolutely! Local first, everything that should likely run locally should be enabled. You can’t use the desktop software to see the contents of the SD card, you have to enable cloud access. I own two Bambu printers, great hardware, and ok software. No longer recommending them.
- parasubvert 2y agoNeither LAN mode nor Developer mode requires cloud connectivity. Keep spreading the FUD though.
- muppetman 2y agoThere is little I find more hilarious than the "<talking head> has put out a video on their <youtube/tiktok/facebook> that says <thing>" comment reply. I summarise all these replies in my head as "Influencer I've never heard of influences" I agree with your re: Developer mode though.
- throw_a_grenade 2y agoThis is not the case though, Jeff Geerling is not a no-name influencer. He actually does stuff, contributes to Fedora and AlmaLinux (IIRC). The most influencer-y stuff would be his playing with funny Raspberry Pi setups, but calling that "influencing" would be uncharitable. That's a hobby.
- muppetman 2y agoYes I'm sure a small subsection of people have heard of him/look up to him for his achievements. I've no doubt he's a smart intelligent person. I'm not having a go at Jeff. My point was the hilarious cult worship of these people. "X posted a video about Y gasp" when 1 in 10,000 know who X is. Influencer influences! Film at 11!
- Jzush 2y agoYeah, what is the point of developer mode for a device you’re not “allowed” to develop for anyway?
- mmorriso 2y agoI use LAN mode for my P1S currently in a shed with a local AP and no internet access and it works fine.
- barbazoo 2y agohttps://www.youtube.com/watch?v=91kfolYkRNM https://www.youtube.com/watch?v=91kfolYkRNM Says even then you have to use their app and cloud service to set up the printer.
- the_mitsuhiko 2y agoI don't think this is correct. I'm fairly certain you can enable LAN only mode without signing in on the printer.
- hammond 2y agoIt's not true, my P1S+AMS has never touched the Internet and I was able to set it up fine on an isolated wifi network out of the box.
- scblock 2y agoThe list of fake concerns they list are not the real and very valid concerns I have seen. This addresses nothing.
- the_mitsuhiko 2y ago> This addresses nothing. This does in-fact address quite a bit, because they have change their stance with this update. Previously even LAN only mode required to go via their bambu connect system, now you can switch it to developer mode and talk freely via MQTT to the printer.
- progbits 2y agoBut when you buy the printer you still need to give it internet access / connect via their app, right?
- the_mitsuhiko 2y agoI'm not sure why you would need to give it internet access. I think even the firmware updates work via SD card.
- nullc 2y agoThey just introduced firmware updates via SD card in the most recent released version, prior to that you had to put the printer online and associate it with an account to get firmware updates. But yes today there is no need to use their cloud services unless you want to control the printer with their phone app. And the printer works totally fine completely isolated from the internet. The now aborted proposed update would have required using a binary shim from bambu with an embedded 1 year lifetime SSL cert to speak the the printer at all, even when in lan mode.
- LouisvilleGeek 2y agoBambu Companion (unfortunately iPhone only) does more than Handy and works on LAN. Using it today in fact! https://www.youtube.com/watch?v=LZpDQN9zgUI https://www.youtube.com/watch?v=LZpDQN9zgUI
- TechIsCool 2y agoI am surprised that the use of a messaging queue through MQTT is considered a misuse of their technology when in reality it appears that the other application just was using an internal API that could change without notice. I also could see how certificate based authentication could be viewed by some as a time based expiration on the firmware.
- vvanders 2y agoYeah that's a huge bummer if so, I've got both a HA automation that shows the printer status without needing to have an app installed and I've got a secondary filtration system that's fully automated which would be a PITA if I had to manage manually. Totally understand if it's something that could change/break in future updates but the language about it being "exploited" is a bummer, you would think extending/documenting that would actually drive further adoption of the printers by building a more robust ecosystem around them.
- blutack 2y agoDoes anyone know or can see an actual concrete security concern with the current implementation of LAN mode? https://github.com/Doridian/OpenBambuAPI/blob/main/mqtt.md https://github.com/Doridian/OpenBambuAPI/blob/main/mqtt.md Right now, the printer's local MQTT server can only be accessed from the local IP using an 8 digit password obtained through through the physical display. I can't personally see any fundamental issue with this design assuming the implementation is correct, but I'm curious if others can.
- iLoveOncall 2y agoLook up old results about "BambuLab MQTT" on Google. They use an online MQTT server instead of the local one for the following functions: initiating printing, heating the nozzle, and heating the heatbed. (see https://www.allaboutbambu.com/2024/06/14/p1p-p1s-new-firmware-released-with-a-twist/ https://www.allaboutbambu.com/2024/06/14/p1p-p1s-new-firmwar...) On https://forum.bambulab.com/t/bambu-lab-mqtt-limitations/83440 https://forum.bambulab.com/t/bambu-lab-mqtt-limitations/8344... you can see their MQTT server got DDOSed by some faulty 3rd party "client". I don't think it's so much about security of the users as much as it is about their own.
- nullc 2y agoThat article is referring to conflicting controls when using their cloud stuff. In lan mode it doesn't use anything remote and works just fine completely isolated. > you can see their MQTT server got DDOSed by some faulty 3rd party "client" Right, when you use 'cloud mode' then bambu controls the printer, and your own control has to go through them.
- parasubvert 2y agoTo me this whole thing feels like they're trying to pass audit to sell Bambu printers to corporations that require secure communications. Mutual TLS with client certs is nearly universal, which is what they're trying to do with Bambu Connect. On the other hand, MQTT isn't a very secure protocol, plus the printer also uses FTP which is mostly banned on corporate networks these days.
- Hizonner 2y agoUh-huh. So exactly what threat or threats is the "security upgrade" meant to address, what alternatives were considered, and where the heck is the "security" in sticking a barely obfuscated private key in a publicly distributed binary?
- ClassyJacket 2y agoThe threat of Bambu not being able to remotely brick your printer in 5 years when they want to sell you a new one
- karunamurti 2y agoThe security threat is real, they got ddos attempt to their mqtt service last year from 3rd party apps. The fix is not good though, distributing private key.
- hn8726 2y agoI genuinely don't understand how these changes could possibly protect them from ddos though — their cloud APIs are still public, and the Bambu Connect app has to do stuff there as well. What could've changed with the proposed changes?
- snvzz 2y agoSad attempt at damage control. Meanwhile, trust continues to be eroded.
- parasubvert 2y agoPeople seem to be missing that FTP and MQTT are generally insecure protocols. I think FTP is probably the bigger issue than MQTT. This kind of stuff is common in home IOT networks but would never pass security audit on a corporate network. Bambu is growing up, serving more corporations beyond the hobby community, and probably has been asked to beef their security up to make it easier to deploy their printers securely. Moving to Mutual TLS via a controlled client like Bambu Connect is a pretty industry standard approach to secure, authenticated communication that doesn't require an internet connection, it is done with digital signatures offline.... and thus it can be done over a LAN. It's how many web APIs inside a corporate network are secured. It's how web browsers are secured. Microsoft, Mozilla, Google, Apple, etc. all send you revised certs/keys regularly in your OS or browser patches. Client authentication via x.509 cert signature or subject verification isn't super common on the public web but it does happen a lot with mobile apps or thick client apps, or some websites, e.g. SAP's many websites often use it to verify you're a customer.
- Maskawanian 2y agoMQTT is not inherently insecure. Much like HTTP, there is a encrypted version that runs on port 8883.
- parasubvert 2y agoThat... doesn't make things particularly secure. First of all MQTT doesn't require authentication. Secondly FTP is involved which is generally deprecated on most sensible servers and networks. Finally, sending passwords in the clear over an encrypted wire to an end device has been an obsolete technique for over 20 years. People still do it, but they shouldn't. It's the reason we have Kerberos, OAuth2/OIDC, and x509 client authentication with Mutual TLS.
- Maskawanian 2y agoNah, you made an absolute statement that MQTT was insecure, that was demonstrated to be incorrect. If HTTP can be made secure by relying on a secure transport, then MQTT can as well. Additionally, MQTT does allow for authentication. I've personally set up brokers many times that will not allow anonymous connections. Misconfiguration of services, does not constitute an error in the protocol itself.
- LeFantome 2y agoThe play here is obviously that they want 3rd party services to use Bambu Connect instead of direct protocol integration. They will make Connect easy and direct too much work. That is what all the Panda talk was about. That way, when Bambu inevitably changes the model ( eg. Subscription ), we will have to pay to get access to the ecosystem. But Bambu will be able to claim that it is not them. We still support developer mode they will say, it is the evil third parties that do not. We need to make sure that dev mode becomes the de facto default. Don’t fall for connect.
- axegon_ 2y agoBambu lab printers are truly awesome in terms of what they can do for a very reasonable price. Having said that, I have never upgraded mine nor have I ever connected it to the internet and never will. Nor will I update it. If it takes me 15 minutes to get an ssh client running on an esp8266 that can connect to an poorly secured server and execute shell commands, there is no way I'm letting a proprietary chinese hardware and software anywhere near my home network. But this is just a side hobby of mine, so I can live with carrying around an SD card. But I can see how something like that can be a major blow to business owners. I am not entirely sure if this blog post is just a response or sneaky backpedaling from bambu labs after the backlash they received over the last few days.
- sarchertech 2y agoThis stuff isn’t gonna stop until we regulate it. I bought a miku baby monitor specifically because they were the only manufacturer that had the feature I wanted that promised to never charge monthly fees to use it. Well then they went bankrupt and a company bought them, forced an over the air update that disabled every feature that made the thing worth buying (for $399), and sent out a letter demanding monthly payment to reenable the “advanced” features. Market forces won’t fix this. Recurring revenue is just too tempting. It also doesn’t matter how well intentioned a company is, the moment they go out of business, someone will buy their assets and force monthly fees on their former customers.
- iancmceachern 2y agoThis is what Louis Rossmann has been doing, he's even been hiring lobbiests and getting results.
- igor47 2y agoSeems like the maker community, esp. YouTube influencers, uniformly recommend bambu. Curious-- do folks here have other recommendations? Equivalent quality, speed, maybe even price, but more committed to free software?
- aweiland 2y agoPrusa
- KMnO4 2y agoPrusa does not have an equivalent printer to the P1S/X1C. Even their Mk4s is twice the price of an A1 and is missing some basic features that come standard on all Bambu Lab printers (such as a camera).
- the_mitsuhiko 2y agoPrusa Core One exists.
- KMnO4 2y agoIt exists, but hasn't started shipping yet. It also is Prusa's step away from open source, so it could end up being just like the BBL.
- parasubvert 2y agoGenerally speaking, no. Prusa comes close - they're dedicated to community and OSS, and are quality parts... but are almost 2x the price and tend to be missing comparable features. The other competition doesn't quite have the UX and quality of Bambu Lab. That's changing slowly, but it's reality today IMO. The challenge is that the 3d Printing community is maturing from a hobbyist/tinker phase into a consumer phase with Bambu Lab leading the way. Bambu Lab has mostly threaded the needle by balancing proprietary UX with practical ability to tinker, swap parts, etc. But as with most hobby communities, if someone doesn't understand a motivation of a change, they immediately ascribe it to a conspiracy. Bambu Lab wanting to improve printer security is an obvious thing to anyone who has dealt with corporate network security in the past... today it is effectively an insecure toy that would only be deployed on black holed lab networks. They're trying to make it more modern via Mutual TLS authenticated file transfer rather than a cobbled together mix of FTP and MQTT.
- deleted 2y ago[deleted]
- reimertz 2y agoWe were about to to buy a Bambu Lab printer but then learnt there will be new printers coming out in Q1 so naturally wanted to wait. I need to educate myself on this a bit more on this issue, but it feels like the rest of the printer industry is just catching up with the X1C (looking at Creality K2 Plus).. Do I wait for next-gen printers from Bambu Labs which I imagine will be quite revolutionary, or do I buy we buy a Creality K2 Plus, which basically is a X1C.
- locusm 2y agoHave you taken a look at the Prusa Core One?
- iancmceachern 2y agoBut bigger!
- lucasauton01 2y ago[dead]
- solarkraft 2y agoIt’s such clownery to try to lock down a thing you’re trying to sell to a community of tinkerers. The brand damage (the article fighting strawmen does little to reduce it) can’t be worth whatever upside they’re seeing unless they really are positioning themselves to use their unjustified power for profit (which will, of course, result in greater brand damage). FWIW, I was really interested in the Bambu models until I found out about their shitty corporate behavior.
- solarkraft 2y agoIs there firmware for Bambu printers beyond the X1 that just skips all the stupid stuff this company does (while keeping the good features)? Like most companies, it seems that they shouldn’t be trusted with control over hardware that you own.
- rcarmo 2y agoThat diagram they have is unfathomable and the arrows are confusing. It would probably have been best to do a separate LAN mode diagram to explain if there are any cloud dependencies whatsoever.
- Chengdavid 2y ago[dead]