5 ms·

BambuStudio has been violating PrusaSlicer AGPL license since their fork

105 points by marcosscriven 5mo ago

https://www.tomshardware.com/3d-printing/josef-prusa-warns-chinese-3d-printing-software-poses-massive-security-risks-bambu-lab-allegedly-violates-agpl-license-with-an-un-auditable-network-black-box https://www.tomshardware.com/3d-printing/josef-prusa-warns-c... https://twitter.com/josefprusa/status/2054602354851254330 https://twitter.com/josefprusa/status/2054602354851254330

nazgu1 5mo ago
It looks like generated by "AI", so I recommend taka a dose of scepticism before reading.
- Gigachad 5mo ago
  A more credible source from Prusa (the company behind the source slicer that bambulab forked) https://www.tomshardware.com/3d-printing/josef-prusa-warns-chinese-3d-printing-software-poses-massive-security-risks-bambu-lab-allegedly-violates-agpl-license-with-an-un-auditable-network-black-box https://www.tomshardware.com/3d-printing/josef-prusa-warns-c... The situation is interesting and kind of a grey area. The way they structured the network code as a plugin that downloads after first run is obviously to avoid violating the AGPL license, but if you don’t install it, large parts of the slicer are inaccessible. So it’s not at all like a normal plugin. Edit: a more direct source. https://x.com/josefprusa/status/2054602354851254330 https://x.com/josefprusa/status/2054602354851254330
  - wlkr 5mo ago
    This is much better than the current slop post. Could it be swapped, please @dang?
    - fragmede 5mo ago
      @dang doesn't do anything. email hn@ycombinator.com to get his/other moderators attention (which I did).
    - walletdrainer 5mo ago
      The tweets by Josef Prusa also seem LLM generated, this whole story is slop.
      - dolebirchwood 5mo ago
        These banal accusations are so dim and dull.
        walletdrainer 5mo ago
        Banal accusations? Here's the frequency of the " - " pattern in tweets by "josefprusa" 2020: 8 / 761 tweets = 1.1% 2021: 5 / 533 tweets = 0.9% 2022: 9 / 597 tweets = 1.5% 2023: 21 / 450 tweets = 4.7% 2024: 57 / 725 tweets = 7.9% 2025: 23 / 390 tweets = 5.9% 2026: 15 / 136 tweets = 11.0% Now, go ahead and tell me this guy is not yet another spammer polluting social media with LLM-generated garbage.
    - N-Krause 5mo ago
      The article linked here is a consequence of the actions taken against the repository linked by OP, not a more 'credible source'. The file linked in by OP, is the main argument by Pawel Jarczak why his fork does not violate any copyright laws (may it be written by/with help of AI or not).
      - wlkr 5mo ago
        I didn't say it was necessarily more credible, although I understand that was mentioned further up. Personally I found the article (not the tweets) much more useful to understand the context of all this, as someone very out of the loop. Certianly more useful to me than a long list of very specific, in my option largely LLM output, points about a codebase I'm entirely unfamiliar with with claims that seem to need a legal team and court case to be meaningful. Slop is somewhat unfair and I'm happy to be disagreed with.
        marcosscriven 5mo ago
        Indeed. It’s not clear at all to me that this is a better or even equivalent post to the one I submitted.
    - sbrocket 5mo ago
      It is kooky that you think some conspiracy nonsense about Bambu being a Chinese company and so something from Josef Prusa, is better than a detailed (if AI-written) analysis of all the ways that Bambu's networking plugin is a tightly integrated component of the AGPLv3 Bambu Studio from the creator of the only reimplementation of that plugin that exists/existed who is the direct target of Bambu's recent legal threats.
- po1nt 5mo ago
  Even if AI generated, the arguments look solid
- sbrocket 5mo ago
  The original post that this commenter objected to, which has now been replaced by Hacker News with a tweet from Josef Prusa with none of the same technical detail, is from one of the primary players in this whole debacle. Here's the original post: https://github.com/jarczakpawel/OrcaSlicer-bambulab/blob/main/bambu_agpl.md https://github.com/jarczakpawel/OrcaSlicer-bambulab/blob/mai... jarczakpawel@ (on Github) reimplemented their network plugin and was targeted with over-inflated legal threats (like Section 1201 claims about circumventing access control, which it did not do) and forced to take down his implementation. What he did is provide an open implementation of their closed source network plugin based on their open-source, AGPLv3 Bambu Studio. This was not some random "AI slop post". This was a (seemingly AI written, yes) summary from the creator at the center of the current debacle, who seems to be the best non-Bambu expert we have on Bambu's networking plugin. Josef Prusa's tweet is not at all equivalent information. Prusa's tweet seems to be little more than some conspiratorial thoughts about Chinese law and Bambu being a Chinese company. Does that play in? Maybe, I have no idea one way or the other, but it says nothing about the AGPL violations or the technical details of how tightly integrated the plugin is with Bambu Studio.
galaxyLogic 5mo ago
This interpretation would mean that you could not produce AGPL licensed code which loads some code in dynamically. Like say you couldn't have an AGPL licensed web-browser which sometimes loads pages whose JavaScript's source-code is obscured. ?
- Krutonium 5mo ago
  IIRC the difference is the effective requirement of having it for the intended function of the software; To whit: Printing to a Bambu printer. It's a legal gray area but the general legal consensus as I understand it is that the dynamic loading is enough most of the time up to the point where it's a requirement for functionality. Of course, IANAL and just a random passerby with a SUPER rough understanding.
- 243423443 5mo ago
  AFAIK, the code of the network "plugin" is dynamically loaded, but the version string is hardcoded in Bambu Studio. The analogy is not exactly right IMO; the browser is not restricted to a specific website or a specific version of that site.
- Gigachad 5mo ago
  The networking code is not some 3rd party content that happens to be loaded. It’s an integral part of bambu studio, and if you don’t install it, large parts of the apps functionality won’t work. By a common sense view it is not a plugin at all, it’s part of the app that they have structured in a weird way to try to avoid the obvious license violation.
- chadgpt3 5mo ago
  Software licensing disputes have almost nothing to do with the technical mechanism that loads the code into RAM. The court will look at the totality of the facts: what is the product, how is it normally operated, who is selling it. There's a lot more common sense involved than programmers like to think (but it's not completely about common sense). For example the Nvidia driver gets to ignore the Linux kernel license because even though it links with the kernel, when considered as a complete package it's not a derivative work of the kernel. It is its own product that can be plugged into various kernels such as Windows and Linux, and the small adapter layer for each kernel doesn't change that. Some German court even once interpreted GPLv2 to prohibit tivoization.
liamgm 5mo ago
it is okay for agpl3 app to consume propietary library , not the opposite that derived code must be same viral license
- tsimionescu 5mo ago
  If you want to distribute binaries or code based on the (A)GPLv3, or use them to serve content over the wire, you have to distribute the source code of the entire software project under the (A)GPLv3. If part of that software is proprietary and licensed in such a way that you can't or won't distribute its code under the (A)GPLv3 or a compatible license, then you can't use any of the (A)GPLv3 code at all. Now, there is some unclear legality around the distribution of plug-ins to a standalone software package. Are you allowed to distribute a GPLv3 plug-in to a proprietary program, like a GPLv3 plugin for Visual Studio? Maybe. Are you allowed to sell a proprietary plug-in for a GPLv3 software, like a paid plug-in to Emacs? Again, maybe. However, the chances for both go down significantly if the "plug-in" is distributed by the same company as the software itself, and if the plugin is critical to major functionality of that software.
  - liamgm 5mo ago
    From i read that not "plugin"/module problem but library problem , difference is a lot. It's okay to depend on propietary library but not ok for propietary "plugin"/module. Apple also doing this for their fork of CrossOver's Wine GPL called Game Porting Toolkit, composed by Wine + propietary D3DMetal DirectX library
    - em-bee 5mo ago
      are you referring to the exception for proprietary libraries that are part of the operating system? an exception that is needed because otherwise it would be impossible to build GPL software for non-free operating systems. wine is under the LGPL which allows linking to any non-free libraries as long as those libraries are available in a form that allows relinking to a changed version of the application.
- sbrocket 5mo ago
selectively 5mo ago
Generated by AI + no one cares about AGPL license compliance (and they aren't violating the AGPL anyway - your AI model is confusing the AGPL for actual GPL).
- sbrocket 5mo ago
  This is nonsense. AGPLv3 is GPLv3 with an added term that extends it to SaaS/network hosted software as well as software distributed in binary or source form. What are you suggesting the AGPL allows that GPL does not? AI-generated text is worth skepticism, but humans can be idiots and spout nonsense too.
  - walletdrainer 5mo ago
    > AI-generated text is worth skepticism, but humans can be idiots and spout nonsense too. Sure, but anyone posting chains of incredibly long LLM generated tweets can safely be ignored as an utter moron.
    - sbrocket 5mo ago
      I understand that filter, I think, but unfortunately your filter is failing you here. The original post was replaced by Hacker News, and was originally a long post on Github - https://github.com/jarczakpawel/OrcaSlicer-bambulab/blob/main/bambu_agpl.md https://github.com/jarczakpawel/OrcaSlicer-bambulab/blob/mai... - detailing how tightly integrated Bambu's networking plugin is with their "forked from the community, long standing AGPLv3" Bambu Studio. That Github post is from the creator at the center of the current debacle, who is probably the foremost expert on Bambu's networking plugin that exists outside of Bambu at the moment since he reimplemented it from scratch. There were no long LLM generated tweets in the original post. I agree that Prusa's tweets seem like a weak and conspiratorial argument about Bambu being a Chinese company and so something. They seem like a distraction and it's a shame HN changed the original post. Surprising they can even do that. The AGPLv3 violations here are pretty clear. Bambu's networking plugin is a tightly integrated closed-source carve out of AGPLv3 code they forked from the open-source community.
walletdrainer 5mo ago
Do people genuinely not understand how stupid it makes them look when they copypaste ChatGPT output onto social media like this? Based on his tweets, Josef seems like a guy incapable of coming up with his own original thoughts.
- aleph_minus_one 5mo ago
  > Based on his tweets, Josef seems like a guy incapable of coming up with his own original thoughts. Rather: Josef Průša is not a native English speaker (his mother tongue is Czech). I observe this for myself: a lot of my original thoughts are hard to translate into English because they are deeply intertwined with how the German language is built. From my observation in particular native German speakers are prone to this phenomenon (that their original thoughts are quite intertwined with how their native language works). I had this discussion with educated English, Turkish and Russian native speakers, but they honestly told me that for them this relationship between their mother tongue and their original thoughts is not similarly marked.
  - em-bee 5mo ago
    it also depends on your language proficiency. i am a native german speaker, but my english is fluent. i think and dream in english too i guess. which means i am not translating any more.
  - walletdrainer 5mo ago
    > Rather: Josef Průša is not a native English speaker (his mother tongue is Czech). Are you joking? Guy has been tweeting in English for almost two decades, that’s not the problem. Here's the frequency of the " - " pattern in tweets by "josefprusa" 2020: 8 / 761 tweets = 1.1% 2021: 5 / 533 tweets = 0.9% 2022: 9 / 597 tweets = 1.5% 2023: 21 / 450 tweets = 4.7% 2024: 57 / 725 tweets = 7.9% 2025: 23 / 390 tweets = 5.9% 2026: 15 / 136 tweets = 11.0%
    - aleph_minus_one 5mo ago
      > Are you joking? Guy has been tweeting in English for almost two decades, that’s not the problem. I think you deeply underestimate how deep your thinking can be convoluted with your native language that you grew up with: I very often have discussions with native speakers of other languages about how I can translate some specific German phrases/thoughts into their mother tongue. They often have to admit that their native language simply has no "pattern" for this, or that the phrase is based on cultural assumptions that do hold in Germany, but not in the country where the language that I want to translate my phrase to is commonly spoken. > Here's the frequency of the " - " pattern in tweets by "josefprusa" What do you want to tell with this?
sebazzz 5mo ago
If Bambu Lab goes after Orcaslicer, then it makes sense they will get scrutinised for the AGPL violation.

105 points by marcosscriven 5mo ago

nazgu1 5mo ago

It looks like generated by "AI", so I recommend taka a dose of scepticism before reading.

Gigachad 5mo ago
A more credible source from Prusa (the company behind the source slicer that bambulab forked) https://www.tomshardware.com/3d-printing/josef-prusa-warns-chinese-3d-printing-software-poses-massive-security-risks-bambu-lab-allegedly-violates-agpl-license-with-an-un-auditable-network-black-box https://www.tomshardware.com/3d-printing/josef-prusa-warns-c... The situation is interesting and kind of a grey area. The way they structured the network code as a plugin that downloads after first run is obviously to avoid violating the AGPL license, but if you don’t install it, large parts of the slicer are inaccessible. So it’s not at all like a normal plugin. Edit: a more direct source. https://x.com/josefprusa/status/2054602354851254330 https://x.com/josefprusa/status/2054602354851254330
- wlkr 5mo ago
  This is much better than the current slop post. Could it be swapped, please @dang?
  - fragmede 5mo ago
    @dang doesn't do anything. email hn@ycombinator.com to get his/other moderators attention (which I did).
  - walletdrainer 5mo ago
    The tweets by Josef Prusa also seem LLM generated, this whole story is slop.
    - dolebirchwood 5mo ago
      These banal accusations are so dim and dull.
      - walletdrainer 5mo ago
        Banal accusations? Here's the frequency of the " - " pattern in tweets by "josefprusa" 2020: 8 / 761 tweets = 1.1% 2021: 5 / 533 tweets = 0.9% 2022: 9 / 597 tweets = 1.5% 2023: 21 / 450 tweets = 4.7% 2024: 57 / 725 tweets = 7.9% 2025: 23 / 390 tweets = 5.9% 2026: 15 / 136 tweets = 11.0% Now, go ahead and tell me this guy is not yet another spammer polluting social media with LLM-generated garbage.
  - N-Krause 5mo ago
    The article linked here is a consequence of the actions taken against the repository linked by OP, not a more 'credible source'. The file linked in by OP, is the main argument by Pawel Jarczak why his fork does not violate any copyright laws (may it be written by/with help of AI or not).
    - wlkr 5mo ago
      I didn't say it was necessarily more credible, although I understand that was mentioned further up. Personally I found the article (not the tweets) much more useful to understand the context of all this, as someone very out of the loop. Certianly more useful to me than a long list of very specific, in my option largely LLM output, points about a codebase I'm entirely unfamiliar with with claims that seem to need a legal team and court case to be meaningful. Slop is somewhat unfair and I'm happy to be disagreed with.
      - marcosscriven 5mo ago
        Indeed. It’s not clear at all to me that this is a better or even equivalent post to the one I submitted.
  - sbrocket 5mo ago
    It is kooky that you think some conspiracy nonsense about Bambu being a Chinese company and so something from Josef Prusa, is better than a detailed (if AI-written) analysis of all the ways that Bambu's networking plugin is a tightly integrated component of the AGPLv3 Bambu Studio from the creator of the only reimplementation of that plugin that exists/existed who is the direct target of Bambu's recent legal threats.
po1nt 5mo ago
Even if AI generated, the arguments look solid
sbrocket 5mo ago
The original post that this commenter objected to, which has now been replaced by Hacker News with a tweet from Josef Prusa with none of the same technical detail, is from one of the primary players in this whole debacle. Here's the original post: https://github.com/jarczakpawel/OrcaSlicer-bambulab/blob/main/bambu_agpl.md https://github.com/jarczakpawel/OrcaSlicer-bambulab/blob/mai... jarczakpawel@ (on Github) reimplemented their network plugin and was targeted with over-inflated legal threats (like Section 1201 claims about circumventing access control, which it did not do) and forced to take down his implementation. What he did is provide an open implementation of their closed source network plugin based on their open-source, AGPLv3 Bambu Studio. This was not some random "AI slop post". This was a (seemingly AI written, yes) summary from the creator at the center of the current debacle, who seems to be the best non-Bambu expert we have on Bambu's networking plugin. Josef Prusa's tweet is not at all equivalent information. Prusa's tweet seems to be little more than some conspiratorial thoughts about Chinese law and Bambu being a Chinese company. Does that play in? Maybe, I have no idea one way or the other, but it says nothing about the AGPL violations or the technical details of how tightly integrated the plugin is with Bambu Studio.

galaxyLogic 5mo ago

This interpretation would mean that you could not produce AGPL licensed code which loads some code in dynamically. Like say you couldn't have an AGPL licensed web-browser which sometimes loads pages whose JavaScript's source-code is obscured. ?

Krutonium 5mo ago
IIRC the difference is the effective requirement of having it for the intended function of the software; To whit: Printing to a Bambu printer. It's a legal gray area but the general legal consensus as I understand it is that the dynamic loading is enough most of the time up to the point where it's a requirement for functionality. Of course, IANAL and just a random passerby with a SUPER rough understanding.
243423443 5mo ago
AFAIK, the code of the network "plugin" is dynamically loaded, but the version string is hardcoded in Bambu Studio. The analogy is not exactly right IMO; the browser is not restricted to a specific website or a specific version of that site.
Gigachad 5mo ago
The networking code is not some 3rd party content that happens to be loaded. It’s an integral part of bambu studio, and if you don’t install it, large parts of the apps functionality won’t work. By a common sense view it is not a plugin at all, it’s part of the app that they have structured in a weird way to try to avoid the obvious license violation.
chadgpt3 5mo ago
Software licensing disputes have almost nothing to do with the technical mechanism that loads the code into RAM. The court will look at the totality of the facts: what is the product, how is it normally operated, who is selling it. There's a lot more common sense involved than programmers like to think (but it's not completely about common sense). For example the Nvidia driver gets to ignore the Linux kernel license because even though it links with the kernel, when considered as a complete package it's not a derivative work of the kernel. It is its own product that can be plugged into various kernels such as Windows and Linux, and the small adapter layer for each kernel doesn't change that. Some German court even once interpreted GPLv2 to prohibit tivoization.

liamgm 5mo ago

it is okay for agpl3 app to consume propietary library , not the opposite that derived code must be same viral license

tsimionescu 5mo ago
If you want to distribute binaries or code based on the (A)GPLv3, or use them to serve content over the wire, you have to distribute the source code of the entire software project under the (A)GPLv3. If part of that software is proprietary and licensed in such a way that you can't or won't distribute its code under the (A)GPLv3 or a compatible license, then you can't use any of the (A)GPLv3 code at all. Now, there is some unclear legality around the distribution of plug-ins to a standalone software package. Are you allowed to distribute a GPLv3 plug-in to a proprietary program, like a GPLv3 plugin for Visual Studio? Maybe. Are you allowed to sell a proprietary plug-in for a GPLv3 software, like a paid plug-in to Emacs? Again, maybe. However, the chances for both go down significantly if the "plug-in" is distributed by the same company as the software itself, and if the plugin is critical to major functionality of that software.
- liamgm 5mo ago
  From i read that not "plugin"/module problem but library problem , difference is a lot. It's okay to depend on propietary library but not ok for propietary "plugin"/module. Apple also doing this for their fork of CrossOver's Wine GPL called Game Porting Toolkit, composed by Wine + propietary D3DMetal DirectX library
  - em-bee 5mo ago
    are you referring to the exception for proprietary libraries that are part of the operating system? an exception that is needed because otherwise it would be impossible to build GPL software for non-free operating systems. wine is under the LGPL which allows linking to any non-free libraries as long as those libraries are available in a form that allows relinking to a changed version of the application.
sbrocket 5mo ago

selectively 5mo ago

Generated by AI + no one cares about AGPL license compliance (and they aren't violating the AGPL anyway - your AI model is confusing the AGPL for actual GPL).

sbrocket 5mo ago
This is nonsense. AGPLv3 is GPLv3 with an added term that extends it to SaaS/network hosted software as well as software distributed in binary or source form. What are you suggesting the AGPL allows that GPL does not? AI-generated text is worth skepticism, but humans can be idiots and spout nonsense too.
- walletdrainer 5mo ago
  > AI-generated text is worth skepticism, but humans can be idiots and spout nonsense too. Sure, but anyone posting chains of incredibly long LLM generated tweets can safely be ignored as an utter moron.
  - sbrocket 5mo ago
    I understand that filter, I think, but unfortunately your filter is failing you here. The original post was replaced by Hacker News, and was originally a long post on Github - https://github.com/jarczakpawel/OrcaSlicer-bambulab/blob/main/bambu_agpl.md https://github.com/jarczakpawel/OrcaSlicer-bambulab/blob/mai... - detailing how tightly integrated Bambu's networking plugin is with their "forked from the community, long standing AGPLv3" Bambu Studio. That Github post is from the creator at the center of the current debacle, who is probably the foremost expert on Bambu's networking plugin that exists outside of Bambu at the moment since he reimplemented it from scratch. There were no long LLM generated tweets in the original post. I agree that Prusa's tweets seem like a weak and conspiratorial argument about Bambu being a Chinese company and so something. They seem like a distraction and it's a shame HN changed the original post. Surprising they can even do that. The AGPLv3 violations here are pretty clear. Bambu's networking plugin is a tightly integrated closed-source carve out of AGPLv3 code they forked from the open-source community.

walletdrainer 5mo ago

Do people genuinely not understand how stupid it makes them look when they copypaste ChatGPT output onto social media like this? Based on his tweets, Josef seems like a guy incapable of coming up with his own original thoughts.

aleph_minus_one 5mo ago
> Based on his tweets, Josef seems like a guy incapable of coming up with his own original thoughts. Rather: Josef Průša is not a native English speaker (his mother tongue is Czech). I observe this for myself: a lot of my original thoughts are hard to translate into English because they are deeply intertwined with how the German language is built. From my observation in particular native German speakers are prone to this phenomenon (that their original thoughts are quite intertwined with how their native language works). I had this discussion with educated English, Turkish and Russian native speakers, but they honestly told me that for them this relationship between their mother tongue and their original thoughts is not similarly marked.
- em-bee 5mo ago
  it also depends on your language proficiency. i am a native german speaker, but my english is fluent. i think and dream in english too i guess. which means i am not translating any more.
- walletdrainer 5mo ago
  > Rather: Josef Průša is not a native English speaker (his mother tongue is Czech). Are you joking? Guy has been tweeting in English for almost two decades, that’s not the problem. Here's the frequency of the " - " pattern in tweets by "josefprusa" 2020: 8 / 761 tweets = 1.1% 2021: 5 / 533 tweets = 0.9% 2022: 9 / 597 tweets = 1.5% 2023: 21 / 450 tweets = 4.7% 2024: 57 / 725 tweets = 7.9% 2025: 23 / 390 tweets = 5.9% 2026: 15 / 136 tweets = 11.0%
  - aleph_minus_one 5mo ago
    > Are you joking? Guy has been tweeting in English for almost two decades, that’s not the problem. I think you deeply underestimate how deep your thinking can be convoluted with your native language that you grew up with: I very often have discussions with native speakers of other languages about how I can translate some specific German phrases/thoughts into their mother tongue. They often have to admit that their native language simply has no "pattern" for this, or that the phrase is based on cultural assumptions that do hold in Germany, but not in the country where the language that I want to translate my phrase to is commonly spoken. > Here's the frequency of the " - " pattern in tweets by "josefprusa" What do you want to tell with this?

sebazzz 5mo ago

If Bambu Lab goes after Orcaslicer, then it makes sense they will get scrutinised for the AGPL violation.