Consumer Rights Wiki - User contributions [en]

Bambu Farm Manager

2025-01-20T17:21:33Z

Lomanic: link put as <ref> ; fix <nowiki> ; typography

{{StubNotice}}
It appears that Bambu Lab is trying to charge additional money after the sale of a 3D printer if you want to use it e.g., in a 3D printing farm<ref>https://bambulab.com/fr/policies/bambu-farm-manager-service-agreement</ref>.

<blockquote>Access to and use of the Service requires two software components: the Bambu Farm Server application and the Bambu Farm client application (collectively referred to as “Bambu Farm Manager,” or the “Software").

[…]

BAMBU LAB MAY OFFER THE SERVICES AND SOFTWARE WITHOUT CHARGE, '''FOR A FEE, OR MAY CHARGE A FEE TO CERTAIN USERS OR FOR CERTAIN USES (E.G. COMMERCIAL USES)'''. BAMBU LAB RESERVES THE RIGHT TO AND '''MAY CHANGE THE LICENSE AND FEE STRUCTURE, CONDITIONS, AND WHICH USERS OR USES REQUIRE A FEE'''. WE WILL GIVE YOU REASONABLE ADVANCE NOTICE IF WE IMPLEMENT OR CHANGE ANY FEES PAYABLE FOR THE LICENSE TO THE SOFTWARE OR CONNECTED SERVICES.</blockquote>

Additional evidence:

https://www.reddit.com/r/BambuLab/comments/1i5aply/for_those_of_you_who_dont_think_they_will_go/

== References ==

{{reflist}}

[[Category:Bambu Lab]]

Bambu Lab LAN mode guide

2025-01-20T17:12:41Z

Lomanic: +Category:Bambu Lab

{{GuideNotice}}

Hi everyone, I just thought I'd share my experience with using my P1S offline and blocking its access to the internet from your router (just in case Bambu Lab decides to do something about all the users refusing to update their firmware and disconnecting from their cloud).

= Turning on LAN-only mode =
I have a P1S with the 01.07.00.00 firmware and an AMS with the 00.00.06.49 firmware (both latest at the time of writing, I performed the update via the internet when I first got my printer one month ago).
<div style="display: flex;justify-content: space-around;>
{| class="wikitable"
|-
! scope="col" style="width: 75px;" |
! scope="col" style="width: 850px;" |
! scope="col" style="width: 475px;" |
|-
|style="background: #efefef;font-weight: bold;text-align: center"|Step 1||
I turned on LAN only mode using Bambu Lab's guide: https://wiki.bambulab.com/en/knowledge-sharing/enable-lan-mode.

Basically you go into your printer's settings, scroll to LAN only mode and set it to ON. This logs you out and supposedly disconnects your printer from their servers, but since it is still connected to WiFi it theoretically could call home if it wanted. We'll take care of that in step 5.
|| [[File:P1S.jpg|thumb|450px|Turn on LAN only mode by selecting it and pressing Ok, then pressing Yes on the confirmation dialog that appears]]
|-style=height:7em
|style="background: #efefef;font-weight: bold;text-align: center"|Step 2||colspan=2| I uninstalled both the Handy Android app and Bambu Studio, I won't be using those anymore.
|-
|style="background: #efefef;font-weight: bold;text-align: center"rowspan=2|Step 3|| I downloaded Orca Slicer 2.2.0 (latest at the time of writing): https://github.com/SoftFever/OrcaSlicer/releases/tag/v2.2.0 . After you follow the link scroll down to the bottom of the page to the Assets section, and pick the right one for you operating system.
|| [[File:Orca download.jpg|thumb|450px|In my case I chose OrcaSlicer_Windows_Installer_V2.2.0.exe]]
|-
| Then I installed it, opened it, installed the Bambu network plugin (no way to use the printer remotely without it yet :( ), did '''not''' log in with a Bambu Labs account and went to the Device page.

Top left corner click on the "No printer +" text and select your printer. With my P1S I still have full functionality ('''including live view''').
|| [[File:Orca slicer 2.2.0.png|thumb|450px|Orca slicer and my LAN only printer]]
|-
|colspan="2"| '''Important Note:''' After everything is working remember to turn on Stealth Mode so that Orca won't attempt to communicate with Bambu's cloud.
|| [[File:Stealth mode.jpg|thumb|450px|Click on the hamburger menu in the top left -> Preferences -> Network enable stealth mode]]
|-
|style="background: #efefef;font-weight: bold;text-align: center"|Step 4|| I got my printer's MAC address from Settings -> MAC (scroll all the way down).
|| [[File:P1S MAC.jpg|thumb|450px|Printer MAC address location]]
|-
|style="background: #efefef;font-weight: bold;text-align: center"|Step 5|| I went into my router's settings (this depends on your manufacturer, send me a DM if you are not sure how to do it), parental controls and added a new rule based on the printer's MAC, to permanently disable its internet access.
|| [[File:Router.jpg|thumb|450px|Example of router settings]]
|}
</div>
And that's it, you have a completely offline printer, that can't access the internet and that you can monitor and view from within your network.

= Remote access =
[[File:Parsec.jpg|thumb|Screenshot from the Parsec Android app. I can monitor everything and cancel/pause printing by pressing on the buttons]]
If you still want to print remotely there are several possibilities. You can use Parsec (if you have a Windows or macOS machine on the printer's network) https://parsec.app/ to connect from your phone / laptop remotely to your local machine without setting up anything else network wise.

You just install it on both your host (machine connected to the same network as the printer) and you phone/laptop and you can use the home machine as if you were in front of it. I even use it to play games, it's got very low latency.

You can also set up a personal VPN using something like https://tailscale.com/, and then you can connect to the printer from your laptop even when you're away.

You can also use remote desktop connection, but I find it's wonkier than Parsec. This video https://www.youtube.com/watch?v=wYW37thazo0 explains how to do so.

= Conclusion =
Although using the Handy app was easier, I always felt a bit queasy at the idea of all of my prints going through their cloud. This latest 'security' update was just the last drop for me. Using this short guide YOU maintain full control over YOUR printer, and nobody else gets to see everything you print. You can even upgrade the firmware offline if you so chose https://wiki.bambulab.com/en/p1/manual/P1-firmware-update-from-SD-card . At the end of the day, their printers are amazing machines, especially for the price point, and I can live with the compromise of using LAN only mode with parental controls to ensure I maintain full control over mine.

= Q&A =
If you have any questions please leave them in the comments or as a PM and I will update this post with the answers.

Orca slicer asks for access code every time: u/KeepCalm76 pointed to this fix that worked for them: https://github.com/SoftFever/OrcaSlicer/issues/6169#issuecomment-2330205871

Blocking a MAC address on UniFi: u/TheBeard_ pointed to this resource https://help.ui.com/hc/en-us/articles/18565355579799-MAC-Address-Restricting

Orca Slicer error 4020 Can't upload file to FTP server, this can happen for 3MF files, you have to export the objects as STLs and import then into a new project: https://www.youtube.com/watch?v=lWDNa2Pytlo

For general Orca Slicer questions/help try their Discord: https://discord.com/invite/P4VE9UY9gJ

= Resources =
I've created a GitHub repository with all the current firmware files and network plugins, both those installed on my computer that work right now and the current versions from their CDN: https://github.com/Tzeny/bambulabs_plugins_firmware . Feel free to make a PR to add your own currently functioning plugins and firmware.

Overview of the situation and how to protest it: https://www.reddit.com/r/BambuLab/comments/1i3gq1t/why_you_should_care_about_bambu_labs_removing/

EU based consumers are entitled to a guarantee of conformity for 24 after purchase as pointed out by u/Royal-Moose9006 , everyone living there should look into it in case things get out of hand: https://europa.eu/youreurope/business/dealing-with-customers/consumer-contracts-guarantees/consumer-guarantees/

= Original Source =

[https://www.reddit.com/r/BambuLab/comments/1i4vp5i/lan_mode_with_live_view_remote_monitoringcontrol/ "LAN mode with live view, remote monitoring+control and blocked internet access - a five step guide"] by [https://www.reddit.com/user/Tzeny15 /u/Tzeny] on [reddit.com | reddit.com]. Sourced Jan 20 2025

[[Category:Bambu Lab]]

Bambu Lab Authorization Control System

2025-01-20T03:19:40Z

Lomanic: /* Reverse Engineering Bambu Connect */

[[Category:Feature Ransom]]

On January 16, 2025, the 3D-printer manufacturer [[:wikipedia:Bambu Lab|Bambu Lab]] announced that future firmwares for their 3D printers would introduce an authorization and authentication protection mechanism for their connection and control, in the name of security. Bambu has stated the following:<blockquote>''"This change is mitigating any risk of remote hacks or printer exposure issues that have happened in the past and also lower the risk of abnormal traffic or attacks."''<ref name="firmware-update-introducing-new-authorization-control-system-2">https://blog.bambulab.com/firmware-update-introducing-new-authorization-control-system-2/</ref><ref>https://all3dp.com/4/bambu-lab-limits-third-party-printer-control-with-new-security-update/</ref></blockquote>

== Controversy regarding firmware updates ==
[[File:Bambu tos screenshot.png|alt=bambu terms stating print jobs may not function properly if update is not performed to new firmware which is highly limiting. |thumb|Bambu terms regarding printer functionality & potential for disrupted print jobs if users do not update to a new firmware that radically restricts the autonomy of the owner of the printer]]

=== Potential for remote disabling of printers ===
A significant concern raised by the community revolves around the wording in Bambu Lab's [[Terms of Service]] and firmware update announcements. Critics and users argue that the phrasing leaves open the possibility for the manufacturer to remotely disable printers that are not updated to the latest firmware. Specifically, Bambu Lab's Terms of Service<ref>https://bambulab.com/en-us/policies/terms</ref> states that printers may block "new print jobs" if updates are not applied, which some users interpret as a potential pathway for forced obsolescence<ref name="firmware-update-introducing-new-authorization-control-system-2" />. The announcement, however, specifically says, "'''What happens if I never upgrade to this firmware?''' ''You may continue using an older firmware version that does not include the new security updates; however, this means the printers may miss out on important security fixes or bug patches included in newer versions.''"<ref name="firmware-update-introducing-new-authorization-control-system-2" />

While defenders of Bambu Lab point out that offline modes such as SD-card printing and LAN-only setups would remain functional, others point out that the Terms of Service do not explicitly limit this restriction to cloud-based printing. This ambiguity has led to speculation that Bambu Lab could enforce broader limitations, effectively rendering printers inoperable for users who choose not to update.<ref>https://old.reddit.com/r/BambuLab/comments/1i45iy2/bambu_lab_reserves_the_right_to_brick_your/</ref>

=== Debate over "bricking" terminology ===
The debate has also extended to the definition of "bricking." Some community members assert that if a printer is unable to accept new print jobs without an update, it effectively becomes non-functional and qualifies as being "bricked." Others counter that as long as certain offline functionalities remain (such as SD-card printing) the term does not accurately apply.<ref>https://old.reddit.com/r/BambuLab/comments/1i45iy2/bambu_lab_reserves_the_right_to_brick_your/m7sezlg/</ref>

=== Community Strategies to Deal with Risks ===
Users have discussed strategies to avoid possible disruptions, including:
* Operating printers exclusively in offline modes.
* Utilizing LAN connections or VPN setups: this requires an access key from the printer (previously, you could use your cloud credentials over LAN).
* Exploring alternative firmware or third-party scripts to restore full functionality<ref>https://old.reddit.com/r/BambuLab/comments/1i45iy2/bambu_lab_reserves_the_right_to_brick_your/m7t8i7r/</ref>.

== Bambu Lab's justification and rebuttal ==
Bambu Lab has stated that the authorization system is in place in order to protect against "remote hacks," "printer exposure," and "abnormal traffic or attacks." There are, however, several ways to mitigate these risks without the loss of user control that their system causes:

* '''The "remote hacks" that were cited as an example in the article seem to be a direct result of the 3D-printer vendor not responding properly to a reported security vulnerability in their product.<ref>[https://www.bitdefender.com/en-au/blog/hotforsecurity/someone-is-hacking-3d-printers-to-warn-owners-of-a-security-flaw?ref=blog.bambulab.com https://www.bitdefender.com/en-au/blog/hotforsecurity/someone-is-hacking-3d-printers-to-warn-owners-of-a-security-flaw]</ref> Therefore, in order to get attention, the researcher decided to infect machines and display a harmless message to spread publicity.''' Properly responding to security vulnerabilities, working to patch them quickly, and working with the security community (who would be more than happy to help secure products) would be some ways to prevent this.
* In the article cited about printer exposure, the hack was carried out largely because of user misconfiguration.<ref>[https://www.csoonline.com/article/566223/over-3700-exposed-3d-printers-open-to-remote-attackers.html?ref=blog.bambulab.com https://www.csoonline.com/article/566223/over-3700-exposed-3d-printers-open-to-remote-attackers.html]</ref> Printer exposure can be mitigated by offering more convenient ways to securely expose printers to the internet, so that users are not tempted to allow unauthenticated access over the network.
* The "abnormal traffic" can be mitigated by steps Bambu has already put in place, as detailed in their own article on the matter<ref>[https://wiki.bambulab.com/en/security-incidents-cloud-traffic?ref=blog.bambulab.com https://wiki.bambulab.com/en/security-incidents-cloud-traffic]</ref>.

== Issues with LAN mode requiring authorization ==

Bambu Lab printers have the ability to be controlled over both cloud and LAN. This allowed users to integrate their printers into private networks and maintain full control without having to rely on the manufacturer's server while also allowing cloud access. The new authorization system mandates that even LAN-based operations must go through an authentication process using Bambu Connect to retain full control.<ref name="bambu-connect">https://wiki.bambulab.com/en/software/bambu-connect</ref> Full local access is still possible and unchanged for those not using the cloud.

This change has drawn criticism for many reasons:
* '''Privacy concerns''': Requiring authentication for LAN mode raises concerns about data being unnecessarily exposed to Bambu Lab's servers, even for local-only operations, though previously, the printer was also connected and could be controlled by the cloud even when sending prints locally.
** Confidentiality required by US Law - This is in conflict with those that have to comply with 18 CFR § 3a.61, 32 CFR § 117.15, 32 CFR § 2001.47, and other restrictions.
* '''Loss of offline independence while also using cloud''': Before, users could have hybrid offline setups. The requirement for authentication removes this option unless users revert to older firmware versions, which Bambu does not allow people to do once they have updated to the firmware using the new scheme.
* '''Increased complexity''': The added authentication layer complicates workflows for users who built custom setups or relied on third-party integrations for LAN control while retaining cloud functionality<ref>https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643</ref>.

=== Precedents and comparisons ===
Critics have likened this potential functionality to similar cases in other industries where manufacturers remotely restrict product features. Notable examples include [[HP]]'s printer firmware updates that [[HP Instant Ink|rendered third-party ink cartridges unusable]] and Tesla's software locks on second-hand vehicles. These parallels suggest a broader trend of manufacturers [[Retroactively amended purchase|using software to control hardware capabilities post-purchase]].<ref>https://www.classaction.org/hp-printer-lawsuit</ref><ref>https://www.wired.com/story/tesla-remote-disable-used-car-features/</ref>

== Implementation Timeline and Requirements ==

The authorization system will be rolled out in phases, starting with the X1 series printers. A beta firmware (version 01.08.03.00) was released on January 17, 2025, with the full release scheduled for January 23, 2025. The P & A series printers will get similar updates at an unspecified future date.

To use printers with the new authorization system, users must update multiple pieces of software:
* Bambu Studio must be updated to version 01.10.02.64 or higher
* Bambu Handy mobile app must be updated to version 2.17.0 or higher
* The new Bambu Connect application must be installed for using third-party slicers

These software updates are mandatory for users who update their firmware. Failing to update all components simultaneously will result in certain printer controls becoming unusable. Users who choose to maintain third-party software compatibility can continue using older firmware versions, though this will not be an option for new printers, which will ship with the authorization system pre-installed.

Bambu Lab states these coordinated updates are necessary because the new authorization system fundamentally changes how the printer validates and accepts commands. The older versions of Bambu Studio and Bambu Handy lack the authentication mechanisms required to interact with printers running the new firmware. The Bambu Connect application was created specifically to provide a controlled interface for third-party software, replacing the previous direct access through network plugins<ref name="firmware-update-introducing-new-authorization-control-system-2" />.

== Impact on third-party integration and user choice ==

=== Changes to third-party access ===
The new authorization system replaces direct network API access with a more limited URL-based interface through Bambu Connect. Third-party software can only interact with the printer by sending specific URL commands to Bambu Connect<ref name="bambu-connect" />. The interface requires three parameters:

* <code>path</code>: The absolute file system path to the 3MF file (e.g., /tmp/cube.gcode.3mf)
* <code>name</code>: The name of the file (e.g., Cube)
* <code>version</code>: A fixed value of 1.0.0 for compatibility

A complete command must be formatted as:<blockquote><syntaxhighlight lang="text">
bambu-connect://import-file?path=%2Ftmp%2Fcube.gcode.3mf&name=Cube&version=1.0.0
</syntaxhighlight></blockquote>This interface only allows basic file transfer and print initiation. All other printer-control functions previously available to third-party software are now exclusive to Bambu's own applications. The path and name parameters must be URL-encoded using encodeURIComponent or equivalent functions<ref name="bambu-connect" />.

=== Reduced home-automation capabilities ===
While basic status monitoring remains available (e.g., print-progress updates in Home Assistant), the new firmware removes the ability for home-automation systems to control printer functions. Users can no longer:
* Start or stop prints remotely using Home Assistant, BTT Panda Touch,<ref name=":0">https://www.facebook.com/BIGTREETECH/posts/pfbid0SNZGxvf7NRdmyVgHf6y9yNedNbU2RrCfdT8gugTSD4AYfr5BHneNF9H1EbwyYiJEl</ref> or other third-party accessories or software interfaces
* Control printer temperatures or cooling
* Automate printer behaviors based on sensor data or events
* Access camera feeds through third-party applications<ref name="bambulab-forum-135400/9">https://forum.bambulab.com/t/this-new-auth-system-will-make-me-sell-my-printers/135400/9</ref>

=== Permanent nature of the update ===
Once a printer is updated to the new firmware, users cannot revert to previous versions that allows full control of the printer using LAN mode access key while signed into the cloud<ref name="firmware-update-introducing-new-authorization-control-system-2" />. The option still exists to disable the cloud service.

The manufacturer states this change is required for security, but community members note that many of the security vulnerabilities being addressed stem from Bambu's own cloud-centric design choices rather than inherent risks of local network control<ref name="bambulab-forum-134549/12">https://forum.bambulab.com/t/bambu-studio-1-10-2-public-beta/134549/12</ref>. The update forces users into using Bambu Connect middleware if they want to retain cloud functionality.

This can be characterised as a significant post-purchase reduction in functionality for existing owners who bought their printers with the understanding they could use third-party software and home-automation tools, but also only affects users actively choosing to use Bambu Cloud at the same time. The inability to revert these changes, combined with the mandatory nature of the update for new printers, is used to demonstrate how manufacturers can use software updates to unilaterally modify the capabilities of hardware products after purchase, although in this case the changes affect only people already choosing to use the cloud service<ref name="bambulab-forum-3643/9">https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643/9</ref>.

For users that would want to use a third-party slicer while using their cloud service, Bambu would require those users to download and install Bambu Connect in order to send gcode wirelessly over LAN or over the cloud. While Bambu claims that they were in contact with SoftFever, the developer of OrcaSlicer, as of writing, SoftFever still does not have any keys for Bambu Connect and the new firmware is only available as opt-in beta at the moment.<ref name=":1">https://x.com/fever_soft/status/1880630570809795034?t=qJyh4SGFZFllcYrqexGW-Q&s=19</ref>

== Impact on functionality ==
While some functionality remains unauthenticated like in previous firmware versions (sending status information from the printer over the network, starting a print job using SD cards), the most important features now require authentication through a new closed-source client called Bambu Connect<ref name="bambu-connect" />. These restricted features include:

* Initializing prints via LAN or cloud mode
* Remote video access to monitor prints
* Controlling motion system, temperature, fans
* AMS settings and calibrations
* Home automation integration beyond basic status monitoring

Previously, third-party software such as OrcaSlicer<ref name="orca-slicer-issue8063">https://github.com/SoftFever/OrcaSlicer/issues/8063</ref> could interact with Bambu Lab printers via the open-source Bambu Studio and proprietary network plug-ins. While Bambu Connect provides a limited URL-based API to initiate prints, most functionality previously openly available is now restricted to Bambu's ecosystem<ref name="bambulab-forum-135400/9" />.

Previously, third-party accessories such as Panda Touch would allow users to control their printers with a standalone device. Panda Touch was especially popular amongst P series printer owners since P series printers contain a monochromatic screen with a D-pad by default for printer control whereas Panda Touch is a full-color touch screen that had a small battery so that way users could reposition and detach their Panda Touch off their printers if needed. Users would be able to queue up jobs, jog printer motors, and connect to multiple printers at once in order to monitor print jobs. According to Big Tree Tech (BTT), the manufacturer of the Panda Touch, they urge users of Panda Touch not to update firmware any further since doing so would foreseeably permanently break compatibility with users' printers and their Panda Touch. <ref name=":0" />

== Communication with Panda Touch developers ==

As of writing, no formal communication has happened between Big Tree Tech (BTT), the manufacturer and developer of Panda Touch, and Bambu Labs. Based on their Facebook announcement, BTT stated that they have reached out to Bambu and will update if Bambu responds to their correspondence<ref name=":0" />.

== Communication with OrcaSlicer developers ==

Before the official announcement of the new authorization and authentication, Bambu Lab engaged with the OrcaSlicer development team regarding the changes. This communication has sparked significant discussion within the 3D-printing community, particularly regarding its timing, tone, and implications.

=== Pre-announcement contact ===
Reports from OrcaSlicer demonstrate that Bambu Lab provided limited advance notice of the changes that would render their software incompatible with Bambu printers running the new firmware. The communication emphasized:
* The introduction of Bambu Connect as the only supported method for interacting with third-party slicers.
* The discontinuation of the network plugin API that OrcaSlicer and other tools relied on for printer control<ref name="orca-slicer-issue8063" />.
* An invitation for OrcaSlicer developers to adapt their software to integrate with the Bambu Connect URL scheme.

The communication lacked the detailed technical documentation that would be necessary for developers to be able to work with the new requirements.

=== How the community viewed these actions ===
This approach has been interpreted by many as a calculated move by Bambu Lab to enforce tighter control over its ecosystem. Primary criticisms of Bambu were:
* '''Lack of transparency''': The limited warning to OrcaSlicer devs suggests that Bambu Lab prioritized internal rollout schedules over community engagement with existing customers. Point to the contrary: the new firmware is in beta and Bambu Connect middleware contains temporary compomises to allow third-party slicers to work as before.
* '''Lack of follow-through:''' As of writing, SoftFever, OrcaSlicer's lead developer, still does not have API keys for Bambu Connect, a necessary layer of Bambu software that would need to be integrated into OrcaSlicer. Bambu's original announcement prominently mentioned OrcaSlicer and gave the impression that Bambu is actively providing the necessary assets so that SoftFever would be able to implement the new software architecture so that OrcaSlicer users are able to still use OrcaSlicer to send gcode to their printers without needing Bambu Connect to be installed as a separate program. The lack of active cooperation does not reflect favorably upon Bambu as it seems like their announcement used OrcaSlicer's name to try to make it seem like Bambu is trying its best to make sure that developers have what they need, but in reality, their inaction seems to show that Bambu is not making a sincere attempt to ensure that OrcaSlicer remains supported<ref name=":1" />.
* '''Disregard for open-source collaboration''': OrcaSlicer is widely used in the community; it is an open-source effort to improve the 3D-printing experience for all customers. By abruptly altering the compatibility landscape, Bambu Lab is seen as undermining good-faith initiatives to improve the ecosystem for everyone. The decision to restrict network APIs in favor of proprietary systems such as Bambu Connect represents a broader industry trend of closing off ecosystems that were once open, removing customer choice, privacy, and freedom.
* '''Token support for third-party tools''': While Bambu Connect provides a workaround for third-party slicer use, it significantly restricts functionality and complicates workflows, leading many to question the sincerity of Bambu's stated support for open-source tools<ref name="bambu-connect" />.
* '''Power imbalance''': As the hardware manufacturer, Bambu Lab has the ability to dictate how its products can be used; often to the detriment of third-party developers and users.

== Community-driven workarounds and technical alternatives ==

The 3D-printing community has begun exploring potential workarounds to restore functionality and user autonomy. These efforts focus on bypassing or mitigating the limitations imposed by the firmware update.

=== Custom firmware development ===
Discussions within the community highlight interest in developing custom firmware as an alternative to Bambu's official updates. One prominent project mentioned in forums is the development of custom firmware for the X1-series printers, such as the "X1Plus Custom Firmware"<ref name="bambulab-forum-134549/12" />. This firmware aims to:
* Restore direct network control and third-party slicer compatibility.
* Re-enable previously available features such as motion-system adjustments, temperature control, and AMS settings without requiring proprietary software.
* Provide users with greater flexibility in integrating printers with home-automation systems and workflows.

However, custom firmware development faces significant challenges, including:
* Limited documentation and proprietary hardware components, which complicate reverse-engineering efforts.
* The potential voiding of warranties and risks of bricking devices.
* Legal concerns regarding intellectual property and bypassing manufacturer-imposed restrictions.

== LAN mode and blocked internet access ==
This is a guide made by the user Tzeny15

https://www.reddit.com/r/BambuLab/comments/1i4vp5i/comment/this/

== Reverse Engineering Bambu Connect ==
{{:Reverse Engineering Bambu Connect}}

''[[Reverse Engineering Bambu Connect|Read more here.]]''

== Community tools and scripts ==
In addition to firmware alternatives, some users have come up with custom scripts and software tools to interface with Bambu Lab printers indirectly. These tools often rely on:
* Reverse-engineering the URL-based commands required by Bambu Connect to enable partial functionality with third-party slicers like OrcaSlicer.
* Creating local server emulations to replicate the network API previously available before the update.

While these tools provide temporary solutions, they don't fully replace the open ecosystem that existed prior to the authorization update.

=== Re-engineering printer-control electronics ===
ChazLayyd's Bambu Lab Klipper Conversion project is currently in an incomplete stage<ref>https://github.com/ChazLayyd/Bambu-Lab-Klipper-Conversion</ref><ref>DhazLayyd's Discord Community

https://discord.gg/W6B5mBejuC</ref>. While the project was not made in response to Bambu's announcement, there has been a wave of new public interest in this specific project. ChazLayyd's documentation instructs P1S owners to non-destructively remove the old control electronics that run Bambu's proprietary software and instructs P1S owners to install off-the-shelf control components so that the existing motor connectors and other critical electronics can communicate with the newly-installed off-the-shelf control components.

=== Advocacy for open-ecosystem support ===
Community members have also organized to advocate for open-source support and rollback options. Suggestions include:
* Allowing an opt-out option for existing users who prefer local network control without cloud dependency.
** It should be pointed out that this has always been possible and past firmware updates made signing into the cloud at any point completely unnecessary. This information continues to be ignored by some.
* Providing an official API for third-party slicers under specific licensing agreements that allow secure authorized usage.<ref name="orca-slicer-issue8063" />
== Bambu corporate strategy vs maker community values==

=== Impact on professional users and print farms ===
The restrictions imposed by the new authorization system create significant operational challenges for professional users who kept their printers signed into the cloud:

* Print farms can no longer use custom automation systems to manage multiple printers
* Workflows built around third-party software have to be completely redesigned
* The requirement to manually export and import files through Bambu Connect creates additional labor
* Integration with existing business systems and workflows becomes more difficult or impossible
* Professional users with more than 20 printers report the new workflow as "an absolute nightmare"<ref>https://forum.bambulab.com/t/this-new-auth-system-will-make-me-sell-my-printers/135400/4</ref>
The solution to the above is not to sign the printer into the cloud. Keeping the printer signed in would be a security oversight in this use case on the part of the print farm.

=== Privacy and data-collection concerns ===

The shift toward mandatory use of Bambu's software ecosystem raises several privacy and data collection concerns:

* All printer operations must now pass through Bambu's cloud infrastructure when using cloud mode
* User print data, including file names and print settings, becomes visible to Bambu when cloud is used
* Camera feeds and operational data are processed through Bambu's servers while on a different network
* Users have limited visibility into how their data is collected, stored, and used in the cloud
* The system creates dependence on Bambu's cloud services availability for basic printer functionality<ref name="bambulab-forum-3643/9" />

While Bambu Lab maintains that cloud processing is necessary for security and functionality, community members argue this represents unnecessary data collection that could be handled locally<ref name="bambulab-forum-134549/12" />. The company's cloud infrastructure costs are significant, leading some users to speculate that future monetization of the cloud services may be planned<ref name="bambulab-forum-3643/5">https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643/5</ref>. Therefore, people should assess if their use case mandates the use of the cloud service and disable it when it doesn't.

This shift from local control to cloud-dependent operation is part of a broader trend in consumer devices, where manufacturers use security concerns to justify increased data collection and reduced customer control over devices they bought and paid for. Privacy-conscious users should operate their printers in LAN-only mode to avoid cloud connectivity.

== Customer reactions ==

Customer reactions have been overwhelmingly negative.<ref>https://forum.bambulab.com/t/bambu-studio-1-10-2-public-beta/134549/4</ref><ref>https://old.reddit.com/r/BambuLab/comments/1i2psvz/firmware_update_introducing_new_authorization/</ref> Bambu Lab has historically pushed cloud-based printer interaction while offering limited LAN mode functionality<ref name="bambulab-forum-3643/9" />. Many customers argue that the security issues this locked-down firmware claims to address are actually consequences of the company's cloud-based design choices rather than inherent risks of local network control<ref name="bambulab-forum-134549/12" />, which continues to infuriate users who are now told that security is the justification for a loss of freedom. As a result of the announcement of the shift, customer ratings on sites like Trustpilot rapidly dropped<ref>https://www.trustpilot.com/review/bambulab.com?sort=recency</ref>, with many reviews citing the restrictions as the reason for the bad reviews.

The shift raises privacy concerns as user print data, including file names, print settings, and camera feeds, must now pass through Bambu's cloud infrastructure.

Many community members and customers ask whether the significant costs of maintaining and deploying this cloud infrastructure might lead to future monetization of these now-mandatory services<ref name="bambulab-forum-3643/5" />, with subscriptions required for features that once worked with local access.

It should be noted, however, that so far '''no changes have been made or indicated for those not using the cloud service'''. Past firmware updates made it possible to avoid using the cloud service completely by allowing pairing the slicer via IP address and access key and doing offline firmware updates without having to sign the printer into the service, not even temporarily, keeping local functionality unchanged.

== Comparisons to similar practices by other companies ==

Bambu Lab's new authorization and authentication requirements have been compared to a number of practices by traditional printer manufacturers, such as [[HP]] or [[Epson]], who have also faced backlash around their handling of [[digital-rights management]] (DRM){{Citation needed}}. These comparisons address:
* '''Forced updates''': Firmware updates have rendered third-party ink cartridges incompatible, forcing users to purchase proprietary consumables.
* '''Restricted features''': Scanner/printer combos that will not scan if the ink is empty.
* '''Consumer backlash''': Users criticized these updates as anti-consumer, with some pursuing [[class action lawsuit|class-action lawsuits]] for deceptive practices.<ref>https://www.classaction.org/hp-printer-ink-firmware-lawsuit</ref>

Like 2D printers, Bambu Lab's update restricts functionality previously available to users and pushes them toward proprietary software and cloud-based control.

A parallel specific to the 3D-printing industry can also be drawn from the now-defunct 3D-printer manufacturer [[MakerBot]], whose shift from open-source, DIY-focused machines in 2012 to closed-source, proprietary machines (similarly to Bambu Labs), ultimately drove customers to less-expensive, open-source competitors.<ref>https://hackaday.com/2016/04/28/the-makerbot-obituary/</ref> MakerBot was also accused of asserting ownership over publicly available, open-source designs uploaded to its 3D print repository, Thingiverse.<ref>https://techcrunch.com/2014/05/28/makerbot-responds-to-critics-who-claim-it-is-stealing-community-ip/</ref> These factors contributed to MakerBot steadily losing their position and reputation as an industry leader, before getting absorbed by rival Ultimaker in 2022.

== References ==

<references/>
[[Category:Bambu Lab]]

Bambu Lab Authorization Control System

2025-01-19T23:30:00Z

Lomanic: dedeuplicate <ref>

[[Category:Feature Ransom]]

On January 16, 2025, the 3D-printer manufacturer [[:wikipedia:Bambu Lab|Bambu Lab]] announced that future firmwares for their 3D printers would introduce an authorization and authentication protection mechanism for their connection and control, in the name of security. Bambu has stated the following:<blockquote>''"This change is mitigating any risk of remote hacks or printer exposure issues that have happened in the past and also lower the risk of abnormal traffic or attacks."''<ref name="firmware-update-introducing-new-authorization-control-system-2">https://blog.bambulab.com/firmware-update-introducing-new-authorization-control-system-2/</ref><ref>https://all3dp.com/4/bambu-lab-limits-third-party-printer-control-with-new-security-update/</ref></blockquote>

== Controversy regarding firmware updates ==
[[File:Bambu tos screenshot.png|alt=bambu terms stating print jobs may not function properly if update is not performed to new firmware which is highly limiting. |thumb|Bambu terms regarding printer functionality & potential for disrupted print jobs if users do not update to a new firmware that radically restricts the autonomy of the owner of the printer]]

=== Potential for remote disabling of printers ===
A significant concern raised by the community revolves around the wording in Bambu Lab's [[Terms of Service]] and firmware update announcements. Critics and users argue that the phrasing leaves open the possibility for the manufacturer to remotely disable printers that are not updated to the latest firmware. Specifically, Bambu Lab's Terms of Service<ref>https://bambulab.com/en-us/policies/terms</ref> states that printers may block "new print jobs" if updates are not applied, which some users interpret as a potential pathway for forced obsolescence<ref name="firmware-update-introducing-new-authorization-control-system-2" />. The announcement, however, specifically says, "'''What happens if I never upgrade to this firmware?''' ''You may continue using an older firmware version that does not include the new security updates; however, this means the printers may miss out on important security fixes or bug patches included in newer versions.''"<ref name="firmware-update-introducing-new-authorization-control-system-2" />

While defenders of Bambu Lab point out that offline modes such as SD-card printing and LAN-only setups would remain functional, others point out that the Terms of Service do not explicitly limit this restriction to cloud-based printing. This ambiguity has led to speculation that Bambu Lab could enforce broader limitations, effectively rendering printers inoperable for users who choose not to update.<ref>https://old.reddit.com/r/BambuLab/comments/1i45iy2/bambu_lab_reserves_the_right_to_brick_your/</ref>

=== Debate over "bricking" terminology ===
The debate has also extended to the definition of "bricking." Some community members assert that if a printer is unable to accept new print jobs without an update, it effectively becomes non-functional and qualifies as being "bricked." Others counter that as long as certain offline functionalities remain (such as SD-card printing) the term does not accurately apply.<ref>https://old.reddit.com/r/BambuLab/comments/1i45iy2/bambu_lab_reserves_the_right_to_brick_your/m7sezlg/</ref>

=== Community Strategies to Deal with Risks ===
Users have discussed strategies to avoid possible disruptions, including:
* Operating printers exclusively in offline modes.
* Utilizing LAN connections or VPN setups: this requires an access key from the printer (previously, you could use your cloud credentials over LAN).
* Exploring alternative firmware or third-party scripts to restore full functionality<ref>https://old.reddit.com/r/BambuLab/comments/1i45iy2/bambu_lab_reserves_the_right_to_brick_your/m7t8i7r/</ref>.

== Bambu Lab's justification and rebuttal ==
Bambu Lab has stated that the authorization system is in place in order to protect against "remote hacks," "printer exposure," and "abnormal traffic or attacks." There are, however, several ways to mitigate these risks without the loss of user control that their system causes:

* '''The "remote hacks" that were cited as an example in the article seem to be a direct result of the 3D-printer vendor not responding properly to a reported security vulnerability in their product.<ref>[https://www.bitdefender.com/en-au/blog/hotforsecurity/someone-is-hacking-3d-printers-to-warn-owners-of-a-security-flaw?ref=blog.bambulab.com https://www.bitdefender.com/en-au/blog/hotforsecurity/someone-is-hacking-3d-printers-to-warn-owners-of-a-security-flaw]</ref> Therefore, in order to get attention, the researcher decided to infect machines and display a harmless message to spread publicity.''' Properly responding to security vulnerabilities, working to patch them quickly, and working with the security community (who would be more than happy to help secure products) would be some ways to prevent this.
* In the article cited about printer exposure, the hack was carried out largely because of user misconfiguration.<ref>[https://www.csoonline.com/article/566223/over-3700-exposed-3d-printers-open-to-remote-attackers.html?ref=blog.bambulab.com https://www.csoonline.com/article/566223/over-3700-exposed-3d-printers-open-to-remote-attackers.html]</ref> Printer exposure can be mitigated by offering more convenient ways to securely expose printers to the internet, so that users are not tempted to allow unauthenticated access over the network.
* The "abnormal traffic" can be mitigated by steps Bambu has already put in place, as detailed in their own article on the matter<ref>[https://wiki.bambulab.com/en/security-incidents-cloud-traffic?ref=blog.bambulab.com https://wiki.bambulab.com/en/security-incidents-cloud-traffic]</ref>.

== Issues with LAN mode requiring authorization ==

Bambu Lab printers have the ability to be controlled over both cloud and LAN. This allowed users to integrate their printers into private networks and maintain full control without having to rely on the manufacturer's server while also allowing cloud access. The new authorization system mandates that even LAN-based operations must go through an authentication process using Bambu Connect to retain full control.<ref name="bambu-connect">https://wiki.bambulab.com/en/software/bambu-connect</ref> Full local access is still possible and unchanged for those not using the cloud.

This change has drawn criticism for many reasons:
* '''Privacy concerns''': Requiring authentication for LAN mode raises concerns about data being unnecessarily exposed to Bambu Lab's servers, even for local-only operations, though previously, the printer was also connected and could be controlled by the cloud even when sending prints locally.
** Confidentiality required by US Law - This is in conflict with those that have to comply with 18 CFR § 3a.61, 32 CFR § 117.15, 32 CFR § 2001.47, and other restrictions.
* '''Loss of offline independence while also using cloud''': Before, users could have hybrid offline setups. The requirement for authentication removes this option unless users revert to older firmware versions, which Bambu does not allow people to do once they have updated to the firmware using the new scheme.
* '''Increased complexity''': The added authentication layer complicates workflows for users who built custom setups or relied on third-party integrations for LAN control while retaining cloud functionality<ref>https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643</ref>.

=== Precedents and comparisons ===
Critics have likened this potential functionality to similar cases in other industries where manufacturers remotely restrict product features. Notable examples include [[HP]]'s printer firmware updates that [[HP Instant Ink|rendered third-party ink cartridges unusable]] and Tesla's software locks on second-hand vehicles. These parallels suggest a broader trend of manufacturers [[Retroactively amended purchase|using software to control hardware capabilities post-purchase]].<ref>https://www.classaction.org/hp-printer-lawsuit</ref><ref>https://www.wired.com/story/tesla-remote-disable-used-car-features/</ref>

== Implementation Timeline and Requirements ==

The authorization system will be rolled out in phases, starting with the X1 series printers. A beta firmware (version 01.08.03.00) was released on January 17, 2025, with the full release scheduled for January 23, 2025. The P & A series printers will get similar updates at an unspecified future date.

To use printers with the new authorization system, users must update multiple pieces of software:
* Bambu Studio must be updated to version 01.10.02.64 or higher
* Bambu Handy mobile app must be updated to version 2.17.0 or higher
* The new Bambu Connect application must be installed for using third-party slicers

These software updates are mandatory for users who update their firmware. Failing to update all components simultaneously will result in certain printer controls becoming unusable. Users who choose to maintain third-party software compatibility can continue using older firmware versions, though this will not be an option for new printers, which will ship with the authorization system pre-installed.

Bambu Lab states these coordinated updates are necessary because the new authorization system fundamentally changes how the printer validates and accepts commands. The older versions of Bambu Studio and Bambu Handy lack the authentication mechanisms required to interact with printers running the new firmware. The Bambu Connect application was created specifically to provide a controlled interface for third-party software, replacing the previous direct access through network plugins<ref name="firmware-update-introducing-new-authorization-control-system-2" />.

== Impact on third-party integration and user choice ==

=== Changes to third-party access ===
The new authorization system replaces direct network API access with a more limited URL-based interface through Bambu Connect. Third-party software can only interact with the printer by sending specific URL commands to Bambu Connect<ref name="bambu-connect" />. The interface requires three parameters:

* <code>path</code>: The absolute file system path to the 3MF file (e.g., /tmp/cube.gcode.3mf)
* <code>name</code>: The name of the file (e.g., Cube)
* <code>version</code>: A fixed value of 1.0.0 for compatibility

A complete command must be formatted as:<blockquote><syntaxhighlight lang="text">
bambu-connect://import-file?path=%2Ftmp%2Fcube.gcode.3mf&name=Cube&version=1.0.0
</syntaxhighlight></blockquote>This interface only allows basic file transfer and print initiation. All other printer-control functions previously available to third-party software are now exclusive to Bambu's own applications. The path and name parameters must be URL-encoded using encodeURIComponent or equivalent functions<ref name="bambu-connect" />.

=== Reduced home-automation capabilities ===
While basic status monitoring remains available (e.g., print-progress updates in Home Assistant), the new firmware removes the ability for home-automation systems to control printer functions. Users can no longer:
* Start or stop prints remotely using Home Assistant, BTT Panda Touch,<ref name=":0">https://www.facebook.com/BIGTREETECH/posts/pfbid0SNZGxvf7NRdmyVgHf6y9yNedNbU2RrCfdT8gugTSD4AYfr5BHneNF9H1EbwyYiJEl</ref> or other third-party accessories or software interfaces
* Control printer temperatures or cooling
* Automate printer behaviors based on sensor data or events
* Access camera feeds through third-party applications<ref name="bambulab-forum-135400/9">https://forum.bambulab.com/t/this-new-auth-system-will-make-me-sell-my-printers/135400/9</ref>

=== Permanent nature of the update ===
Once a printer is updated to the new firmware, users cannot revert to previous versions that allows full control of the printer using LAN mode access key while signed into the cloud<ref name="firmware-update-introducing-new-authorization-control-system-2" />. The option still exists to disable the cloud service.

The manufacturer states this change is required for security, but community members note that many of the security vulnerabilities being addressed stem from Bambu's own cloud-centric design choices rather than inherent risks of local network control<ref name="bambulab-forum-134549/12">https://forum.bambulab.com/t/bambu-studio-1-10-2-public-beta/134549/12</ref>. The update forces users into using Bambu Connect middleware if they want to retain cloud functionality.

This can be characterised as a significant post-purchase reduction in functionality for existing owners who bought their printers with the understanding they could use third-party software and home-automation tools, but also only affects users actively choosing to use Bambu Cloud at the same time. The inability to revert these changes, combined with the mandatory nature of the update for new printers, is used to demonstrate how manufacturers can use software updates to unilaterally modify the capabilities of hardware products after purchase, although in this case the changes affect only people already choosing to use the cloud service<ref name="bambulab-forum-3643/9">https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643/9</ref>.

For users that would want to use a third-party slicer while using their cloud service, Bambu would require those users to download and install Bambu Connect in order to send gcode wirelessly over LAN or over the cloud. While Bambu claims that they were in contact with SoftFever, the developer of OrcaSlicer, as of writing, SoftFever still does not have any keys for Bambu Connect and the new firmware is only available as opt-in beta at the moment.<ref name=":1">https://x.com/fever_soft/status/1880630570809795034?t=qJyh4SGFZFllcYrqexGW-Q&s=19</ref>

== Impact on functionality ==
While some functionality remains unauthenticated like in previous firmware versions (sending status information from the printer over the network, starting a print job using SD cards), the most important features now require authentication through a new closed-source client called Bambu Connect<ref name="bambu-connect" />. These restricted features include:

* Initializing prints via LAN or cloud mode
* Remote video access to monitor prints
* Controlling motion system, temperature, fans
* AMS settings and calibrations
* Home automation integration beyond basic status monitoring

Previously, third-party software such as OrcaSlicer<ref name="orca-slicer-issue8063">https://github.com/SoftFever/OrcaSlicer/issues/8063</ref> could interact with Bambu Lab printers via the open-source Bambu Studio and proprietary network plug-ins. While Bambu Connect provides a limited URL-based API to initiate prints, most functionality previously openly available is now restricted to Bambu's ecosystem<ref name="bambulab-forum-135400/9" />.

Previously, third-party accessories such as Panda Touch would allow users to control their printers with a standalone device. Panda Touch was especially popular amongst P series printer owners since P series printers contain a monochromatic screen with a D-pad by default for printer control whereas Panda Touch is a full-color touch screen that had a small battery so that way users could reposition and detach their Panda Touch off their printers if needed. Users would be able to queue up jobs, jog printer motors, and connect to multiple printers at once in order to monitor print jobs. According to Big Tree Tech (BTT), the manufacturer of the Panda Touch, they urge users of Panda Touch not to update firmware any further since doing so would foreseeably permanently break compatibility with users' printers and their Panda Touch. <ref name=":0" />

== Communication with Panda Touch developers ==

As of writing, no formal communication has happened between Big Tree Tech (BTT), the manufacturer and developer of Panda Touch, and Bambu Labs. Based on their Facebook announcement, BTT stated that they have reached out to Bambu and will update if Bambu responds to their correspondence<ref name=":0" />.

== Communication with OrcaSlicer developers ==

Before the official announcement of the new authorization and authentication, Bambu Lab engaged with the OrcaSlicer development team regarding the changes. This communication has sparked significant discussion within the 3D-printing community, particularly regarding its timing, tone, and implications.

=== Pre-announcement contact ===
Reports from OrcaSlicer demonstrate that Bambu Lab provided limited advance notice of the changes that would render their software incompatible with Bambu printers running the new firmware. The communication emphasized:
* The introduction of Bambu Connect as the only supported method for interacting with third-party slicers.
* The discontinuation of the network plugin API that OrcaSlicer and other tools relied on for printer control<ref name="orca-slicer-issue8063" />.
* An invitation for OrcaSlicer developers to adapt their software to integrate with the Bambu Connect URL scheme.

The communication lacked the detailed technical documentation that would be necessary for developers to be able to work with the new requirements.

=== How the community viewed these actions ===
This approach has been interpreted by many as a calculated move by Bambu Lab to enforce tighter control over its ecosystem. Primary criticisms of Bambu were:
* '''Lack of transparency''': The limited warning to OrcaSlicer devs suggests that Bambu Lab prioritized internal rollout schedules over community engagement with existing customers. Point to the contrary: the new firmware is in beta and Bambu Connect middleware contains temporary compomises to allow third-party slicers to work as before.
* '''Lack of follow-through:''' As of writing, SoftFever, OrcaSlicer's lead developer, still does not have API keys for Bambu Connect, a necessary layer of Bambu software that would need to be integrated into OrcaSlicer. Bambu's original announcement prominently mentioned OrcaSlicer and gave the impression that Bambu is actively providing the necessary assets so that SoftFever would be able to implement the new software architecture so that OrcaSlicer users are able to still use OrcaSlicer to send gcode to their printers without needing Bambu Connect to be installed as a separate program. The lack of active cooperation does not reflect favorably upon Bambu as it seems like their announcement used OrcaSlicer's name to try to make it seem like Bambu is trying its best to make sure that developers have what they need, but in reality, their inaction seems to show that Bambu is not making a sincere attempt to ensure that OrcaSlicer remains supported<ref name=":1" />.
* '''Disregard for open-source collaboration''': OrcaSlicer is widely used in the community; it is an open-source effort to improve the 3D-printing experience for all customers. By abruptly altering the compatibility landscape, Bambu Lab is seen as undermining good-faith initiatives to improve the ecosystem for everyone. The decision to restrict network APIs in favor of proprietary systems such as Bambu Connect represents a broader industry trend of closing off ecosystems that were once open, removing customer choice, privacy, and freedom.
* '''Token support for third-party tools''': While Bambu Connect provides a workaround for third-party slicer use, it significantly restricts functionality and complicates workflows, leading many to question the sincerity of Bambu's stated support for open-source tools<ref name="bambu-connect" />.
* '''Power imbalance''': As the hardware manufacturer, Bambu Lab has the ability to dictate how its products can be used; often to the detriment of third-party developers and users.

== Community-driven workarounds and technical alternatives ==

The 3D-printing community has begun exploring potential workarounds to restore functionality and user autonomy. These efforts focus on bypassing or mitigating the limitations imposed by the firmware update.

=== Custom firmware development ===
Discussions within the community highlight interest in developing custom firmware as an alternative to Bambu's official updates. One prominent project mentioned in forums is the development of custom firmware for the X1-series printers, such as the "X1Plus Custom Firmware"<ref name="bambulab-forum-134549/12" />. This firmware aims to:
* Restore direct network control and third-party slicer compatibility.
* Re-enable previously available features such as motion-system adjustments, temperature control, and AMS settings without requiring proprietary software.
* Provide users with greater flexibility in integrating printers with home-automation systems and workflows.

However, custom firmware development faces significant challenges, including:
* Limited documentation and proprietary hardware components, which complicate reverse-engineering efforts.
* The potential voiding of warranties and risks of bricking devices.
* Legal concerns regarding intellectual property and bypassing manufacturer-imposed restrictions.

== LAN mode and blocked internet access ==
This is a guide made by the user Tzeny15

https://www.reddit.com/r/BambuLab/comments/1i4vp5i/comment/this/

== Reverse Engineering Bambu Connect ==
{{:Reverse Engineering Bambu Connect}}

''[[Reverse_Engineering_Bambu_Connect|Read more here.]]''

{{Reverse Engineering Bambu Connect}}

== Community tools and scripts ==
In addition to firmware alternatives, some users have come up with custom scripts and software tools to interface with Bambu Lab printers indirectly. These tools often rely on:
* Reverse-engineering the URL-based commands required by Bambu Connect to enable partial functionality with third-party slicers like OrcaSlicer.
* Creating local server emulations to replicate the network API previously available before the update.

While these tools provide temporary solutions, they don't fully replace the open ecosystem that existed prior to the authorization update.

=== Re-engineering printer-control electronics ===
ChazLayyd's Bambu Lab Klipper Conversion project is currently in an incomplete stage<ref>https://github.com/ChazLayyd/Bambu-Lab-Klipper-Conversion</ref><ref>DhazLayyd's Discord Community

https://discord.gg/W6B5mBejuC</ref>. While the project was not made in response to Bambu's announcement, there has been a wave of new public interest in this specific project. ChazLayyd's documentation instructs P1S owners to non-destructively remove the old control electronics that run Bambu's proprietary software and instructs P1S owners to install off-the-shelf control components so that the existing motor connectors and other critical electronics can communicate with the newly-installed off-the-shelf control components.

=== Advocacy for open-ecosystem support ===
Community members have also organized to advocate for open-source support and rollback options. Suggestions include:
* Allowing an opt-out option for existing users who prefer local network control without cloud dependency.
** It should be pointed out that this has always been possible and past firmware updates made signing into the cloud at any point completely unnecessary. This information continues to be ignored by some.
* Providing an official API for third-party slicers under specific licensing agreements that allow secure authorized usage.<ref name="orca-slicer-issue8063" />
== Bambu corporate strategy vs maker community values==

=== Impact on professional users and print farms ===
The restrictions imposed by the new authorization system create significant operational challenges for professional users who kept their printers signed into the cloud:

* Print farms can no longer use custom automation systems to manage multiple printers
* Workflows built around third-party software have to be completely redesigned
* The requirement to manually export and import files through Bambu Connect creates additional labor
* Integration with existing business systems and workflows becomes more difficult or impossible
* Professional users with more than 20 printers report the new workflow as "an absolute nightmare"<ref>https://forum.bambulab.com/t/this-new-auth-system-will-make-me-sell-my-printers/135400/4</ref>
The solution to the above is not to sign the printer into the cloud. Keeping the printer signed in would be a security oversight in this use case on the part of the print farm.

=== Privacy and data-collection concerns ===

The shift toward mandatory use of Bambu's software ecosystem raises several privacy and data collection concerns:

* All printer operations must now pass through Bambu's cloud infrastructure when using cloud mode
* User print data, including file names and print settings, becomes visible to Bambu when cloud is used
* Camera feeds and operational data are processed through Bambu's servers while on a different network
* Users have limited visibility into how their data is collected, stored, and used in the cloud
* The system creates dependence on Bambu's cloud services availability for basic printer functionality<ref name="bambulab-forum-3643/9" />

While Bambu Lab maintains that cloud processing is necessary for security and functionality, community members argue this represents unnecessary data collection that could be handled locally<ref name="bambulab-forum-134549/12" />. The company's cloud infrastructure costs are significant, leading some users to speculate that future monetization of the cloud services may be planned<ref name="bambulab-forum-3643/5">https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643/5</ref>. Therefore, people should assess if their use case mandates the use of the cloud service and disable it when it doesn't.

This shift from local control to cloud-dependent operation is part of a broader trend in consumer devices, where manufacturers use security concerns to justify increased data collection and reduced customer control over devices they bought and paid for. Privacy-conscious users should operate their printers in LAN-only mode to avoid cloud connectivity.

== Customer reactions ==

Customer reactions have been overwhelmingly negative.<ref>https://forum.bambulab.com/t/bambu-studio-1-10-2-public-beta/134549/4</ref><ref>https://old.reddit.com/r/BambuLab/comments/1i2psvz/firmware_update_introducing_new_authorization/</ref> Bambu Lab has historically pushed cloud-based printer interaction while offering limited LAN mode functionality<ref name="bambulab-forum-3643/9" />. Many customers argue that the security issues this locked-down firmware claims to address are actually consequences of the company's cloud-based design choices rather than inherent risks of local network control<ref name="bambulab-forum-134549/12" />, which continues to infuriate users who are now told that security is the justification for a loss of freedom. As a result of the announcement of the shift, customer ratings on sites like Trustpilot rapidly dropped<ref>https://www.trustpilot.com/review/bambulab.com?sort=recency</ref>, with many reviews citing the restrictions as the reason for the bad reviews.

The shift raises privacy concerns as user print data, including file names, print settings, and camera feeds, must now pass through Bambu's cloud infrastructure.

Many community members and customers ask whether the significant costs of maintaining and deploying this cloud infrastructure might lead to future monetization of these now-mandatory services<ref name="bambulab-forum-3643/5" />, with subscriptions required for features that once worked with local access.

It should be noted, however, that so far '''no changes have been made or indicated for those not using the cloud service'''. Past firmware updates made it possible to avoid using the cloud service completely by allowing pairing the slicer via IP address and access key and doing offline firmware updates without having to sign the printer into the service, not even temporarily, keeping local functionality unchanged.

== Comparisons to similar practices by other companies ==

Bambu Lab's new authorization and authentication requirements have been compared to a number of practices by traditional printer manufacturers, such as [[HP]] or [[Epson]], who have also faced backlash around their handling of [[digital-rights management]] (DRM){{Citation needed}}. These comparisons address:
* '''Forced updates''': Firmware updates have rendered third-party ink cartridges incompatible, forcing users to purchase proprietary consumables.
* '''Restricted features''': Scanner/printer combos that will not scan if the ink is empty.
* '''Consumer backlash''': Users criticized these updates as anti-consumer, with some pursuing [[class action lawsuit|class-action lawsuits]] for deceptive practices.<ref>https://www.classaction.org/hp-printer-ink-firmware-lawsuit</ref>

Like 2D printers, Bambu Lab's update restricts functionality previously available to users and pushes them toward proprietary software and cloud-based control.

A parallel specific to the 3D-printing industry can also be drawn from the now-defunct 3D-printer manufacturer [[MakerBot]], whose shift from open-source, DIY-focused machines in 2012 to closed-source, proprietary machines (similarly to Bambu Labs), ultimately drove customers to less-expensive, open-source competitors.<ref>https://hackaday.com/2016/04/28/the-makerbot-obituary/</ref> MakerBot was also accused of asserting ownership over publicly available, open-source designs uploaded to its 3D print repository, Thingiverse.<ref>https://techcrunch.com/2014/05/28/makerbot-responds-to-critics-who-claim-it-is-stealing-community-ip/</ref> These factors contributed to MakerBot steadily losing their position and reputation as an industry leader, before getting absorbed by rival Ultimaker in 2022.

== References ==

<references/>
[[Category:Bambu Lab]]

Bambu Lab Authorization Control System

2025-01-19T23:21:13Z

Lomanic: deduplicate <ref>

[[Category:Feature Ransom]]

On January 16, 2025, the 3D-printer manufacturer [[:wikipedia:Bambu Lab|Bambu Lab]] announced that future firmwares for their 3D printers would introduce an authorization and authentication protection mechanism for their connection and control, in the name of security. Bambu has stated the following:<blockquote>''"This change is mitigating any risk of remote hacks or printer exposure issues that have happened in the past and also lower the risk of abnormal traffic or attacks."''<ref name="firmware-update-introducing-new-authorization-control-system-2">https://blog.bambulab.com/firmware-update-introducing-new-authorization-control-system-2/</ref><ref>https://all3dp.com/4/bambu-lab-limits-third-party-printer-control-with-new-security-update/</ref></blockquote>

== Controversy regarding firmware updates ==
[[File:Bambu tos screenshot.png|alt=bambu terms stating print jobs may not function properly if update is not performed to new firmware which is highly limiting. |thumb|Bambu terms regarding printer functionality & potential for disrupted print jobs if users do not update to a new firmware that radically restricts the autonomy of the owner of the printer]]

=== Potential for remote disabling of printers ===
A significant concern raised by the community revolves around the wording in Bambu Lab's [[Terms of Service]] and firmware update announcements. Critics and users argue that the phrasing leaves open the possibility for the manufacturer to remotely disable printers that are not updated to the latest firmware. Specifically, Bambu Lab's Terms of Service<ref>https://bambulab.com/en-us/policies/terms</ref> states that printers may block "new print jobs" if updates are not applied, which some users interpret as a potential pathway for forced obsolescence<ref name="firmware-update-introducing-new-authorization-control-system-2" />. The announcement, however, specifically says, "'''What happens if I never upgrade to this firmware?''' ''You may continue using an older firmware version that does not include the new security updates; however, this means the printers may miss out on important security fixes or bug patches included in newer versions.''"<ref name="firmware-update-introducing-new-authorization-control-system-2" />

While defenders of Bambu Lab point out that offline modes such as SD-card printing and LAN-only setups would remain functional, others point out that the Terms of Service do not explicitly limit this restriction to cloud-based printing. This ambiguity has led to speculation that Bambu Lab could enforce broader limitations, effectively rendering printers inoperable for users who choose not to update.<ref>https://old.reddit.com/r/BambuLab/comments/1i45iy2/bambu_lab_reserves_the_right_to_brick_your/</ref>

=== Debate over "bricking" terminology ===
The debate has also extended to the definition of "bricking." Some community members assert that if a printer is unable to accept new print jobs without an update, it effectively becomes non-functional and qualifies as being "bricked." Others counter that as long as certain offline functionalities remain (such as SD-card printing) the term does not accurately apply.<ref>https://old.reddit.com/r/BambuLab/comments/1i45iy2/bambu_lab_reserves_the_right_to_brick_your/m7sezlg/</ref>

=== Community Strategies to Deal with Risks ===
Users have discussed strategies to avoid possible disruptions, including:
* Operating printers exclusively in offline modes.
* Utilizing LAN connections or VPN setups: this requires an access key from the printer (previously, you could use your cloud credentials over LAN).
* Exploring alternative firmware or third-party scripts to restore full functionality<ref>https://old.reddit.com/r/BambuLab/comments/1i45iy2/bambu_lab_reserves_the_right_to_brick_your/m7t8i7r/</ref>.

== Bambu Lab's justification and rebuttal ==
Bambu Lab has stated that the authorization system is in place in order to protect against "remote hacks," "printer exposure," and "abnormal traffic or attacks." There are, however, several ways to mitigate these risks without the loss of user control that their system causes:

* '''The "remote hacks" that were cited as an example in the article seem to be a direct result of the 3D-printer vendor not responding properly to a reported security vulnerability in their product.<ref>[https://www.bitdefender.com/en-au/blog/hotforsecurity/someone-is-hacking-3d-printers-to-warn-owners-of-a-security-flaw?ref=blog.bambulab.com https://www.bitdefender.com/en-au/blog/hotforsecurity/someone-is-hacking-3d-printers-to-warn-owners-of-a-security-flaw]</ref> Therefore, in order to get attention, the researcher decided to infect machines and display a harmless message to spread publicity.''' Properly responding to security vulnerabilities, working to patch them quickly, and working with the security community (who would be more than happy to help secure products) would be some ways to prevent this.
* In the article cited about printer exposure, the hack was carried out largely because of user misconfiguration.<ref>[https://www.csoonline.com/article/566223/over-3700-exposed-3d-printers-open-to-remote-attackers.html?ref=blog.bambulab.com https://www.csoonline.com/article/566223/over-3700-exposed-3d-printers-open-to-remote-attackers.html]</ref> Printer exposure can be mitigated by offering more convenient ways to securely expose printers to the internet, so that users are not tempted to allow unauthenticated access over the network.
* The "abnormal traffic" can be mitigated by steps Bambu has already put in place, as detailed in their own article on the matter<ref>[https://wiki.bambulab.com/en/security-incidents-cloud-traffic?ref=blog.bambulab.com https://wiki.bambulab.com/en/security-incidents-cloud-traffic]</ref>.

== Issues with LAN mode requiring authorization ==

Bambu Lab printers have the ability to be controlled over both cloud and LAN. This allowed users to integrate their printers into private networks and maintain full control without having to rely on the manufacturer's server while also allowing cloud access. The new authorization system mandates that even LAN-based operations must go through an authentication process using Bambu Connect to retain full control.<ref name="bambu-connect">https://wiki.bambulab.com/en/software/bambu-connect</ref> Full local access is still possible and unchanged for those not using the cloud.

This change has drawn criticism for many reasons:
* '''Privacy concerns''': Requiring authentication for LAN mode raises concerns about data being unnecessarily exposed to Bambu Lab's servers, even for local-only operations, though previously, the printer was also connected and could be controlled by the cloud even when sending prints locally.
** Confidentiality required by US Law - This is in conflict with those that have to comply with 18 CFR § 3a.61, 32 CFR § 117.15, 32 CFR § 2001.47, and other restrictions.
* '''Loss of offline independence while also using cloud''': Before, users could have hybrid offline setups. The requirement for authentication removes this option unless users revert to older firmware versions, which Bambu does not allow people to do once they have updated to the firmware using the new scheme.
* '''Increased complexity''': The added authentication layer complicates workflows for users who built custom setups or relied on third-party integrations for LAN control while retaining cloud functionality<ref>https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643</ref>.

=== Precedents and comparisons ===
Critics have likened this potential functionality to similar cases in other industries where manufacturers remotely restrict product features. Notable examples include [[HP]]'s printer firmware updates that [[HP Instant Ink|rendered third-party ink cartridges unusable]] and Tesla's software locks on second-hand vehicles. These parallels suggest a broader trend of manufacturers [[Retroactively amended purchase|using software to control hardware capabilities post-purchase]].<ref>https://www.classaction.org/hp-printer-lawsuit</ref><ref>https://www.wired.com/story/tesla-remote-disable-used-car-features/</ref>

== Implementation Timeline and Requirements ==

The authorization system will be rolled out in phases, starting with the X1 series printers. A beta firmware (version 01.08.03.00) was released on January 17, 2025, with the full release scheduled for January 23, 2025. The P & A series printers will get similar updates at an unspecified future date.

To use printers with the new authorization system, users must update multiple pieces of software:
* Bambu Studio must be updated to version 01.10.02.64 or higher
* Bambu Handy mobile app must be updated to version 2.17.0 or higher
* The new Bambu Connect application must be installed for using third-party slicers

These software updates are mandatory for users who update their firmware. Failing to update all components simultaneously will result in certain printer controls becoming unusable. Users who choose to maintain third-party software compatibility can continue using older firmware versions, though this will not be an option for new printers, which will ship with the authorization system pre-installed.

Bambu Lab states these coordinated updates are necessary because the new authorization system fundamentally changes how the printer validates and accepts commands. The older versions of Bambu Studio and Bambu Handy lack the authentication mechanisms required to interact with printers running the new firmware. The Bambu Connect application was created specifically to provide a controlled interface for third-party software, replacing the previous direct access through network plugins<ref name="firmware-update-introducing-new-authorization-control-system-2" />.

== Impact on third-party integration and user choice ==

=== Changes to third-party access ===
The new authorization system replaces direct network API access with a more limited URL-based interface through Bambu Connect. Third-party software can only interact with the printer by sending specific URL commands to Bambu Connect<ref name="bambu-connect" />. The interface requires three parameters:

* <code>path</code>: The absolute file system path to the 3MF file (e.g., /tmp/cube.gcode.3mf)
* <code>name</code>: The name of the file (e.g., Cube)
* <code>version</code>: A fixed value of 1.0.0 for compatibility

A complete command must be formatted as:<blockquote><syntaxhighlight lang="text">
bambu-connect://import-file?path=%2Ftmp%2Fcube.gcode.3mf&name=Cube&version=1.0.0
</syntaxhighlight></blockquote>This interface only allows basic file transfer and print initiation. All other printer-control functions previously available to third-party software are now exclusive to Bambu's own applications. The path and name parameters must be URL-encoded using encodeURIComponent or equivalent functions<ref name="bambu-connect" />.

=== Reduced home-automation capabilities ===
While basic status monitoring remains available (e.g., print-progress updates in Home Assistant), the new firmware removes the ability for home-automation systems to control printer functions. Users can no longer:
* Start or stop prints remotely using Home Assistant, BTT Panda Touch,<ref name=":0">https://www.facebook.com/BIGTREETECH/posts/pfbid0SNZGxvf7NRdmyVgHf6y9yNedNbU2RrCfdT8gugTSD4AYfr5BHneNF9H1EbwyYiJEl</ref> or other third-party accessories or software interfaces
* Control printer temperatures or cooling
* Automate printer behaviors based on sensor data or events
* Access camera feeds through third-party applications<ref name="bambulab-forum-135400/9">https://forum.bambulab.com/t/this-new-auth-system-will-make-me-sell-my-printers/135400/9</ref>

=== Permanent nature of the update ===
Once a printer is updated to the new firmware, users cannot revert to previous versions that allows full control of the printer using LAN mode access key while signed into the cloud<ref name="firmware-update-introducing-new-authorization-control-system-2" />. The option still exists to disable the cloud service.

The manufacturer states this change is required for security, but community members note that many of the security vulnerabilities being addressed stem from Bambu's own cloud-centric design choices rather than inherent risks of local network control<ref name="bambulab-forum-134549/12">https://forum.bambulab.com/t/bambu-studio-1-10-2-public-beta/134549/12</ref>. The update forces users into using Bambu Connect middleware if they want to retain cloud functionality.

This can be characterised as a significant post-purchase reduction in functionality for existing owners who bought their printers with the understanding they could use third-party software and home-automation tools, but also only affects users actively choosing to use Bambu Cloud at the same time. The inability to revert these changes, combined with the mandatory nature of the update for new printers, is used to demonstrate how manufacturers can use software updates to unilaterally modify the capabilities of hardware products after purchase, although in this case the changes affect only people already choosing to use the cloud service<ref>https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643/9</ref>.

For users that would want to use a third-party slicer while using their cloud service, Bambu would require those users to download and install Bambu Connect in order to send gcode wirelessly over LAN or over the cloud. While Bambu claims that they were in contact with SoftFever, the developer of OrcaSlicer, as of writing, SoftFever still does not have any keys for Bambu Connect and the new firmware is only available as opt-in beta at the moment.<ref name=":1">https://x.com/fever_soft/status/1880630570809795034?t=qJyh4SGFZFllcYrqexGW-Q&s=19</ref>

== Impact on functionality ==
While some functionality remains unauthenticated like in previous firmware versions (sending status information from the printer over the network, starting a print job using SD cards), the most important features now require authentication through a new closed-source client called Bambu Connect<ref name="bambu-connect" />. These restricted features include:

* Initializing prints via LAN or cloud mode
* Remote video access to monitor prints
* Controlling motion system, temperature, fans
* AMS settings and calibrations
* Home automation integration beyond basic status monitoring

Previously, third-party software such as OrcaSlicer<ref name="orca-slicer-issue8063">https://github.com/SoftFever/OrcaSlicer/issues/8063</ref> could interact with Bambu Lab printers via the open-source Bambu Studio and proprietary network plug-ins. While Bambu Connect provides a limited URL-based API to initiate prints, most functionality previously openly available is now restricted to Bambu's ecosystem<ref name="bambulab-forum-135400/9" />.

Previously, third-party accessories such as Panda Touch would allow users to control their printers with a standalone device. Panda Touch was especially popular amongst P series printer owners since P series printers contain a monochromatic screen with a D-pad by default for printer control whereas Panda Touch is a full-color touch screen that had a small battery so that way users could reposition and detach their Panda Touch off their printers if needed. Users would be able to queue up jobs, jog printer motors, and connect to multiple printers at once in order to monitor print jobs. According to Big Tree Tech (BTT), the manufacturer of the Panda Touch, they urge users of Panda Touch not to update firmware any further since doing so would foreseeably permanently break compatibility with users' printers and their Panda Touch. <ref name=":0" />

== Communication with Panda Touch developers ==

As of writing, no formal communication has happened between Big Tree Tech (BTT), the manufacturer and developer of Panda Touch, and Bambu Labs. Based on their Facebook announcement, BTT stated that they have reached out to Bambu and will update if Bambu responds to their correspondence<ref name=":0" />.

== Communication with OrcaSlicer developers ==

Before the official announcement of the new authorization and authentication, Bambu Lab engaged with the OrcaSlicer development team regarding the changes. This communication has sparked significant discussion within the 3D-printing community, particularly regarding its timing, tone, and implications.

=== Pre-announcement contact ===
Reports from OrcaSlicer demonstrate that Bambu Lab provided limited advance notice of the changes that would render their software incompatible with Bambu printers running the new firmware. The communication emphasized:
* The introduction of Bambu Connect as the only supported method for interacting with third-party slicers.
* The discontinuation of the network plugin API that OrcaSlicer and other tools relied on for printer control<ref name="orca-slicer-issue8063" />.
* An invitation for OrcaSlicer developers to adapt their software to integrate with the Bambu Connect URL scheme.

The communication lacked the detailed technical documentation that would be necessary for developers to be able to work with the new requirements.

=== How the community viewed these actions ===
This approach has been interpreted by many as a calculated move by Bambu Lab to enforce tighter control over its ecosystem. Primary criticisms of Bambu were:
* '''Lack of transparency''': The limited warning to OrcaSlicer devs suggests that Bambu Lab prioritized internal rollout schedules over community engagement with existing customers. Point to the contrary: the new firmware is in beta and Bambu Connect middleware contains temporary compomises to allow third-party slicers to work as before.
* '''Lack of follow-through:''' As of writing, SoftFever, OrcaSlicer's lead developer, still does not have API keys for Bambu Connect, a necessary layer of Bambu software that would need to be integrated into OrcaSlicer. Bambu's original announcement prominently mentioned OrcaSlicer and gave the impression that Bambu is actively providing the necessary assets so that SoftFever would be able to implement the new software architecture so that OrcaSlicer users are able to still use OrcaSlicer to send gcode to their printers without needing Bambu Connect to be installed as a separate program. The lack of active cooperation does not reflect favorably upon Bambu as it seems like their announcement used OrcaSlicer's name to try to make it seem like Bambu is trying its best to make sure that developers have what they need, but in reality, their inaction seems to show that Bambu is not making a sincere attempt to ensure that OrcaSlicer remains supported<ref name=":1" />.
* '''Disregard for open-source collaboration''': OrcaSlicer is widely used in the community; it is an open-source effort to improve the 3D-printing experience for all customers. By abruptly altering the compatibility landscape, Bambu Lab is seen as undermining good-faith initiatives to improve the ecosystem for everyone. The decision to restrict network APIs in favor of proprietary systems such as Bambu Connect represents a broader industry trend of closing off ecosystems that were once open, removing customer choice, privacy, and freedom.
* '''Token support for third-party tools''': While Bambu Connect provides a workaround for third-party slicer use, it significantly restricts functionality and complicates workflows, leading many to question the sincerity of Bambu's stated support for open-source tools<ref name="bambu-connect" />.
* '''Power imbalance''': As the hardware manufacturer, Bambu Lab has the ability to dictate how its products can be used; often to the detriment of third-party developers and users.

== Community-driven workarounds and technical alternatives ==

The 3D-printing community has begun exploring potential workarounds to restore functionality and user autonomy. These efforts focus on bypassing or mitigating the limitations imposed by the firmware update.

=== Custom firmware development ===
Discussions within the community highlight interest in developing custom firmware as an alternative to Bambu's official updates. One prominent project mentioned in forums is the development of custom firmware for the X1-series printers, such as the "X1Plus Custom Firmware"<ref name="bambulab-forum-134549/12" />. This firmware aims to:
* Restore direct network control and third-party slicer compatibility.
* Re-enable previously available features such as motion-system adjustments, temperature control, and AMS settings without requiring proprietary software.
* Provide users with greater flexibility in integrating printers with home-automation systems and workflows.

However, custom firmware development faces significant challenges, including:
* Limited documentation and proprietary hardware components, which complicate reverse-engineering efforts.
* The potential voiding of warranties and risks of bricking devices.
* Legal concerns regarding intellectual property and bypassing manufacturer-imposed restrictions.

== LAN mode and blocked internet access ==
This is a guide made by the user Tzeny15

https://www.reddit.com/r/BambuLab/comments/1i4vp5i/comment/this/

== Reverse Engineering Bambu Connect ==
{{:Reverse Engineering Bambu Connect}}

''[[Reverse_Engineering_Bambu_Connect|Read more here.]]''

{{Reverse Engineering Bambu Connect}}

== Community tools and scripts ==
In addition to firmware alternatives, some users have come up with custom scripts and software tools to interface with Bambu Lab printers indirectly. These tools often rely on:
* Reverse-engineering the URL-based commands required by Bambu Connect to enable partial functionality with third-party slicers like OrcaSlicer.
* Creating local server emulations to replicate the network API previously available before the update.

While these tools provide temporary solutions, they don't fully replace the open ecosystem that existed prior to the authorization update.

=== Re-engineering printer-control electronics ===
ChazLayyd's Bambu Lab Klipper Conversion project is currently in an incomplete stage<ref>https://github.com/ChazLayyd/Bambu-Lab-Klipper-Conversion</ref><ref>DhazLayyd's Discord Community

https://discord.gg/W6B5mBejuC</ref>. While the project was not made in response to Bambu's announcement, there has been a wave of new public interest in this specific project. ChazLayyd's documentation instructs P1S owners to non-destructively remove the old control electronics that run Bambu's proprietary software and instructs P1S owners to install off-the-shelf control components so that the existing motor connectors and other critical electronics can communicate with the newly-installed off-the-shelf control components.

=== Advocacy for open-ecosystem support ===
Community members have also organized to advocate for open-source support and rollback options. Suggestions include:
* Allowing an opt-out option for existing users who prefer local network control without cloud dependency.
** It should be pointed out that this has always been possible and past firmware updates made signing into the cloud at any point completely unnecessary. This information continues to be ignored by some.
* Providing an official API for third-party slicers under specific licensing agreements that allow secure authorized usage.<ref name="orca-slicer-issue8063" />
== Bambu corporate strategy vs maker community values==

=== Impact on professional users and print farms ===
The restrictions imposed by the new authorization system create significant operational challenges for professional users who kept their printers signed into the cloud:

* Print farms can no longer use custom automation systems to manage multiple printers
* Workflows built around third-party software have to be completely redesigned
* The requirement to manually export and import files through Bambu Connect creates additional labor
* Integration with existing business systems and workflows becomes more difficult or impossible
* Professional users with more than 20 printers report the new workflow as "an absolute nightmare"<ref>https://forum.bambulab.com/t/this-new-auth-system-will-make-me-sell-my-printers/135400/4</ref>
The solution to the above is not to sign the printer into the cloud. Keeping the printer signed in would be a security oversight in this use case on the part of the print farm.

=== Privacy and data-collection concerns ===

The shift toward mandatory use of Bambu's software ecosystem raises several privacy and data collection concerns:

* All printer operations must now pass through Bambu's cloud infrastructure when using cloud mode
* User print data, including file names and print settings, becomes visible to Bambu when cloud is used
* Camera feeds and operational data are processed through Bambu's servers while on a different network
* Users have limited visibility into how their data is collected, stored, and used in the cloud
* The system creates dependence on Bambu's cloud services availability for basic printer functionality<ref>https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643/9</ref>

While Bambu Lab maintains that cloud processing is necessary for security and functionality, community members argue this represents unnecessary data collection that could be handled locally<ref name="bambulab-forum-134549/12" />. The company's cloud infrastructure costs are significant, leading some users to speculate that future monetization of the cloud services may be planned<ref name="bambulab-forum-3643/5">https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643/5</ref>. Therefore, people should assess if their use case mandates the use of the cloud service and disable it when it doesn't.

This shift from local control to cloud-dependent operation is part of a broader trend in consumer devices, where manufacturers use security concerns to justify increased data collection and reduced customer control over devices they bought and paid for. Privacy-conscious users should operate their printers in LAN-only mode to avoid cloud connectivity.

== Customer reactions ==

Customer reactions have been overwhelmingly negative.<ref>https://forum.bambulab.com/t/bambu-studio-1-10-2-public-beta/134549/4</ref><ref>https://old.reddit.com/r/BambuLab/comments/1i2psvz/firmware_update_introducing_new_authorization/</ref> Bambu Lab has historically pushed cloud-based printer interaction while offering limited LAN mode functionality.<ref>https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643/9</ref> Many customers argue that the security issues this locked-down firmware claims to address are actually consequences of the company's cloud-based design choices rather than inherent risks of local network control<ref name="bambulab-forum-134549/12" />, which continues to infuriate users who are now told that security is the justification for a loss of freedom. As a result of the announcement of the shift, customer ratings on sites like Trustpilot rapidly dropped<ref>https://www.trustpilot.com/review/bambulab.com?sort=recency</ref>, with many reviews citing the restrictions as the reason for the bad reviews.

The shift raises privacy concerns as user print data, including file names, print settings, and camera feeds, must now pass through Bambu's cloud infrastructure.

Many community members and customers ask whether the significant costs of maintaining and deploying this cloud infrastructure might lead to future monetization of these now-mandatory services<ref name="bambulab-forum-3643/5" />, with subscriptions required for features that once worked with local access.

It should be noted, however, that so far '''no changes have been made or indicated for those not using the cloud service'''. Past firmware updates made it possible to avoid using the cloud service completely by allowing pairing the slicer via IP address and access key and doing offline firmware updates without having to sign the printer into the service, not even temporarily, keeping local functionality unchanged.

== Comparisons to similar practices by other companies ==

Bambu Lab's new authorization and authentication requirements have been compared to a number of practices by traditional printer manufacturers, such as [[HP]] or [[Epson]], who have also faced backlash around their handling of [[digital-rights management]] (DRM){{Citation needed}}. These comparisons address:
* '''Forced updates''': Firmware updates have rendered third-party ink cartridges incompatible, forcing users to purchase proprietary consumables.
* '''Restricted features''': Scanner/printer combos that will not scan if the ink is empty.
* '''Consumer backlash''': Users criticized these updates as anti-consumer, with some pursuing [[class action lawsuit|class-action lawsuits]] for deceptive practices.<ref>https://www.classaction.org/hp-printer-ink-firmware-lawsuit</ref>

Like 2D printers, Bambu Lab's update restricts functionality previously available to users and pushes them toward proprietary software and cloud-based control.

A parallel specific to the 3D-printing industry can also be drawn from the now-defunct 3D-printer manufacturer [[MakerBot]], whose shift from open-source, DIY-focused machines in 2012 to closed-source, proprietary machines (similarly to Bambu Labs), ultimately drove customers to less-expensive, open-source competitors.<ref>https://hackaday.com/2016/04/28/the-makerbot-obituary/</ref> MakerBot was also accused of asserting ownership over publicly available, open-source designs uploaded to its 3D print repository, Thingiverse.<ref>https://techcrunch.com/2014/05/28/makerbot-responds-to-critics-who-claim-it-is-stealing-community-ip/</ref> These factors contributed to MakerBot steadily losing their position and reputation as an industry leader, before getting absorbed by rival Ultimaker in 2022.

== References ==

<references/>
[[Category:Bambu Lab]]

Bambu Lab Authorization Control System

2025-01-19T23:19:17Z

Lomanic: /* How the community viewed these actions */ typography

[[Category:Feature Ransom]]

On January 16, 2025, the 3D-printer manufacturer [[:wikipedia:Bambu Lab|Bambu Lab]] announced that future firmwares for their 3D printers would introduce an authorization and authentication protection mechanism for their connection and control, in the name of security. Bambu has stated the following:<blockquote>''"This change is mitigating any risk of remote hacks or printer exposure issues that have happened in the past and also lower the risk of abnormal traffic or attacks."''<ref name="firmware-update-introducing-new-authorization-control-system-2">https://blog.bambulab.com/firmware-update-introducing-new-authorization-control-system-2/</ref><ref>https://all3dp.com/4/bambu-lab-limits-third-party-printer-control-with-new-security-update/</ref></blockquote>

== Controversy regarding firmware updates ==
[[File:Bambu tos screenshot.png|alt=bambu terms stating print jobs may not function properly if update is not performed to new firmware which is highly limiting. |thumb|Bambu terms regarding printer functionality & potential for disrupted print jobs if users do not update to a new firmware that radically restricts the autonomy of the owner of the printer]]

=== Potential for remote disabling of printers ===
A significant concern raised by the community revolves around the wording in Bambu Lab's [[Terms of Service]] and firmware update announcements. Critics and users argue that the phrasing leaves open the possibility for the manufacturer to remotely disable printers that are not updated to the latest firmware. Specifically, Bambu Lab's Terms of Service<ref>https://bambulab.com/en-us/policies/terms</ref> states that printers may block "new print jobs" if updates are not applied, which some users interpret as a potential pathway for forced obsolescence<ref name="firmware-update-introducing-new-authorization-control-system-2" />. The announcement, however, specifically says, "'''What happens if I never upgrade to this firmware?''' ''You may continue using an older firmware version that does not include the new security updates; however, this means the printers may miss out on important security fixes or bug patches included in newer versions.''"<ref name="firmware-update-introducing-new-authorization-control-system-2" />

While defenders of Bambu Lab point out that offline modes such as SD-card printing and LAN-only setups would remain functional, others point out that the Terms of Service do not explicitly limit this restriction to cloud-based printing. This ambiguity has led to speculation that Bambu Lab could enforce broader limitations, effectively rendering printers inoperable for users who choose not to update.<ref>https://old.reddit.com/r/BambuLab/comments/1i45iy2/bambu_lab_reserves_the_right_to_brick_your/</ref>

=== Debate over "bricking" terminology ===
The debate has also extended to the definition of "bricking." Some community members assert that if a printer is unable to accept new print jobs without an update, it effectively becomes non-functional and qualifies as being "bricked." Others counter that as long as certain offline functionalities remain (such as SD-card printing) the term does not accurately apply.<ref>https://old.reddit.com/r/BambuLab/comments/1i45iy2/bambu_lab_reserves_the_right_to_brick_your/m7sezlg/</ref>

=== Community Strategies to Deal with Risks ===
Users have discussed strategies to avoid possible disruptions, including:
* Operating printers exclusively in offline modes.
* Utilizing LAN connections or VPN setups: this requires an access key from the printer (previously, you could use your cloud credentials over LAN).
* Exploring alternative firmware or third-party scripts to restore full functionality<ref>https://old.reddit.com/r/BambuLab/comments/1i45iy2/bambu_lab_reserves_the_right_to_brick_your/m7t8i7r/</ref>.

== Bambu Lab's justification and rebuttal ==
Bambu Lab has stated that the authorization system is in place in order to protect against "remote hacks," "printer exposure," and "abnormal traffic or attacks." There are, however, several ways to mitigate these risks without the loss of user control that their system causes:

* '''The "remote hacks" that were cited as an example in the article seem to be a direct result of the 3D-printer vendor not responding properly to a reported security vulnerability in their product.<ref>[https://www.bitdefender.com/en-au/blog/hotforsecurity/someone-is-hacking-3d-printers-to-warn-owners-of-a-security-flaw?ref=blog.bambulab.com https://www.bitdefender.com/en-au/blog/hotforsecurity/someone-is-hacking-3d-printers-to-warn-owners-of-a-security-flaw]</ref> Therefore, in order to get attention, the researcher decided to infect machines and display a harmless message to spread publicity.''' Properly responding to security vulnerabilities, working to patch them quickly, and working with the security community (who would be more than happy to help secure products) would be some ways to prevent this.
* In the article cited about printer exposure, the hack was carried out largely because of user misconfiguration.<ref>[https://www.csoonline.com/article/566223/over-3700-exposed-3d-printers-open-to-remote-attackers.html?ref=blog.bambulab.com https://www.csoonline.com/article/566223/over-3700-exposed-3d-printers-open-to-remote-attackers.html]</ref> Printer exposure can be mitigated by offering more convenient ways to securely expose printers to the internet, so that users are not tempted to allow unauthenticated access over the network.
* The "abnormal traffic" can be mitigated by steps Bambu has already put in place, as detailed in their own article on the matter<ref>[https://wiki.bambulab.com/en/security-incidents-cloud-traffic?ref=blog.bambulab.com https://wiki.bambulab.com/en/security-incidents-cloud-traffic]</ref>.

== Issues with LAN mode requiring authorization ==

Bambu Lab printers have the ability to be controlled over both cloud and LAN. This allowed users to integrate their printers into private networks and maintain full control without having to rely on the manufacturer's server while also allowing cloud access. The new authorization system mandates that even LAN-based operations must go through an authentication process using Bambu Connect to retain full control.<ref name="bambu-connect">https://wiki.bambulab.com/en/software/bambu-connect</ref> Full local access is still possible and unchanged for those not using the cloud.

This change has drawn criticism for many reasons:
* '''Privacy concerns''': Requiring authentication for LAN mode raises concerns about data being unnecessarily exposed to Bambu Lab's servers, even for local-only operations, though previously, the printer was also connected and could be controlled by the cloud even when sending prints locally.
** Confidentiality required by US Law - This is in conflict with those that have to comply with 18 CFR § 3a.61, 32 CFR § 117.15, 32 CFR § 2001.47, and other restrictions.
* '''Loss of offline independence while also using cloud''': Before, users could have hybrid offline setups. The requirement for authentication removes this option unless users revert to older firmware versions, which Bambu does not allow people to do once they have updated to the firmware using the new scheme.
* '''Increased complexity''': The added authentication layer complicates workflows for users who built custom setups or relied on third-party integrations for LAN control while retaining cloud functionality<ref>https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643</ref>.

=== Precedents and comparisons ===
Critics have likened this potential functionality to similar cases in other industries where manufacturers remotely restrict product features. Notable examples include [[HP]]'s printer firmware updates that [[HP Instant Ink|rendered third-party ink cartridges unusable]] and Tesla's software locks on second-hand vehicles. These parallels suggest a broader trend of manufacturers [[Retroactively amended purchase|using software to control hardware capabilities post-purchase]].<ref>https://www.classaction.org/hp-printer-lawsuit</ref><ref>https://www.wired.com/story/tesla-remote-disable-used-car-features/</ref>

== Implementation Timeline and Requirements ==

The authorization system will be rolled out in phases, starting with the X1 series printers. A beta firmware (version 01.08.03.00) was released on January 17, 2025, with the full release scheduled for January 23, 2025. The P & A series printers will get similar updates at an unspecified future date.

To use printers with the new authorization system, users must update multiple pieces of software:
* Bambu Studio must be updated to version 01.10.02.64 or higher
* Bambu Handy mobile app must be updated to version 2.17.0 or higher
* The new Bambu Connect application must be installed for using third-party slicers

These software updates are mandatory for users who update their firmware. Failing to update all components simultaneously will result in certain printer controls becoming unusable. Users who choose to maintain third-party software compatibility can continue using older firmware versions, though this will not be an option for new printers, which will ship with the authorization system pre-installed.

Bambu Lab states these coordinated updates are necessary because the new authorization system fundamentally changes how the printer validates and accepts commands. The older versions of Bambu Studio and Bambu Handy lack the authentication mechanisms required to interact with printers running the new firmware. The Bambu Connect application was created specifically to provide a controlled interface for third-party software, replacing the previous direct access through network plugins<ref name="firmware-update-introducing-new-authorization-control-system-2" />.

== Impact on third-party integration and user choice ==

=== Changes to third-party access ===
The new authorization system replaces direct network API access with a more limited URL-based interface through Bambu Connect. Third-party software can only interact with the printer by sending specific URL commands to Bambu Connect<ref name="bambu-connect" />. The interface requires three parameters:

* <code>path</code>: The absolute file system path to the 3MF file (e.g., /tmp/cube.gcode.3mf)
* <code>name</code>: The name of the file (e.g., Cube)
* <code>version</code>: A fixed value of 1.0.0 for compatibility

A complete command must be formatted as:<blockquote><syntaxhighlight lang="text">
bambu-connect://import-file?path=%2Ftmp%2Fcube.gcode.3mf&name=Cube&version=1.0.0
</syntaxhighlight></blockquote>This interface only allows basic file transfer and print initiation. All other printer-control functions previously available to third-party software are now exclusive to Bambu's own applications. The path and name parameters must be URL-encoded using encodeURIComponent or equivalent functions<ref name="bambu-connect" />.

=== Reduced home-automation capabilities ===
While basic status monitoring remains available (e.g., print-progress updates in Home Assistant), the new firmware removes the ability for home-automation systems to control printer functions. Users can no longer:
* Start or stop prints remotely using Home Assistant, BTT Panda Touch,<ref name=":0">https://www.facebook.com/BIGTREETECH/posts/pfbid0SNZGxvf7NRdmyVgHf6y9yNedNbU2RrCfdT8gugTSD4AYfr5BHneNF9H1EbwyYiJEl</ref> or other third-party accessories or software interfaces
* Control printer temperatures or cooling
* Automate printer behaviors based on sensor data or events
* Access camera feeds through third-party applications<ref>https://forum.bambulab.com/t/this-new-auth-system-will-make-me-sell-my-printers/135400/9</ref>

=== Permanent nature of the update ===
Once a printer is updated to the new firmware, users cannot revert to previous versions that allows full control of the printer using LAN mode access key while signed into the cloud<ref name="firmware-update-introducing-new-authorization-control-system-2" />. The option still exists to disable the cloud service.

The manufacturer states this change is required for security, but community members note that many of the security vulnerabilities being addressed stem from Bambu's own cloud-centric design choices rather than inherent risks of local network control<ref name="bambulab-forum-134549/12">https://forum.bambulab.com/t/bambu-studio-1-10-2-public-beta/134549/12</ref>. The update forces users into using Bambu Connect middleware if they want to retain cloud functionality.

This can be characterised as a significant post-purchase reduction in functionality for existing owners who bought their printers with the understanding they could use third-party software and home-automation tools, but also only affects users actively choosing to use Bambu Cloud at the same time. The inability to revert these changes, combined with the mandatory nature of the update for new printers, is used to demonstrate how manufacturers can use software updates to unilaterally modify the capabilities of hardware products after purchase, although in this case the changes affect only people already choosing to use the cloud service<ref>https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643/9</ref>.

For users that would want to use a third-party slicer while using their cloud service, Bambu would require those users to download and install Bambu Connect in order to send gcode wirelessly over LAN or over the cloud. While Bambu claims that they were in contact with SoftFever, the developer of OrcaSlicer, as of writing, SoftFever still does not have any keys for Bambu Connect and the new firmware is only available as opt-in beta at the moment.<ref name=":1">https://x.com/fever_soft/status/1880630570809795034?t=qJyh4SGFZFllcYrqexGW-Q&s=19</ref>

== Impact on functionality ==
While some functionality remains unauthenticated like in previous firmware versions (sending status information from the printer over the network, starting a print job using SD cards), the most important features now require authentication through a new closed-source client called Bambu Connect<ref name="bambu-connect" />. These restricted features include:

* Initializing prints via LAN or cloud mode
* Remote video access to monitor prints
* Controlling motion system, temperature, fans
* AMS settings and calibrations
* Home automation integration beyond basic status monitoring

Previously, third-party software such as OrcaSlicer<ref name="orca-slicer-issue8063">https://github.com/SoftFever/OrcaSlicer/issues/8063</ref> could interact with Bambu Lab printers via the open-source Bambu Studio and proprietary network plug-ins. While Bambu Connect provides a limited URL-based API to initiate prints, most functionality previously openly available is now restricted to Bambu's ecosystem<ref>https://forum.bambulab.com/t/this-new-auth-system-will-make-me-sell-my-printers/135400/9</ref>.

Previously, third-party accessories such as Panda Touch would allow users to control their printers with a standalone device. Panda Touch was especially popular amongst P series printer owners since P series printers contain a monochromatic screen with a D-pad by default for printer control whereas Panda Touch is a full-color touch screen that had a small battery so that way users could reposition and detach their Panda Touch off their printers if needed. Users would be able to queue up jobs, jog printer motors, and connect to multiple printers at once in order to monitor print jobs. According to Big Tree Tech (BTT), the manufacturer of the Panda Touch, they urge users of Panda Touch not to update firmware any further since doing so would foreseeably permanently break compatibility with users' printers and their Panda Touch. <ref name=":0" />

== Communication with Panda Touch developers ==

As of writing, no formal communication has happened between Big Tree Tech (BTT), the manufacturer and developer of Panda Touch, and Bambu Labs. Based on their Facebook announcement, BTT stated that they have reached out to Bambu and will update if Bambu responds to their correspondence. <ref name=":0" />

== Communication with OrcaSlicer developers ==

Before the official announcement of the new authorization and authentication, Bambu Lab engaged with the OrcaSlicer development team regarding the changes. This communication has sparked significant discussion within the 3D-printing community, particularly regarding its timing, tone, and implications.

=== Pre-announcement contact ===
Reports from OrcaSlicer demonstrate that Bambu Lab provided limited advance notice of the changes that would render their software incompatible with Bambu printers running the new firmware. The communication emphasized:
* The introduction of Bambu Connect as the only supported method for interacting with third-party slicers.
* The discontinuation of the network plugin API that OrcaSlicer and other tools relied on for printer control<ref name="orca-slicer-issue8063" />.
* An invitation for OrcaSlicer developers to adapt their software to integrate with the Bambu Connect URL scheme.

The communication lacked the detailed technical documentation that would be necessary for developers to be able to work with the new requirements.

=== How the community viewed these actions ===
This approach has been interpreted by many as a calculated move by Bambu Lab to enforce tighter control over its ecosystem. Primary criticisms of Bambu were:
* '''Lack of transparency''': The limited warning to OrcaSlicer devs suggests that Bambu Lab prioritized internal rollout schedules over community engagement with existing customers. Point to the contrary: the new firmware is in beta and Bambu Connect middleware contains temporary compomises to allow third-party slicers to work as before.
* '''Lack of follow-through:''' As of writing, SoftFever, OrcaSlicer's lead developer, still does not have API keys for Bambu Connect, a necessary layer of Bambu software that would need to be integrated into OrcaSlicer. Bambu's original announcement prominently mentioned OrcaSlicer and gave the impression that Bambu is actively providing the necessary assets so that SoftFever would be able to implement the new software architecture so that OrcaSlicer users are able to still use OrcaSlicer to send gcode to their printers without needing Bambu Connect to be installed as a separate program. The lack of active cooperation does not reflect favorably upon Bambu as it seems like their announcement used OrcaSlicer's name to try to make it seem like Bambu is trying its best to make sure that developers have what they need, but in reality, their inaction seems to show that Bambu is not making a sincere attempt to ensure that OrcaSlicer remains supported<ref name=":1" />.
* '''Disregard for open-source collaboration''': OrcaSlicer is widely used in the community; it is an open-source effort to improve the 3D-printing experience for all customers. By abruptly altering the compatibility landscape, Bambu Lab is seen as undermining good-faith initiatives to improve the ecosystem for everyone. The decision to restrict network APIs in favor of proprietary systems such as Bambu Connect represents a broader industry trend of closing off ecosystems that were once open, removing customer choice, privacy, and freedom.
* '''Token support for third-party tools''': While Bambu Connect provides a workaround for third-party slicer use, it significantly restricts functionality and complicates workflows, leading many to question the sincerity of Bambu's stated support for open-source tools<ref name="bambu-connect" />.
* '''Power imbalance''': As the hardware manufacturer, Bambu Lab has the ability to dictate how its products can be used; often to the detriment of third-party developers and users.

== Community-driven workarounds and technical alternatives ==

The 3D-printing community has begun exploring potential workarounds to restore functionality and user autonomy. These efforts focus on bypassing or mitigating the limitations imposed by the firmware update.

=== Custom firmware development ===
Discussions within the community highlight interest in developing custom firmware as an alternative to Bambu's official updates. One prominent project mentioned in forums is the development of custom firmware for the X1-series printers, such as the "X1Plus Custom Firmware"<ref name="bambulab-forum-134549/12" />. This firmware aims to:
* Restore direct network control and third-party slicer compatibility.
* Re-enable previously available features such as motion-system adjustments, temperature control, and AMS settings without requiring proprietary software.
* Provide users with greater flexibility in integrating printers with home-automation systems and workflows.

However, custom firmware development faces significant challenges, including:
* Limited documentation and proprietary hardware components, which complicate reverse-engineering efforts.
* The potential voiding of warranties and risks of bricking devices.
* Legal concerns regarding intellectual property and bypassing manufacturer-imposed restrictions.

== LAN mode and blocked internet access ==
This is a guide made by the user Tzeny15

https://www.reddit.com/r/BambuLab/comments/1i4vp5i/comment/this/

== Reverse Engineering Bambu Connect ==
{{:Reverse Engineering Bambu Connect}}

''[[Reverse_Engineering_Bambu_Connect|Read more here.]]''

{{Reverse Engineering Bambu Connect}}

== Community tools and scripts ==
In addition to firmware alternatives, some users have come up with custom scripts and software tools to interface with Bambu Lab printers indirectly. These tools often rely on:
* Reverse-engineering the URL-based commands required by Bambu Connect to enable partial functionality with third-party slicers like OrcaSlicer.
* Creating local server emulations to replicate the network API previously available before the update.

While these tools provide temporary solutions, they don't fully replace the open ecosystem that existed prior to the authorization update.

=== Re-engineering printer-control electronics ===
ChazLayyd's Bambu Lab Klipper Conversion project is currently in an incomplete stage<ref>https://github.com/ChazLayyd/Bambu-Lab-Klipper-Conversion</ref><ref>DhazLayyd's Discord Community

https://discord.gg/W6B5mBejuC</ref>. While the project was not made in response to Bambu's announcement, there has been a wave of new public interest in this specific project. ChazLayyd's documentation instructs P1S owners to non-destructively remove the old control electronics that run Bambu's proprietary software and instructs P1S owners to install off-the-shelf control components so that the existing motor connectors and other critical electronics can communicate with the newly-installed off-the-shelf control components.

=== Advocacy for open-ecosystem support ===
Community members have also organized to advocate for open-source support and rollback options. Suggestions include:
* Allowing an opt-out option for existing users who prefer local network control without cloud dependency.
** It should be pointed out that this has always been possible and past firmware updates made signing into the cloud at any point completely unnecessary. This information continues to be ignored by some.
* Providing an official API for third-party slicers under specific licensing agreements that allow secure authorized usage.<ref name="orca-slicer-issue8063" />
== Bambu corporate strategy vs maker community values==

=== Impact on professional users and print farms ===
The restrictions imposed by the new authorization system create significant operational challenges for professional users who kept their printers signed into the cloud:

* Print farms can no longer use custom automation systems to manage multiple printers
* Workflows built around third-party software have to be completely redesigned
* The requirement to manually export and import files through Bambu Connect creates additional labor
* Integration with existing business systems and workflows becomes more difficult or impossible
* Professional users with more than 20 printers report the new workflow as "an absolute nightmare"<ref>https://forum.bambulab.com/t/this-new-auth-system-will-make-me-sell-my-printers/135400/4</ref>
The solution to the above is not to sign the printer into the cloud. Keeping the printer signed in would be a security oversight in this use case on the part of the print farm.

=== Privacy and data-collection concerns ===

The shift toward mandatory use of Bambu's software ecosystem raises several privacy and data collection concerns:

* All printer operations must now pass through Bambu's cloud infrastructure when using cloud mode
* User print data, including file names and print settings, becomes visible to Bambu when cloud is used
* Camera feeds and operational data are processed through Bambu's servers while on a different network
* Users have limited visibility into how their data is collected, stored, and used in the cloud
* The system creates dependence on Bambu's cloud services availability for basic printer functionality<ref>https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643/9</ref>

While Bambu Lab maintains that cloud processing is necessary for security and functionality, community members argue this represents unnecessary data collection that could be handled locally<ref name="bambulab-forum-134549/12" />. The company's cloud infrastructure costs are significant, leading some users to speculate that future monetization of the cloud services may be planned<ref name="bambulab-forum-3643/5">https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643/5</ref>. Therefore, people should assess if their use case mandates the use of the cloud service and disable it when it doesn't.

This shift from local control to cloud-dependent operation is part of a broader trend in consumer devices, where manufacturers use security concerns to justify increased data collection and reduced customer control over devices they bought and paid for. Privacy-conscious users should operate their printers in LAN-only mode to avoid cloud connectivity.

== Customer reactions ==

Customer reactions have been overwhelmingly negative.<ref>https://forum.bambulab.com/t/bambu-studio-1-10-2-public-beta/134549/4</ref><ref>https://old.reddit.com/r/BambuLab/comments/1i2psvz/firmware_update_introducing_new_authorization/</ref> Bambu Lab has historically pushed cloud-based printer interaction while offering limited LAN mode functionality.<ref>https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643/9</ref> Many customers argue that the security issues this locked-down firmware claims to address are actually consequences of the company's cloud-based design choices rather than inherent risks of local network control<ref name="bambulab-forum-134549/12" />, which continues to infuriate users who are now told that security is the justification for a loss of freedom. As a result of the announcement of the shift, customer ratings on sites like Trustpilot rapidly dropped<ref>https://www.trustpilot.com/review/bambulab.com?sort=recency</ref>, with many reviews citing the restrictions as the reason for the bad reviews.

The shift raises privacy concerns as user print data, including file names, print settings, and camera feeds, must now pass through Bambu's cloud infrastructure.

Many community members and customers ask whether the significant costs of maintaining and deploying this cloud infrastructure might lead to future monetization of these now-mandatory services<ref name="bambulab-forum-3643/5" />, with subscriptions required for features that once worked with local access.

It should be noted, however, that so far '''no changes have been made or indicated for those not using the cloud service'''. Past firmware updates made it possible to avoid using the cloud service completely by allowing pairing the slicer via IP address and access key and doing offline firmware updates without having to sign the printer into the service, not even temporarily, keeping local functionality unchanged.

== Comparisons to similar practices by other companies ==

Bambu Lab's new authorization and authentication requirements have been compared to a number of practices by traditional printer manufacturers, such as [[HP]] or [[Epson]], who have also faced backlash around their handling of [[digital-rights management]] (DRM){{Citation needed}}. These comparisons address:
* '''Forced updates''': Firmware updates have rendered third-party ink cartridges incompatible, forcing users to purchase proprietary consumables.
* '''Restricted features''': Scanner/printer combos that will not scan if the ink is empty.
* '''Consumer backlash''': Users criticized these updates as anti-consumer, with some pursuing [[class action lawsuit|class-action lawsuits]] for deceptive practices.<ref>https://www.classaction.org/hp-printer-ink-firmware-lawsuit</ref>

Like 2D printers, Bambu Lab's update restricts functionality previously available to users and pushes them toward proprietary software and cloud-based control.

A parallel specific to the 3D-printing industry can also be drawn from the now-defunct 3D-printer manufacturer [[MakerBot]], whose shift from open-source, DIY-focused machines in 2012 to closed-source, proprietary machines (similarly to Bambu Labs), ultimately drove customers to less-expensive, open-source competitors.<ref>https://hackaday.com/2016/04/28/the-makerbot-obituary/</ref> MakerBot was also accused of asserting ownership over publicly available, open-source designs uploaded to its 3D print repository, Thingiverse.<ref>https://techcrunch.com/2014/05/28/makerbot-responds-to-critics-who-claim-it-is-stealing-community-ip/</ref> These factors contributed to MakerBot steadily losing their position and reputation as an industry leader, before getting absorbed by rival Ultimaker in 2022.

== References ==

<references/>
[[Category:Bambu Lab]]

Bambu Lab Authorization Control System

2025-01-19T23:18:00Z

Lomanic: deduplicate <ref>

[[Category:Feature Ransom]]

On January 16, 2025, the 3D-printer manufacturer [[:wikipedia:Bambu Lab|Bambu Lab]] announced that future firmwares for their 3D printers would introduce an authorization and authentication protection mechanism for their connection and control, in the name of security. Bambu has stated the following:<blockquote>''"This change is mitigating any risk of remote hacks or printer exposure issues that have happened in the past and also lower the risk of abnormal traffic or attacks."''<ref name="firmware-update-introducing-new-authorization-control-system-2">https://blog.bambulab.com/firmware-update-introducing-new-authorization-control-system-2/</ref><ref>https://all3dp.com/4/bambu-lab-limits-third-party-printer-control-with-new-security-update/</ref></blockquote>

== Controversy regarding firmware updates ==
[[File:Bambu tos screenshot.png|alt=bambu terms stating print jobs may not function properly if update is not performed to new firmware which is highly limiting. |thumb|Bambu terms regarding printer functionality & potential for disrupted print jobs if users do not update to a new firmware that radically restricts the autonomy of the owner of the printer]]

=== Potential for remote disabling of printers ===
A significant concern raised by the community revolves around the wording in Bambu Lab's [[Terms of Service]] and firmware update announcements. Critics and users argue that the phrasing leaves open the possibility for the manufacturer to remotely disable printers that are not updated to the latest firmware. Specifically, Bambu Lab's Terms of Service<ref>https://bambulab.com/en-us/policies/terms</ref> states that printers may block "new print jobs" if updates are not applied, which some users interpret as a potential pathway for forced obsolescence<ref name="firmware-update-introducing-new-authorization-control-system-2" />. The announcement, however, specifically says, "'''What happens if I never upgrade to this firmware?''' ''You may continue using an older firmware version that does not include the new security updates; however, this means the printers may miss out on important security fixes or bug patches included in newer versions.''"<ref name="firmware-update-introducing-new-authorization-control-system-2" />

While defenders of Bambu Lab point out that offline modes such as SD-card printing and LAN-only setups would remain functional, others point out that the Terms of Service do not explicitly limit this restriction to cloud-based printing. This ambiguity has led to speculation that Bambu Lab could enforce broader limitations, effectively rendering printers inoperable for users who choose not to update.<ref>https://old.reddit.com/r/BambuLab/comments/1i45iy2/bambu_lab_reserves_the_right_to_brick_your/</ref>

=== Debate over "bricking" terminology ===
The debate has also extended to the definition of "bricking." Some community members assert that if a printer is unable to accept new print jobs without an update, it effectively becomes non-functional and qualifies as being "bricked." Others counter that as long as certain offline functionalities remain (such as SD-card printing) the term does not accurately apply.<ref>https://old.reddit.com/r/BambuLab/comments/1i45iy2/bambu_lab_reserves_the_right_to_brick_your/m7sezlg/</ref>

=== Community Strategies to Deal with Risks ===
Users have discussed strategies to avoid possible disruptions, including:
* Operating printers exclusively in offline modes.
* Utilizing LAN connections or VPN setups: this requires an access key from the printer (previously, you could use your cloud credentials over LAN).
* Exploring alternative firmware or third-party scripts to restore full functionality<ref>https://old.reddit.com/r/BambuLab/comments/1i45iy2/bambu_lab_reserves_the_right_to_brick_your/m7t8i7r/</ref>.

== Bambu Lab's justification and rebuttal ==
Bambu Lab has stated that the authorization system is in place in order to protect against "remote hacks," "printer exposure," and "abnormal traffic or attacks." There are, however, several ways to mitigate these risks without the loss of user control that their system causes:

* '''The "remote hacks" that were cited as an example in the article seem to be a direct result of the 3D-printer vendor not responding properly to a reported security vulnerability in their product.<ref>[https://www.bitdefender.com/en-au/blog/hotforsecurity/someone-is-hacking-3d-printers-to-warn-owners-of-a-security-flaw?ref=blog.bambulab.com https://www.bitdefender.com/en-au/blog/hotforsecurity/someone-is-hacking-3d-printers-to-warn-owners-of-a-security-flaw]</ref> Therefore, in order to get attention, the researcher decided to infect machines and display a harmless message to spread publicity.''' Properly responding to security vulnerabilities, working to patch them quickly, and working with the security community (who would be more than happy to help secure products) would be some ways to prevent this.
* In the article cited about printer exposure, the hack was carried out largely because of user misconfiguration.<ref>[https://www.csoonline.com/article/566223/over-3700-exposed-3d-printers-open-to-remote-attackers.html?ref=blog.bambulab.com https://www.csoonline.com/article/566223/over-3700-exposed-3d-printers-open-to-remote-attackers.html]</ref> Printer exposure can be mitigated by offering more convenient ways to securely expose printers to the internet, so that users are not tempted to allow unauthenticated access over the network.
* The "abnormal traffic" can be mitigated by steps Bambu has already put in place, as detailed in their own article on the matter<ref>[https://wiki.bambulab.com/en/security-incidents-cloud-traffic?ref=blog.bambulab.com https://wiki.bambulab.com/en/security-incidents-cloud-traffic]</ref>.

== Issues with LAN mode requiring authorization ==

Bambu Lab printers have the ability to be controlled over both cloud and LAN. This allowed users to integrate their printers into private networks and maintain full control without having to rely on the manufacturer's server while also allowing cloud access. The new authorization system mandates that even LAN-based operations must go through an authentication process using Bambu Connect to retain full control.<ref name="bambu-connect">https://wiki.bambulab.com/en/software/bambu-connect</ref> Full local access is still possible and unchanged for those not using the cloud.

This change has drawn criticism for many reasons:
* '''Privacy concerns''': Requiring authentication for LAN mode raises concerns about data being unnecessarily exposed to Bambu Lab's servers, even for local-only operations, though previously, the printer was also connected and could be controlled by the cloud even when sending prints locally.
** Confidentiality required by US Law - This is in conflict with those that have to comply with 18 CFR § 3a.61, 32 CFR § 117.15, 32 CFR § 2001.47, and other restrictions.
* '''Loss of offline independence while also using cloud''': Before, users could have hybrid offline setups. The requirement for authentication removes this option unless users revert to older firmware versions, which Bambu does not allow people to do once they have updated to the firmware using the new scheme.
* '''Increased complexity''': The added authentication layer complicates workflows for users who built custom setups or relied on third-party integrations for LAN control while retaining cloud functionality<ref>https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643</ref>.

=== Precedents and comparisons ===
Critics have likened this potential functionality to similar cases in other industries where manufacturers remotely restrict product features. Notable examples include [[HP]]'s printer firmware updates that [[HP Instant Ink|rendered third-party ink cartridges unusable]] and Tesla's software locks on second-hand vehicles. These parallels suggest a broader trend of manufacturers [[Retroactively amended purchase|using software to control hardware capabilities post-purchase]].<ref>https://www.classaction.org/hp-printer-lawsuit</ref><ref>https://www.wired.com/story/tesla-remote-disable-used-car-features/</ref>

== Implementation Timeline and Requirements ==

The authorization system will be rolled out in phases, starting with the X1 series printers. A beta firmware (version 01.08.03.00) was released on January 17, 2025, with the full release scheduled for January 23, 2025. The P & A series printers will get similar updates at an unspecified future date.

To use printers with the new authorization system, users must update multiple pieces of software:
* Bambu Studio must be updated to version 01.10.02.64 or higher
* Bambu Handy mobile app must be updated to version 2.17.0 or higher
* The new Bambu Connect application must be installed for using third-party slicers

These software updates are mandatory for users who update their firmware. Failing to update all components simultaneously will result in certain printer controls becoming unusable. Users who choose to maintain third-party software compatibility can continue using older firmware versions, though this will not be an option for new printers, which will ship with the authorization system pre-installed.

Bambu Lab states these coordinated updates are necessary because the new authorization system fundamentally changes how the printer validates and accepts commands. The older versions of Bambu Studio and Bambu Handy lack the authentication mechanisms required to interact with printers running the new firmware. The Bambu Connect application was created specifically to provide a controlled interface for third-party software, replacing the previous direct access through network plugins<ref name="firmware-update-introducing-new-authorization-control-system-2" />.

== Impact on third-party integration and user choice ==

=== Changes to third-party access ===
The new authorization system replaces direct network API access with a more limited URL-based interface through Bambu Connect. Third-party software can only interact with the printer by sending specific URL commands to Bambu Connect<ref name="bambu-connect" />. The interface requires three parameters:

* <code>path</code>: The absolute file system path to the 3MF file (e.g., /tmp/cube.gcode.3mf)
* <code>name</code>: The name of the file (e.g., Cube)
* <code>version</code>: A fixed value of 1.0.0 for compatibility

A complete command must be formatted as:<blockquote><syntaxhighlight lang="text">
bambu-connect://import-file?path=%2Ftmp%2Fcube.gcode.3mf&name=Cube&version=1.0.0
</syntaxhighlight></blockquote>This interface only allows basic file transfer and print initiation. All other printer-control functions previously available to third-party software are now exclusive to Bambu's own applications. The path and name parameters must be URL-encoded using encodeURIComponent or equivalent functions<ref name="bambu-connect" />.

=== Reduced home-automation capabilities ===
While basic status monitoring remains available (e.g., print-progress updates in Home Assistant), the new firmware removes the ability for home-automation systems to control printer functions. Users can no longer:
* Start or stop prints remotely using Home Assistant, BTT Panda Touch,<ref name=":0">https://www.facebook.com/BIGTREETECH/posts/pfbid0SNZGxvf7NRdmyVgHf6y9yNedNbU2RrCfdT8gugTSD4AYfr5BHneNF9H1EbwyYiJEl</ref> or other third-party accessories or software interfaces
* Control printer temperatures or cooling
* Automate printer behaviors based on sensor data or events
* Access camera feeds through third-party applications<ref>https://forum.bambulab.com/t/this-new-auth-system-will-make-me-sell-my-printers/135400/9</ref>

=== Permanent nature of the update ===
Once a printer is updated to the new firmware, users cannot revert to previous versions that allows full control of the printer using LAN mode access key while signed into the cloud<ref name="firmware-update-introducing-new-authorization-control-system-2" />. The option still exists to disable the cloud service.

The manufacturer states this change is required for security, but community members note that many of the security vulnerabilities being addressed stem from Bambu's own cloud-centric design choices rather than inherent risks of local network control<ref name="bambulab-forum-134549/12">https://forum.bambulab.com/t/bambu-studio-1-10-2-public-beta/134549/12</ref>. The update forces users into using Bambu Connect middleware if they want to retain cloud functionality.

This can be characterised as a significant post-purchase reduction in functionality for existing owners who bought their printers with the understanding they could use third-party software and home-automation tools, but also only affects users actively choosing to use Bambu Cloud at the same time. The inability to revert these changes, combined with the mandatory nature of the update for new printers, is used to demonstrate how manufacturers can use software updates to unilaterally modify the capabilities of hardware products after purchase, although in this case the changes affect only people already choosing to use the cloud service<ref>https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643/9</ref>.

For users that would want to use a third-party slicer while using their cloud service, Bambu would require those users to download and install Bambu Connect in order to send gcode wirelessly over LAN or over the cloud. While Bambu claims that they were in contact with SoftFever, the developer of OrcaSlicer, as of writing, SoftFever still does not have any keys for Bambu Connect and the new firmware is only available as opt-in beta at the moment.<ref name=":1">https://x.com/fever_soft/status/1880630570809795034?t=qJyh4SGFZFllcYrqexGW-Q&s=19</ref>

== Impact on functionality ==
While some functionality remains unauthenticated like in previous firmware versions (sending status information from the printer over the network, starting a print job using SD cards), the most important features now require authentication through a new closed-source client called Bambu Connect<ref name="bambu-connect" />. These restricted features include:

* Initializing prints via LAN or cloud mode
* Remote video access to monitor prints
* Controlling motion system, temperature, fans
* AMS settings and calibrations
* Home automation integration beyond basic status monitoring

Previously, third-party software such as OrcaSlicer<ref name="orca-slicer-issue8063">https://github.com/SoftFever/OrcaSlicer/issues/8063</ref> could interact with Bambu Lab printers via the open-source Bambu Studio and proprietary network plug-ins. While Bambu Connect provides a limited URL-based API to initiate prints, most functionality previously openly available is now restricted to Bambu's ecosystem<ref>https://forum.bambulab.com/t/this-new-auth-system-will-make-me-sell-my-printers/135400/9</ref>.

Previously, third-party accessories such as Panda Touch would allow users to control their printers with a standalone device. Panda Touch was especially popular amongst P series printer owners since P series printers contain a monochromatic screen with a D-pad by default for printer control whereas Panda Touch is a full-color touch screen that had a small battery so that way users could reposition and detach their Panda Touch off their printers if needed. Users would be able to queue up jobs, jog printer motors, and connect to multiple printers at once in order to monitor print jobs. According to Big Tree Tech (BTT), the manufacturer of the Panda Touch, they urge users of Panda Touch not to update firmware any further since doing so would foreseeably permanently break compatibility with users' printers and their Panda Touch. <ref name=":0" />

== Communication with Panda Touch developers ==

As of writing, no formal communication has happened between Big Tree Tech (BTT), the manufacturer and developer of Panda Touch, and Bambu Labs. Based on their Facebook announcement, BTT stated that they have reached out to Bambu and will update if Bambu responds to their correspondence. <ref name=":0" />

== Communication with OrcaSlicer developers ==

Before the official announcement of the new authorization and authentication, Bambu Lab engaged with the OrcaSlicer development team regarding the changes. This communication has sparked significant discussion within the 3D-printing community, particularly regarding its timing, tone, and implications.

=== Pre-announcement contact ===
Reports from OrcaSlicer demonstrate that Bambu Lab provided limited advance notice of the changes that would render their software incompatible with Bambu printers running the new firmware. The communication emphasized:
* The introduction of Bambu Connect as the only supported method for interacting with third-party slicers.
* The discontinuation of the network plugin API that OrcaSlicer and other tools relied on for printer control<ref name="orca-slicer-issue8063" />.
* An invitation for OrcaSlicer developers to adapt their software to integrate with the Bambu Connect URL scheme.

The communication lacked the detailed technical documentation that would be necessary for developers to be able to work with the new requirements.

=== How the community viewed these actions ===
This approach has been interpreted by many as a calculated move by Bambu Lab to enforce tighter control over its ecosystem. Primary criticisms of Bambu were:
* '''Lack of transparency''': The limited warning to OrcaSlicer devs suggests that Bambu Lab prioritized internal rollout schedules over community engagement with existing customers. Point to the contrary: The new firmware is in beta and Bambu Connect middleware contains temporary compomises to allow third-party slicers to work as before.
* '''Lack of follow-through:''' As of writing, SoftFever, OrcaSlicer's lead developer, still does not have API keys for Bambu Connect, a necessary layer of Bambu software that would need to be integrated into OrcaSlicer. Bambu's original announcement prominently mentioned OrcaSlicer and gave the impression that Bambu is actively providing the necessary assets so that SoftFever would be able to implement the new software architecture so that OrcaSlicer users are able to still use OrcaSlicer to send gcode to their printers without needing Bambu Connect to be installed as a separate program. The lack of active cooperation does not reflect favorably upon Bambu as it seems like their announcement used OrcaSlicer's name to try to make it seem like Bambu is trying its best to make sure that developers have what they need, but in reality, their inaction seems to show that Bambu is not making a sincere attempt to ensure that OrcaSlicer remains supported. <ref name=":1" />
* '''Disregard for open-source collaboration''': OrcaSlicer is widely used in the community; it is an open-source effort to improve the 3D-printing experience for all customers. By abruptly altering the compatibility landscape, Bambu Lab is seen as undermining good-faith initiatives to improve the ecosystem for everyone. The decision to restrict network APIs in favor of proprietary systems such as Bambu Connect represents a broader industry trend of closing off ecosystems that were once open, removing customer choice, privacy, and freedom.
* '''Token support for third-party tools''': While Bambu Connect provides a workaround for third-party slicer use, it significantly restricts functionality and complicates workflows, leading many to question the sincerity of Bambu's stated support for open-source tools<ref name="bambu-connect" />.
* '''Power imbalance''': As the hardware manufacturer, Bambu Lab has the ability to dictate how its products can be used; often to the detriment of third-party developers and users.
== Community-driven workarounds and technical alternatives ==

The 3D-printing community has begun exploring potential workarounds to restore functionality and user autonomy. These efforts focus on bypassing or mitigating the limitations imposed by the firmware update.

=== Custom firmware development ===
Discussions within the community highlight interest in developing custom firmware as an alternative to Bambu's official updates. One prominent project mentioned in forums is the development of custom firmware for the X1-series printers, such as the "X1Plus Custom Firmware"<ref name="bambulab-forum-134549/12" />. This firmware aims to:
* Restore direct network control and third-party slicer compatibility.
* Re-enable previously available features such as motion-system adjustments, temperature control, and AMS settings without requiring proprietary software.
* Provide users with greater flexibility in integrating printers with home-automation systems and workflows.

However, custom firmware development faces significant challenges, including:
* Limited documentation and proprietary hardware components, which complicate reverse-engineering efforts.
* The potential voiding of warranties and risks of bricking devices.
* Legal concerns regarding intellectual property and bypassing manufacturer-imposed restrictions.

== LAN mode and blocked internet access ==
This is a guide made by the user Tzeny15

https://www.reddit.com/r/BambuLab/comments/1i4vp5i/comment/this/

== Reverse Engineering Bambu Connect ==
{{:Reverse Engineering Bambu Connect}}

''[[Reverse_Engineering_Bambu_Connect|Read more here.]]''

== Community tools and scripts ==
In addition to firmware alternatives, some users have come up with custom scripts and software tools to interface with Bambu Lab printers indirectly. These tools often rely on:
* Reverse-engineering the URL-based commands required by Bambu Connect to enable partial functionality with third-party slicers like OrcaSlicer.
* Creating local server emulations to replicate the network API previously available before the update.

While these tools provide temporary solutions, they don't fully replace the open ecosystem that existed prior to the authorization update.

=== Re-engineering printer-control electronics ===
ChazLayyd's Bambu Lab Klipper Conversion project is currently in an incomplete stage<ref>https://github.com/ChazLayyd/Bambu-Lab-Klipper-Conversion</ref><ref>DhazLayyd's Discord Community

https://discord.gg/W6B5mBejuC</ref>. While the project was not made in response to Bambu's announcement, there has been a wave of new public interest in this specific project. ChazLayyd's documentation instructs P1S owners to non-destructively remove the old control electronics that run Bambu's proprietary software and instructs P1S owners to install off-the-shelf control components so that the existing motor connectors and other critical electronics can communicate with the newly-installed off-the-shelf control components.

=== Advocacy for open-ecosystem support ===
Community members have also organized to advocate for open-source support and rollback options. Suggestions include:
* Allowing an opt-out option for existing users who prefer local network control without cloud dependency.
** It should be pointed out that this has always been possible and past firmware updates made signing into the cloud at any point completely unnecessary. This information continues to be ignored by some.
* Providing an official API for third-party slicers under specific licensing agreements that allow secure authorized usage.<ref name="orca-slicer-issue8063" />
== Bambu corporate strategy vs maker community values==

=== Impact on professional users and print farms ===
The restrictions imposed by the new authorization system create significant operational challenges for professional users who kept their printers signed into the cloud:

* Print farms can no longer use custom automation systems to manage multiple printers
* Workflows built around third-party software have to be completely redesigned
* The requirement to manually export and import files through Bambu Connect creates additional labor
* Integration with existing business systems and workflows becomes more difficult or impossible
* Professional users with more than 20 printers report the new workflow as "an absolute nightmare"<ref>https://forum.bambulab.com/t/this-new-auth-system-will-make-me-sell-my-printers/135400/4</ref>
The solution to the above is not to sign the printer into the cloud. Keeping the printer signed in would be a security oversight in this use case on the part of the print farm.

=== Privacy and data-collection concerns ===

The shift toward mandatory use of Bambu's software ecosystem raises several privacy and data collection concerns:

* All printer operations must now pass through Bambu's cloud infrastructure when using cloud mode
* User print data, including file names and print settings, becomes visible to Bambu when cloud is used
* Camera feeds and operational data are processed through Bambu's servers while on a different network
* Users have limited visibility into how their data is collected, stored, and used in the cloud
* The system creates dependence on Bambu's cloud services availability for basic printer functionality<ref>https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643/9</ref>

While Bambu Lab maintains that cloud processing is necessary for security and functionality, community members argue this represents unnecessary data collection that could be handled locally<ref name="bambulab-forum-134549/12" />. The company's cloud infrastructure costs are significant, leading some users to speculate that future monetization of the cloud services may be planned<ref name="bambulab-forum-3643/5">https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643/5</ref>. Therefore, people should assess if their use case mandates the use of the cloud service and disable it when it doesn't.

This shift from local control to cloud-dependent operation is part of a broader trend in consumer devices, where manufacturers use security concerns to justify increased data collection and reduced customer control over devices they bought and paid for. Privacy-conscious users should operate their printers in LAN-only mode to avoid cloud connectivity.

== Customer reactions ==

Customer reactions have been overwhelmingly negative.<ref>https://forum.bambulab.com/t/bambu-studio-1-10-2-public-beta/134549/4</ref><ref>https://old.reddit.com/r/BambuLab/comments/1i2psvz/firmware_update_introducing_new_authorization/</ref> Bambu Lab has historically pushed cloud-based printer interaction while offering limited LAN mode functionality.<ref>https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643/9</ref> Many customers argue that the security issues this locked-down firmware claims to address are actually consequences of the company's cloud-based design choices rather than inherent risks of local network control<ref name="bambulab-forum-134549/12" />, which continues to infuriate users who are now told that security is the justification for a loss of freedom. As a result of the announcement of the shift, customer ratings on sites like Trustpilot rapidly dropped<ref>https://www.trustpilot.com/review/bambulab.com?sort=recency</ref>, with many reviews citing the restrictions as the reason for the bad reviews.

The shift raises privacy concerns as user print data, including file names, print settings, and camera feeds, must now pass through Bambu's cloud infrastructure.

Many community members and customers ask whether the significant costs of maintaining and deploying this cloud infrastructure might lead to future monetization of these now-mandatory services<ref name="bambulab-forum-3643/5" />, with subscriptions required for features that once worked with local access.

It should be noted, however, that so far '''no changes have been made or indicated for those not using the cloud service'''. Past firmware updates made it possible to avoid using the cloud service completely by allowing pairing the slicer via IP address and access key and doing offline firmware updates without having to sign the printer into the service, not even temporarily, keeping local functionality unchanged.

== Comparisons to similar practices by other companies ==

Bambu Lab's new authorization and authentication requirements have been compared to a number of practices by traditional printer manufacturers, such as [[HP]] or [[Epson]], who have also faced backlash around their handling of [[digital-rights management]] (DRM){{Citation needed}}. These comparisons address:
* '''Forced updates''': Firmware updates have rendered third-party ink cartridges incompatible, forcing users to purchase proprietary consumables.
* '''Restricted features''': Scanner/printer combos that will not scan if the ink is empty.
* '''Consumer backlash''': Users criticized these updates as anti-consumer, with some pursuing [[class action lawsuit|class-action lawsuits]] for deceptive practices.<ref>https://www.classaction.org/hp-printer-ink-firmware-lawsuit</ref>

Like 2D printers, Bambu Lab's update restricts functionality previously available to users and pushes them toward proprietary software and cloud-based control.

A parallel specific to the 3D-printing industry can also be drawn from the now-defunct 3D-printer manufacturer [[MakerBot]], whose shift from open-source, DIY-focused machines in 2012 to closed-source, proprietary machines (similarly to Bambu Labs), ultimately drove customers to less-expensive, open-source competitors.<ref>https://hackaday.com/2016/04/28/the-makerbot-obituary/</ref> MakerBot was also accused of asserting ownership over publicly available, open-source designs uploaded to its 3D print repository, Thingiverse.<ref>https://techcrunch.com/2014/05/28/makerbot-responds-to-critics-who-claim-it-is-stealing-community-ip/</ref> These factors contributed to MakerBot steadily losing their position and reputation as an industry leader, before getting absorbed by rival Ultimaker in 2022.

== References ==

<references/>
[[Category:Bambu Lab]]

Bambu Lab Authorization Control System

2025-01-19T23:15:19Z

Lomanic: deduplicate <ref>

[[Category:Feature Ransom]]

On January 16, 2025, the 3D-printer manufacturer [[:wikipedia:Bambu Lab|Bambu Lab]] announced that future firmwares for their 3D printers would introduce an authorization and authentication protection mechanism for their connection and control, in the name of security. Bambu has stated the following:<blockquote>''"This change is mitigating any risk of remote hacks or printer exposure issues that have happened in the past and also lower the risk of abnormal traffic or attacks."''<ref name="firmware-update-introducing-new-authorization-control-system-2">https://blog.bambulab.com/firmware-update-introducing-new-authorization-control-system-2/</ref><ref>https://all3dp.com/4/bambu-lab-limits-third-party-printer-control-with-new-security-update/</ref></blockquote>

== Controversy regarding firmware updates ==
[[File:Bambu tos screenshot.png|alt=bambu terms stating print jobs may not function properly if update is not performed to new firmware which is highly limiting. |thumb|Bambu terms regarding printer functionality & potential for disrupted print jobs if users do not update to a new firmware that radically restricts the autonomy of the owner of the printer]]

=== Potential for remote disabling of printers ===
A significant concern raised by the community revolves around the wording in Bambu Lab's [[Terms of Service]] and firmware update announcements. Critics and users argue that the phrasing leaves open the possibility for the manufacturer to remotely disable printers that are not updated to the latest firmware. Specifically, Bambu Lab's Terms of Service<ref>https://bambulab.com/en-us/policies/terms</ref> states that printers may block "new print jobs" if updates are not applied, which some users interpret as a potential pathway for forced obsolescence<ref name="firmware-update-introducing-new-authorization-control-system-2" />. The announcement, however, specifically says, "'''What happens if I never upgrade to this firmware?''' ''You may continue using an older firmware version that does not include the new security updates; however, this means the printers may miss out on important security fixes or bug patches included in newer versions.''"<ref name="firmware-update-introducing-new-authorization-control-system-2" />

While defenders of Bambu Lab point out that offline modes such as SD-card printing and LAN-only setups would remain functional, others point out that the Terms of Service do not explicitly limit this restriction to cloud-based printing. This ambiguity has led to speculation that Bambu Lab could enforce broader limitations, effectively rendering printers inoperable for users who choose not to update.<ref>https://old.reddit.com/r/BambuLab/comments/1i45iy2/bambu_lab_reserves_the_right_to_brick_your/</ref>

=== Debate over "bricking" terminology ===
The debate has also extended to the definition of "bricking." Some community members assert that if a printer is unable to accept new print jobs without an update, it effectively becomes non-functional and qualifies as being "bricked." Others counter that as long as certain offline functionalities remain (such as SD-card printing) the term does not accurately apply.<ref>https://old.reddit.com/r/BambuLab/comments/1i45iy2/bambu_lab_reserves_the_right_to_brick_your/m7sezlg/</ref>

=== Community Strategies to Deal with Risks ===
Users have discussed strategies to avoid possible disruptions, including:
* Operating printers exclusively in offline modes.
* Utilizing LAN connections or VPN setups: this requires an access key from the printer (previously, you could use your cloud credentials over LAN).
* Exploring alternative firmware or third-party scripts to restore full functionality<ref>https://old.reddit.com/r/BambuLab/comments/1i45iy2/bambu_lab_reserves_the_right_to_brick_your/m7t8i7r/</ref>.

== Bambu Lab's justification and rebuttal ==
Bambu Lab has stated that the authorization system is in place in order to protect against "remote hacks," "printer exposure," and "abnormal traffic or attacks." There are, however, several ways to mitigate these risks without the loss of user control that their system causes:

* '''The "remote hacks" that were cited as an example in the article seem to be a direct result of the 3D-printer vendor not responding properly to a reported security vulnerability in their product.<ref>[https://www.bitdefender.com/en-au/blog/hotforsecurity/someone-is-hacking-3d-printers-to-warn-owners-of-a-security-flaw?ref=blog.bambulab.com https://www.bitdefender.com/en-au/blog/hotforsecurity/someone-is-hacking-3d-printers-to-warn-owners-of-a-security-flaw]</ref> Therefore, in order to get attention, the researcher decided to infect machines and display a harmless message to spread publicity.''' Properly responding to security vulnerabilities, working to patch them quickly, and working with the security community (who would be more than happy to help secure products) would be some ways to prevent this.
* In the article cited about printer exposure, the hack was carried out largely because of user misconfiguration.<ref>[https://www.csoonline.com/article/566223/over-3700-exposed-3d-printers-open-to-remote-attackers.html?ref=blog.bambulab.com https://www.csoonline.com/article/566223/over-3700-exposed-3d-printers-open-to-remote-attackers.html]</ref> Printer exposure can be mitigated by offering more convenient ways to securely expose printers to the internet, so that users are not tempted to allow unauthenticated access over the network.
* The "abnormal traffic" can be mitigated by steps Bambu has already put in place, as detailed in their own article on the matter<ref>[https://wiki.bambulab.com/en/security-incidents-cloud-traffic?ref=blog.bambulab.com https://wiki.bambulab.com/en/security-incidents-cloud-traffic]</ref>.

== Issues with LAN mode requiring authorization ==

Bambu Lab printers have the ability to be controlled over both cloud and LAN. This allowed users to integrate their printers into private networks and maintain full control without having to rely on the manufacturer's server while also allowing cloud access. The new authorization system mandates that even LAN-based operations must go through an authentication process using Bambu Connect to retain full control.<ref name="bambu-connect">https://wiki.bambulab.com/en/software/bambu-connect</ref> Full local access is still possible and unchanged for those not using the cloud.

This change has drawn criticism for many reasons:
* '''Privacy concerns''': Requiring authentication for LAN mode raises concerns about data being unnecessarily exposed to Bambu Lab's servers, even for local-only operations, though previously, the printer was also connected and could be controlled by the cloud even when sending prints locally.
** Confidentiality required by US Law - This is in conflict with those that have to comply with 18 CFR § 3a.61, 32 CFR § 117.15, 32 CFR § 2001.47, and other restrictions.
* '''Loss of offline independence while also using cloud''': Before, users could have hybrid offline setups. The requirement for authentication removes this option unless users revert to older firmware versions, which Bambu does not allow people to do once they have updated to the firmware using the new scheme.
* '''Increased complexity''': The added authentication layer complicates workflows for users who built custom setups or relied on third-party integrations for LAN control while retaining cloud functionality<ref>https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643</ref>.

=== Precedents and comparisons ===
Critics have likened this potential functionality to similar cases in other industries where manufacturers remotely restrict product features. Notable examples include [[HP]]'s printer firmware updates that [[HP Instant Ink|rendered third-party ink cartridges unusable]] and Tesla's software locks on second-hand vehicles. These parallels suggest a broader trend of manufacturers [[Retroactively amended purchase|using software to control hardware capabilities post-purchase]].<ref>https://www.classaction.org/hp-printer-lawsuit</ref><ref>https://www.wired.com/story/tesla-remote-disable-used-car-features/</ref>

== Implementation Timeline and Requirements ==

The authorization system will be rolled out in phases, starting with the X1 series printers. A beta firmware (version 01.08.03.00) was released on January 17, 2025, with the full release scheduled for January 23, 2025. The P & A series printers will get similar updates at an unspecified future date.

To use printers with the new authorization system, users must update multiple pieces of software:
* Bambu Studio must be updated to version 01.10.02.64 or higher
* Bambu Handy mobile app must be updated to version 2.17.0 or higher
* The new Bambu Connect application must be installed for using third-party slicers

These software updates are mandatory for users who update their firmware. Failing to update all components simultaneously will result in certain printer controls becoming unusable. Users who choose to maintain third-party software compatibility can continue using older firmware versions, though this will not be an option for new printers, which will ship with the authorization system pre-installed.

Bambu Lab states these coordinated updates are necessary because the new authorization system fundamentally changes how the printer validates and accepts commands. The older versions of Bambu Studio and Bambu Handy lack the authentication mechanisms required to interact with printers running the new firmware. The Bambu Connect application was created specifically to provide a controlled interface for third-party software, replacing the previous direct access through network plugins<ref name="firmware-update-introducing-new-authorization-control-system-2" />.

== Impact on third-party integration and user choice ==

=== Changes to third-party access ===
The new authorization system replaces direct network API access with a more limited URL-based interface through Bambu Connect. Third-party software can only interact with the printer by sending specific URL commands to Bambu Connect<ref name="bambu-connect" />. The interface requires three parameters:

* <code>path</code>: The absolute file system path to the 3MF file (e.g., /tmp/cube.gcode.3mf)
* <code>name</code>: The name of the file (e.g., Cube)
* <code>version</code>: A fixed value of 1.0.0 for compatibility

A complete command must be formatted as:<blockquote><syntaxhighlight lang="text">
bambu-connect://import-file?path=%2Ftmp%2Fcube.gcode.3mf&name=Cube&version=1.0.0
</syntaxhighlight></blockquote>This interface only allows basic file transfer and print initiation. All other printer-control functions previously available to third-party software are now exclusive to Bambu's own applications. The path and name parameters must be URL-encoded using encodeURIComponent or equivalent functions<ref name="bambu-connect" />.

=== Reduced home-automation capabilities ===
While basic status monitoring remains available (e.g., print-progress updates in Home Assistant), the new firmware removes the ability for home-automation systems to control printer functions. Users can no longer:
* Start or stop prints remotely using Home Assistant, BTT Panda Touch,<ref name=":0">https://www.facebook.com/BIGTREETECH/posts/pfbid0SNZGxvf7NRdmyVgHf6y9yNedNbU2RrCfdT8gugTSD4AYfr5BHneNF9H1EbwyYiJEl</ref> or other third-party accessories or software interfaces
* Control printer temperatures or cooling
* Automate printer behaviors based on sensor data or events
* Access camera feeds through third-party applications<ref>https://forum.bambulab.com/t/this-new-auth-system-will-make-me-sell-my-printers/135400/9</ref>

=== Permanent nature of the update ===
Once a printer is updated to the new firmware, users cannot revert to previous versions that allows full control of the printer using LAN mode access key while signed into the cloud<ref name="firmware-update-introducing-new-authorization-control-system-2" />. The option still exists to disable the cloud service.

The manufacturer states this change is required for security, but community members note that many of the security vulnerabilities being addressed stem from Bambu's own cloud-centric design choices rather than inherent risks of local network control<ref name="bambulab-forum-134549/12">https://forum.bambulab.com/t/bambu-studio-1-10-2-public-beta/134549/12</ref>. The update forces users into using Bambu Connect middleware if they want to retain cloud functionality.

This can be characterised as a significant post-purchase reduction in functionality for existing owners who bought their printers with the understanding they could use third-party software and home-automation tools, but also only affects users actively choosing to use Bambu Cloud at the same time. The inability to revert these changes, combined with the mandatory nature of the update for new printers, is used to demonstrate how manufacturers can use software updates to unilaterally modify the capabilities of hardware products after purchase, although in this case the changes affect only people already choosing to use the cloud service<ref>https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643/9</ref>.

For users that would want to use a third-party slicer while using their cloud service, Bambu would require those users to download and install Bambu Connect in order to send gcode wirelessly over LAN or over the cloud. While Bambu claims that they were in contact with SoftFever, the developer of OrcaSlicer, as of writing, SoftFever still does not have any keys for Bambu Connect and the new firmware is only available as opt-in beta at the moment.<ref name=":1">https://x.com/fever_soft/status/1880630570809795034?t=qJyh4SGFZFllcYrqexGW-Q&s=19</ref>

== Impact on functionality ==
While some functionality remains unauthenticated like in previous firmware versions (sending status information from the printer over the network, starting a print job using SD cards), the most important features now require authentication through a new closed-source client called Bambu Connect<ref name="bambu-connect" />. These restricted features include:

* Initializing prints via LAN or cloud mode
* Remote video access to monitor prints
* Controlling motion system, temperature, fans
* AMS settings and calibrations
* Home automation integration beyond basic status monitoring

Previously, third-party software such as OrcaSlicer<ref name="orca-slicer-issue8063">https://github.com/SoftFever/OrcaSlicer/issues/8063</ref> could interact with Bambu Lab printers via the open-source Bambu Studio and proprietary network plug-ins. While Bambu Connect provides a limited URL-based API to initiate prints, most functionality previously openly available is now restricted to Bambu's ecosystem<ref>https://forum.bambulab.com/t/this-new-auth-system-will-make-me-sell-my-printers/135400/9</ref>.

Previously, third-party accessories such as Panda Touch would allow users to control their printers with a standalone device. Panda Touch was especially popular amongst P series printer owners since P series printers contain a monochromatic screen with a D-pad by default for printer control whereas Panda Touch is a full-color touch screen that had a small battery so that way users could reposition and detach their Panda Touch off their printers if needed. Users would be able to queue up jobs, jog printer motors, and connect to multiple printers at once in order to monitor print jobs. According to Big Tree Tech (BTT), the manufacturer of the Panda Touch, they urge users of Panda Touch not to update firmware any further since doing so would foreseeably permanently break compatibility with users' printers and their Panda Touch. <ref name=":0" />

== Communication with Panda Touch developers ==

As of writing, no formal communication has happened between Big Tree Tech (BTT), the manufacturer and developer of Panda Touch, and Bambu Labs. Based on their Facebook announcement, BTT stated that they have reached out to Bambu and will update if Bambu responds to their correspondence. <ref name=":0" />

== Communication with OrcaSlicer developers ==

Before the official announcement of the new authorization and authentication, Bambu Lab engaged with the OrcaSlicer development team regarding the changes. This communication has sparked significant discussion within the 3D-printing community, particularly regarding its timing, tone, and implications.

=== Pre-announcement contact ===
Reports from OrcaSlicer demonstrate that Bambu Lab provided limited advance notice of the changes that would render their software incompatible with Bambu printers running the new firmware. The communication emphasized:
* The introduction of Bambu Connect as the only supported method for interacting with third-party slicers.
* The discontinuation of the network plugin API that OrcaSlicer and other tools relied on for printer control<ref name="orca-slicer-issue8063" />.
* An invitation for OrcaSlicer developers to adapt their software to integrate with the Bambu Connect URL scheme.

The communication lacked the detailed technical documentation that would be necessary for developers to be able to work with the new requirements.

=== How the community viewed these actions ===
This approach has been interpreted by many as a calculated move by Bambu Lab to enforce tighter control over its ecosystem. Primary criticisms of Bambu were:
* '''Lack of transparency''': The limited warning to OrcaSlicer devs suggests that Bambu Lab prioritized internal rollout schedules over community engagement with existing customers. Point to the contrary: The new firmware is in beta and Bambu Connect middleware contains temporary compomises to allow third-party slicers to work as before.
* '''Lack of follow-through:''' As of writing, SoftFever, OrcaSlicer's lead developer, still does not have API keys for Bambu Connect, a necessary layer of Bambu software that would need to be integrated into OrcaSlicer. Bambu's original announcement prominently mentioned OrcaSlicer and gave the impression that Bambu is actively providing the necessary assets so that SoftFever would be able to implement the new software architecture so that OrcaSlicer users are able to still use OrcaSlicer to send gcode to their printers without needing Bambu Connect to be installed as a separate program. The lack of active cooperation does not reflect favorably upon Bambu as it seems like their announcement used OrcaSlicer's name to try to make it seem like Bambu is trying its best to make sure that developers have what they need, but in reality, their inaction seems to show that Bambu is not making a sincere attempt to ensure that OrcaSlicer remains supported. <ref name=":1" />
* '''Disregard for open-source collaboration''': OrcaSlicer is widely used in the community; it is an open-source effort to improve the 3D-printing experience for all customers. By abruptly altering the compatibility landscape, Bambu Lab is seen as undermining good-faith initiatives to improve the ecosystem for everyone. The decision to restrict network APIs in favor of proprietary systems such as Bambu Connect represents a broader industry trend of closing off ecosystems that were once open, removing customer choice, privacy, and freedom.
* '''Token support for third-party tools''': While Bambu Connect provides a workaround for third-party slicer use, it significantly restricts functionality and complicates workflows, leading many to question the sincerity of Bambu's stated support for open-source tools<ref name="bambu-connect" />.
* '''Power imbalance''': As the hardware manufacturer, Bambu Lab has the ability to dictate how its products can be used; often to the detriment of third-party developers and users.
== Community-driven workarounds and technical alternatives ==

The 3D-printing community has begun exploring potential workarounds to restore functionality and user autonomy. These efforts focus on bypassing or mitigating the limitations imposed by the firmware update.

=== Custom firmware development ===
Discussions within the community highlight interest in developing custom firmware as an alternative to Bambu's official updates. One prominent project mentioned in forums is the development of custom firmware for the X1-series printers, such as the "X1Plus Custom Firmware"<ref name="bambulab-forum-134549/12" />. This firmware aims to:
* Restore direct network control and third-party slicer compatibility.
* Re-enable previously available features such as motion-system adjustments, temperature control, and AMS settings without requiring proprietary software.
* Provide users with greater flexibility in integrating printers with home-automation systems and workflows.

However, custom firmware development faces significant challenges, including:
* Limited documentation and proprietary hardware components, which complicate reverse-engineering efforts.
* The potential voiding of warranties and risks of bricking devices.
* Legal concerns regarding intellectual property and bypassing manufacturer-imposed restrictions.

== LAN mode and blocked internet access ==
This is a guide made by the user Tzeny15

https://www.reddit.com/r/BambuLab/comments/1i4vp5i/comment/this/

== Reverse Engineering Bambu Connect ==
{{:Reverse Engineering Bambu Connect}}

''[[Reverse_Engineering_Bambu_Connect|Read more here.]]''

== Community tools and scripts ==
In addition to firmware alternatives, some users have come up with custom scripts and software tools to interface with Bambu Lab printers indirectly. These tools often rely on:
* Reverse-engineering the URL-based commands required by Bambu Connect to enable partial functionality with third-party slicers like OrcaSlicer.
* Creating local server emulations to replicate the network API previously available before the update.

While these tools provide temporary solutions, they don't fully replace the open ecosystem that existed prior to the authorization update.

=== Re-engineering printer-control electronics ===
ChazLayyd's Bambu Lab Klipper Conversion project is currently in an incomplete stage<ref>https://github.com/ChazLayyd/Bambu-Lab-Klipper-Conversion</ref><ref>DhazLayyd's Discord Community

https://discord.gg/W6B5mBejuC</ref>. While the project was not made in response to Bambu's announcement, there has been a wave of new public interest in this specific project. ChazLayyd's documentation instructs P1S owners to non-destructively remove the old control electronics that run Bambu's proprietary software and instructs P1S owners to install off-the-shelf control components so that the existing motor connectors and other critical electronics can communicate with the newly-installed off-the-shelf control components.

=== Advocacy for open-ecosystem support ===
Community members have also organized to advocate for open-source support and rollback options. Suggestions include:
* Allowing an opt-out option for existing users who prefer local network control without cloud dependency.
** It should be pointed out that this has always been possible and past firmware updates made signing into the cloud at any point completely unnecessary. This information continues to be ignored by some.
* Providing an official API for third-party slicers under specific licensing agreements that allow secure authorized usage.<ref name="orca-slicer-issue8063" />
== Bambu corporate strategy vs maker community values==

=== Impact on professional users and print farms ===
The restrictions imposed by the new authorization system create significant operational challenges for professional users who kept their printers signed into the cloud:

* Print farms can no longer use custom automation systems to manage multiple printers
* Workflows built around third-party software have to be completely redesigned
* The requirement to manually export and import files through Bambu Connect creates additional labor
* Integration with existing business systems and workflows becomes more difficult or impossible
* Professional users with more than 20 printers report the new workflow as "an absolute nightmare"<ref>https://forum.bambulab.com/t/this-new-auth-system-will-make-me-sell-my-printers/135400/4</ref>
The solution to the above is not to sign the printer into the cloud. Keeping the printer signed in would be a security oversight in this use case on the part of the print farm.

=== Privacy and data-collection concerns ===

The shift toward mandatory use of Bambu's software ecosystem raises several privacy and data collection concerns:

* All printer operations must now pass through Bambu's cloud infrastructure when using cloud mode
* User print data, including file names and print settings, becomes visible to Bambu when cloud is used
* Camera feeds and operational data are processed through Bambu's servers while on a different network
* Users have limited visibility into how their data is collected, stored, and used in the cloud
* The system creates dependence on Bambu's cloud services availability for basic printer functionality<ref>https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643/9</ref>

While Bambu Lab maintains that cloud processing is necessary for security and functionality, community members argue this represents unnecessary data collection that could be handled locally<ref name="bambulab-forum-134549/12" />. The company's cloud infrastructure costs are significant, leading some users to speculate that future monetization of the cloud services may be planned.<ref>https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643/5</ref> Therefore, people should assess if their use case mandates the use of the cloud service and disable it when it doesn't.

This shift from local control to cloud-dependent operation is part of a broader trend in consumer devices, where manufacturers use security concerns to justify increased data collection and reduced customer control over devices they bought and paid for. Privacy-conscious users should operate their printers in LAN-only mode to avoid cloud connectivity.

== Customer reactions ==

Customer reactions have been overwhelmingly negative.<ref>https://forum.bambulab.com/t/bambu-studio-1-10-2-public-beta/134549/4</ref><ref>https://old.reddit.com/r/BambuLab/comments/1i2psvz/firmware_update_introducing_new_authorization/</ref> Bambu Lab has historically pushed cloud-based printer interaction while offering limited LAN mode functionality.<ref>https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643/9</ref> Many customers argue that the security issues this locked-down firmware claims to address are actually consequences of the company's cloud-based design choices rather than inherent risks of local network control<ref name="bambulab-forum-134549/12" />, which continues to infuriate users who are now told that security is the justification for a loss of freedom. As a result of the announcement of the shift, customer ratings on sites like Trustpilot rapidly dropped<ref>https://www.trustpilot.com/review/bambulab.com?sort=recency</ref>, with many reviews citing the restrictions as the reason for the bad reviews.

The shift raises privacy concerns as user print data, including file names, print settings, and camera feeds, must now pass through Bambu's cloud infrastructure.

Many community members and customers ask whether the significant costs of maintaining and deploying this cloud infrastructure might lead to future monetization of these now-mandatory services,<ref>https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643/5</ref> with subscriptions required for features that once worked with local access.

It should be noted, however, that so far '''no changes have been made or indicated for those not using the cloud service'''. Past firmware updates made it possible to avoid using the cloud service completely by allowing pairing the slicer via IP address and access key and doing offline firmware updates without having to sign the printer into the service, not even temporarily, keeping local functionality unchanged.

== Comparisons to similar practices by other companies ==

Bambu Lab's new authorization and authentication requirements have been compared to a number of practices by traditional printer manufacturers, such as [[HP]] or [[Epson]], who have also faced backlash around their handling of [[digital-rights management]] (DRM){{Citation needed}}. These comparisons address:
* '''Forced updates''': Firmware updates have rendered third-party ink cartridges incompatible, forcing users to purchase proprietary consumables.
* '''Restricted features''': Scanner/printer combos that will not scan if the ink is empty.
* '''Consumer backlash''': Users criticized these updates as anti-consumer, with some pursuing [[class action lawsuit|class-action lawsuits]] for deceptive practices.<ref>https://www.classaction.org/hp-printer-ink-firmware-lawsuit</ref>

Like 2D printers, Bambu Lab's update restricts functionality previously available to users and pushes them toward proprietary software and cloud-based control.

A parallel specific to the 3D-printing industry can also be drawn from the now-defunct 3D-printer manufacturer [[MakerBot]], whose shift from open-source, DIY-focused machines in 2012 to closed-source, proprietary machines (similarly to Bambu Labs), ultimately drove customers to less-expensive, open-source competitors.<ref>https://hackaday.com/2016/04/28/the-makerbot-obituary/</ref> MakerBot was also accused of asserting ownership over publicly available, open-source designs uploaded to its 3D print repository, Thingiverse.<ref>https://techcrunch.com/2014/05/28/makerbot-responds-to-critics-who-claim-it-is-stealing-community-ip/</ref> These factors contributed to MakerBot steadily losing their position and reputation as an industry leader, before getting absorbed by rival Ultimaker in 2022.

== References ==

<references/>
[[Category:Bambu Lab]]

Bambu Lab Authorization Control System

2025-01-19T23:11:22Z

Lomanic: deduplicate <ref>

[[Category:Feature Ransom]]

On January 16, 2025, the 3D-printer manufacturer [[:wikipedia:Bambu Lab|Bambu Lab]] announced that future firmwares for their 3D printers would introduce an authorization and authentication protection mechanism for their connection and control, in the name of security. Bambu has stated the following:<blockquote>''"This change is mitigating any risk of remote hacks or printer exposure issues that have happened in the past and also lower the risk of abnormal traffic or attacks."''<ref name="firmware-update-introducing-new-authorization-control-system-2">https://blog.bambulab.com/firmware-update-introducing-new-authorization-control-system-2/</ref><ref>https://all3dp.com/4/bambu-lab-limits-third-party-printer-control-with-new-security-update/</ref></blockquote>

== Controversy regarding firmware updates ==
[[File:Bambu tos screenshot.png|alt=bambu terms stating print jobs may not function properly if update is not performed to new firmware which is highly limiting. |thumb|Bambu terms regarding printer functionality & potential for disrupted print jobs if users do not update to a new firmware that radically restricts the autonomy of the owner of the printer]]

=== Potential for remote disabling of printers ===
A significant concern raised by the community revolves around the wording in Bambu Lab's [[Terms of Service]] and firmware update announcements. Critics and users argue that the phrasing leaves open the possibility for the manufacturer to remotely disable printers that are not updated to the latest firmware. Specifically, Bambu Lab's Terms of Service<ref>https://bambulab.com/en-us/policies/terms</ref> states that printers may block "new print jobs" if updates are not applied, which some users interpret as a potential pathway for forced obsolescence<ref name="firmware-update-introducing-new-authorization-control-system-2" />. The announcement, however, specifically says, "'''What happens if I never upgrade to this firmware?''' ''You may continue using an older firmware version that does not include the new security updates; however, this means the printers may miss out on important security fixes or bug patches included in newer versions.''"<ref name="firmware-update-introducing-new-authorization-control-system-2" />

While defenders of Bambu Lab point out that offline modes such as SD-card printing and LAN-only setups would remain functional, others point out that the Terms of Service do not explicitly limit this restriction to cloud-based printing. This ambiguity has led to speculation that Bambu Lab could enforce broader limitations, effectively rendering printers inoperable for users who choose not to update.<ref>https://old.reddit.com/r/BambuLab/comments/1i45iy2/bambu_lab_reserves_the_right_to_brick_your/</ref>

=== Debate over "bricking" terminology ===
The debate has also extended to the definition of "bricking." Some community members assert that if a printer is unable to accept new print jobs without an update, it effectively becomes non-functional and qualifies as being "bricked." Others counter that as long as certain offline functionalities remain (such as SD-card printing) the term does not accurately apply.<ref>https://old.reddit.com/r/BambuLab/comments/1i45iy2/bambu_lab_reserves_the_right_to_brick_your/m7sezlg/</ref>

=== Community Strategies to Deal with Risks ===
Users have discussed strategies to avoid possible disruptions, including:
* Operating printers exclusively in offline modes.
* Utilizing LAN connections or VPN setups: this requires an access key from the printer (previously, you could use your cloud credentials over LAN).
* Exploring alternative firmware or third-party scripts to restore full functionality<ref>https://old.reddit.com/r/BambuLab/comments/1i45iy2/bambu_lab_reserves_the_right_to_brick_your/m7t8i7r/</ref>.

== Bambu Lab's justification and rebuttal ==
Bambu Lab has stated that the authorization system is in place in order to protect against "remote hacks," "printer exposure," and "abnormal traffic or attacks." There are, however, several ways to mitigate these risks without the loss of user control that their system causes:

* '''The "remote hacks" that were cited as an example in the article seem to be a direct result of the 3D-printer vendor not responding properly to a reported security vulnerability in their product.<ref>[https://www.bitdefender.com/en-au/blog/hotforsecurity/someone-is-hacking-3d-printers-to-warn-owners-of-a-security-flaw?ref=blog.bambulab.com https://www.bitdefender.com/en-au/blog/hotforsecurity/someone-is-hacking-3d-printers-to-warn-owners-of-a-security-flaw]</ref> Therefore, in order to get attention, the researcher decided to infect machines and display a harmless message to spread publicity.''' Properly responding to security vulnerabilities, working to patch them quickly, and working with the security community (who would be more than happy to help secure products) would be some ways to prevent this.
* In the article cited about printer exposure, the hack was carried out largely because of user misconfiguration.<ref>[https://www.csoonline.com/article/566223/over-3700-exposed-3d-printers-open-to-remote-attackers.html?ref=blog.bambulab.com https://www.csoonline.com/article/566223/over-3700-exposed-3d-printers-open-to-remote-attackers.html]</ref> Printer exposure can be mitigated by offering more convenient ways to securely expose printers to the internet, so that users are not tempted to allow unauthenticated access over the network.
* The "abnormal traffic" can be mitigated by steps Bambu has already put in place, as detailed in their own article on the matter<ref>[https://wiki.bambulab.com/en/security-incidents-cloud-traffic?ref=blog.bambulab.com https://wiki.bambulab.com/en/security-incidents-cloud-traffic]</ref>.

== Issues with LAN mode requiring authorization ==

Bambu Lab printers have the ability to be controlled over both cloud and LAN. This allowed users to integrate their printers into private networks and maintain full control without having to rely on the manufacturer's server while also allowing cloud access. The new authorization system mandates that even LAN-based operations must go through an authentication process using Bambu Connect to retain full control.<ref name="bambu-connect">https://wiki.bambulab.com/en/software/bambu-connect</ref> Full local access is still possible and unchanged for those not using the cloud.

This change has drawn criticism for many reasons:
* '''Privacy concerns''': Requiring authentication for LAN mode raises concerns about data being unnecessarily exposed to Bambu Lab's servers, even for local-only operations, though previously, the printer was also connected and could be controlled by the cloud even when sending prints locally.
** Confidentiality required by US Law - This is in conflict with those that have to comply with 18 CFR § 3a.61, 32 CFR § 117.15, 32 CFR § 2001.47, and other restrictions.
* '''Loss of offline independence while also using cloud''': Before, users could have hybrid offline setups. The requirement for authentication removes this option unless users revert to older firmware versions, which Bambu does not allow people to do once they have updated to the firmware using the new scheme.
* '''Increased complexity''': The added authentication layer complicates workflows for users who built custom setups or relied on third-party integrations for LAN control while retaining cloud functionality<ref>https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643</ref>.

=== Precedents and comparisons ===
Critics have likened this potential functionality to similar cases in other industries where manufacturers remotely restrict product features. Notable examples include [[HP]]'s printer firmware updates that [[HP Instant Ink|rendered third-party ink cartridges unusable]] and Tesla's software locks on second-hand vehicles. These parallels suggest a broader trend of manufacturers [[Retroactively amended purchase|using software to control hardware capabilities post-purchase]].<ref>https://www.classaction.org/hp-printer-lawsuit</ref><ref>https://www.wired.com/story/tesla-remote-disable-used-car-features/</ref>

== Implementation Timeline and Requirements ==

The authorization system will be rolled out in phases, starting with the X1 series printers. A beta firmware (version 01.08.03.00) was released on January 17, 2025, with the full release scheduled for January 23, 2025. The P & A series printers will get similar updates at an unspecified future date.

To use printers with the new authorization system, users must update multiple pieces of software:
* Bambu Studio must be updated to version 01.10.02.64 or higher
* Bambu Handy mobile app must be updated to version 2.17.0 or higher
* The new Bambu Connect application must be installed for using third-party slicers

These software updates are mandatory for users who update their firmware. Failing to update all components simultaneously will result in certain printer controls becoming unusable. Users who choose to maintain third-party software compatibility can continue using older firmware versions, though this will not be an option for new printers, which will ship with the authorization system pre-installed.

Bambu Lab states these coordinated updates are necessary because the new authorization system fundamentally changes how the printer validates and accepts commands. The older versions of Bambu Studio and Bambu Handy lack the authentication mechanisms required to interact with printers running the new firmware. The Bambu Connect application was created specifically to provide a controlled interface for third-party software, replacing the previous direct access through network plugins<ref name="firmware-update-introducing-new-authorization-control-system-2" />.

== Impact on third-party integration and user choice ==

=== Changes to third-party access ===
The new authorization system replaces direct network API access with a more limited URL-based interface through Bambu Connect. Third-party software can only interact with the printer by sending specific URL commands to Bambu Connect<ref name="bambu-connect" />. The interface requires three parameters:

* <code>path</code>: The absolute file system path to the 3MF file (e.g., /tmp/cube.gcode.3mf)
* <code>name</code>: The name of the file (e.g., Cube)
* <code>version</code>: A fixed value of 1.0.0 for compatibility

A complete command must be formatted as:<blockquote><syntaxhighlight lang="text">
bambu-connect://import-file?path=%2Ftmp%2Fcube.gcode.3mf&name=Cube&version=1.0.0
</syntaxhighlight></blockquote>This interface only allows basic file transfer and print initiation. All other printer-control functions previously available to third-party software are now exclusive to Bambu's own applications. The path and name parameters must be URL-encoded using encodeURIComponent or equivalent functions<ref name="bambu-connect" />.

=== Reduced home-automation capabilities ===
While basic status monitoring remains available (e.g., print-progress updates in Home Assistant), the new firmware removes the ability for home-automation systems to control printer functions. Users can no longer:
* Start or stop prints remotely using Home Assistant, BTT Panda Touch,<ref name=":0">https://www.facebook.com/BIGTREETECH/posts/pfbid0SNZGxvf7NRdmyVgHf6y9yNedNbU2RrCfdT8gugTSD4AYfr5BHneNF9H1EbwyYiJEl</ref> or other third-party accessories or software interfaces
* Control printer temperatures or cooling
* Automate printer behaviors based on sensor data or events
* Access camera feeds through third-party applications<ref>https://forum.bambulab.com/t/this-new-auth-system-will-make-me-sell-my-printers/135400/9</ref>

=== Permanent nature of the update ===
Once a printer is updated to the new firmware, users cannot revert to previous versions that allows full control of the printer using LAN mode access key while signed into the cloud<ref name="firmware-update-introducing-new-authorization-control-system-2" />. The option still exists to disable the cloud service.

The manufacturer states this change is required for security, but community members note that many of the security vulnerabilities being addressed stem from Bambu's own cloud-centric design choices rather than inherent risks of local network control<ref>https://forum.bambulab.com/t/bambu-studio-1-10-2-public-beta/134549/12</ref>. The update forces users into using Bambu Connect middleware if they want to retain cloud functionality.

This can be characterised as a significant post-purchase reduction in functionality for existing owners who bought their printers with the understanding they could use third-party software and home-automation tools, but also only affects users actively choosing to use Bambu Cloud at the same time. The inability to revert these changes, combined with the mandatory nature of the update for new printers, is used to demonstrate how manufacturers can use software updates to unilaterally modify the capabilities of hardware products after purchase, although in this case the changes affect only people already choosing to use the cloud service<ref>https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643/9</ref>.

For users that would want to use a third-party slicer while using their cloud service, Bambu would require those users to download and install Bambu Connect in order to send gcode wirelessly over LAN or over the cloud. While Bambu claims that they were in contact with SoftFever, the developer of OrcaSlicer, as of writing, SoftFever still does not have any keys for Bambu Connect and the new firmware is only available as opt-in beta at the moment.<ref name=":1">https://x.com/fever_soft/status/1880630570809795034?t=qJyh4SGFZFllcYrqexGW-Q&s=19</ref>

== Impact on functionality ==
While some functionality remains unauthenticated like in previous firmware versions (sending status information from the printer over the network, starting a print job using SD cards), the most important features now require authentication through a new closed-source client called Bambu Connect<ref name="bambu-connect" />. These restricted features include:

* Initializing prints via LAN or cloud mode
* Remote video access to monitor prints
* Controlling motion system, temperature, fans
* AMS settings and calibrations
* Home automation integration beyond basic status monitoring

Previously, third-party software such as OrcaSlicer<ref name="orca-slicer-issue8063">https://github.com/SoftFever/OrcaSlicer/issues/8063</ref> could interact with Bambu Lab printers via the open-source Bambu Studio and proprietary network plug-ins. While Bambu Connect provides a limited URL-based API to initiate prints, most functionality previously openly available is now restricted to Bambu's ecosystem<ref>https://forum.bambulab.com/t/this-new-auth-system-will-make-me-sell-my-printers/135400/9</ref>.

Previously, third-party accessories such as Panda Touch would allow users to control their printers with a standalone device. Panda Touch was especially popular amongst P series printer owners since P series printers contain a monochromatic screen with a D-pad by default for printer control whereas Panda Touch is a full-color touch screen that had a small battery so that way users could reposition and detach their Panda Touch off their printers if needed. Users would be able to queue up jobs, jog printer motors, and connect to multiple printers at once in order to monitor print jobs. According to Big Tree Tech (BTT), the manufacturer of the Panda Touch, they urge users of Panda Touch not to update firmware any further since doing so would foreseeably permanently break compatibility with users' printers and their Panda Touch. <ref name=":0" />

== Communication with Panda Touch developers ==

As of writing, no formal communication has happened between Big Tree Tech (BTT), the manufacturer and developer of Panda Touch, and Bambu Labs. Based on their Facebook announcement, BTT stated that they have reached out to Bambu and will update if Bambu responds to their correspondence. <ref name=":0" />

== Communication with OrcaSlicer developers ==

Before the official announcement of the new authorization and authentication, Bambu Lab engaged with the OrcaSlicer development team regarding the changes. This communication has sparked significant discussion within the 3D-printing community, particularly regarding its timing, tone, and implications.

=== Pre-announcement contact ===
Reports from OrcaSlicer demonstrate that Bambu Lab provided limited advance notice of the changes that would render their software incompatible with Bambu printers running the new firmware. The communication emphasized:
* The introduction of Bambu Connect as the only supported method for interacting with third-party slicers.
* The discontinuation of the network plugin API that OrcaSlicer and other tools relied on for printer control<ref name="orca-slicer-issue8063" />.
* An invitation for OrcaSlicer developers to adapt their software to integrate with the Bambu Connect URL scheme.

The communication lacked the detailed technical documentation that would be necessary for developers to be able to work with the new requirements.

=== How the community viewed these actions ===
This approach has been interpreted by many as a calculated move by Bambu Lab to enforce tighter control over its ecosystem. Primary criticisms of Bambu were:
* '''Lack of transparency''': The limited warning to OrcaSlicer devs suggests that Bambu Lab prioritized internal rollout schedules over community engagement with existing customers. Point to the contrary: The new firmware is in beta and Bambu Connect middleware contains temporary compomises to allow third-party slicers to work as before.
* '''Lack of follow-through:''' As of writing, SoftFever, OrcaSlicer's lead developer, still does not have API keys for Bambu Connect, a necessary layer of Bambu software that would need to be integrated into OrcaSlicer. Bambu's original announcement prominently mentioned OrcaSlicer and gave the impression that Bambu is actively providing the necessary assets so that SoftFever would be able to implement the new software architecture so that OrcaSlicer users are able to still use OrcaSlicer to send gcode to their printers without needing Bambu Connect to be installed as a separate program. The lack of active cooperation does not reflect favorably upon Bambu as it seems like their announcement used OrcaSlicer's name to try to make it seem like Bambu is trying its best to make sure that developers have what they need, but in reality, their inaction seems to show that Bambu is not making a sincere attempt to ensure that OrcaSlicer remains supported. <ref name=":1" />
* '''Disregard for open-source collaboration''': OrcaSlicer is widely used in the community; it is an open-source effort to improve the 3D-printing experience for all customers. By abruptly altering the compatibility landscape, Bambu Lab is seen as undermining good-faith initiatives to improve the ecosystem for everyone. The decision to restrict network APIs in favor of proprietary systems such as Bambu Connect represents a broader industry trend of closing off ecosystems that were once open, removing customer choice, privacy, and freedom.
* '''Token support for third-party tools''': While Bambu Connect provides a workaround for third-party slicer use, it significantly restricts functionality and complicates workflows, leading many to question the sincerity of Bambu's stated support for open-source tools<ref name="bambu-connect" />.
* '''Power imbalance''': As the hardware manufacturer, Bambu Lab has the ability to dictate how its products can be used; often to the detriment of third-party developers and users.
== Community-driven workarounds and technical alternatives ==

The 3D-printing community has begun exploring potential workarounds to restore functionality and user autonomy. These efforts focus on bypassing or mitigating the limitations imposed by the firmware update.

=== Custom firmware development ===
Discussions within the community highlight interest in developing custom firmware as an alternative to Bambu's official updates. One prominent project mentioned in forums is the development of custom firmware for the X1-series printers, such as the "X1Plus Custom Firmware."<ref>https://forum.bambulab.com/t/bambu-studio-1-10-2-public-beta/134549/12</ref> This firmware aims to:
* Restore direct network control and third-party slicer compatibility.
* Re-enable previously available features such as motion-system adjustments, temperature control, and AMS settings without requiring proprietary software.
* Provide users with greater flexibility in integrating printers with home-automation systems and workflows.

However, custom firmware development faces significant challenges, including:
* Limited documentation and proprietary hardware components, which complicate reverse-engineering efforts.
* The potential voiding of warranties and risks of bricking devices.
* Legal concerns regarding intellectual property and bypassing manufacturer-imposed restrictions.

== LAN mode and blocked internet access ==
This is a guide made by the user Tzeny15

https://www.reddit.com/r/BambuLab/comments/1i4vp5i/comment/this/

== Reverse Engineering Bambu Connect ==
{{:Reverse Engineering Bambu Connect}}

''[[Reverse_Engineering_Bambu_Connect|Read more here.]]''

== Community tools and scripts ==
In addition to firmware alternatives, some users have come up with custom scripts and software tools to interface with Bambu Lab printers indirectly. These tools often rely on:
* Reverse-engineering the URL-based commands required by Bambu Connect to enable partial functionality with third-party slicers like OrcaSlicer.
* Creating local server emulations to replicate the network API previously available before the update.

While these tools provide temporary solutions, they don't fully replace the open ecosystem that existed prior to the authorization update.

=== Re-engineering printer-control electronics ===
ChazLayyd's Bambu Lab Klipper Conversion project is currently in an incomplete stage<ref>https://github.com/ChazLayyd/Bambu-Lab-Klipper-Conversion</ref><ref>DhazLayyd's Discord Community

https://discord.gg/W6B5mBejuC</ref>. While the project was not made in response to Bambu's announcement, there has been a wave of new public interest in this specific project. ChazLayyd's documentation instructs P1S owners to non-destructively remove the old control electronics that run Bambu's proprietary software and instructs P1S owners to install off-the-shelf control components so that the existing motor connectors and other critical electronics can communicate with the newly-installed off-the-shelf control components.

=== Advocacy for open-ecosystem support ===
Community members have also organized to advocate for open-source support and rollback options. Suggestions include:
* Allowing an opt-out option for existing users who prefer local network control without cloud dependency.
** It should be pointed out that this has always been possible and past firmware updates made signing into the cloud at any point completely unnecessary. This information continues to be ignored by some.
* Providing an official API for third-party slicers under specific licensing agreements that allow secure authorized usage.<ref name="orca-slicer-issue8063" />
== Bambu corporate strategy vs maker community values==

=== Impact on professional users and print farms ===
The restrictions imposed by the new authorization system create significant operational challenges for professional users who kept their printers signed into the cloud:

* Print farms can no longer use custom automation systems to manage multiple printers
* Workflows built around third-party software have to be completely redesigned
* The requirement to manually export and import files through Bambu Connect creates additional labor
* Integration with existing business systems and workflows becomes more difficult or impossible
* Professional users with more than 20 printers report the new workflow as "an absolute nightmare"<ref>https://forum.bambulab.com/t/this-new-auth-system-will-make-me-sell-my-printers/135400/4</ref>
The solution to the above is not to sign the printer into the cloud. Keeping the printer signed in would be a security oversight in this use case on the part of the print farm.

=== Privacy and data-collection concerns ===

The shift toward mandatory use of Bambu's software ecosystem raises several privacy and data collection concerns:

* All printer operations must now pass through Bambu's cloud infrastructure when using cloud mode
* User print data, including file names and print settings, becomes visible to Bambu when cloud is used
* Camera feeds and operational data are processed through Bambu's servers while on a different network
* Users have limited visibility into how their data is collected, stored, and used in the cloud
* The system creates dependence on Bambu's cloud services availability for basic printer functionality<ref>https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643/9</ref>

While Bambu Lab maintains that cloud processing is necessary for security and functionality, community members argue this represents unnecessary data collection that could be handled locally.<ref>https://forum.bambulab.com/t/bambu-studio-1-10-2-public-beta/134549/12</ref> The company's cloud infrastructure costs are significant, leading some users to speculate that future monetization of the cloud services may be planned.<ref>https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643/5</ref> Therefore, people should assess if their use case mandates the use of the cloud service and disable it when it doesn't.

This shift from local control to cloud-dependent operation is part of a broader trend in consumer devices, where manufacturers use security concerns to justify increased data collection and reduced customer control over devices they bought and paid for. Privacy-conscious users should operate their printers in LAN-only mode to avoid cloud connectivity.

== Customer reactions ==

Customer reactions have been overwhelmingly negative.<ref>https://forum.bambulab.com/t/bambu-studio-1-10-2-public-beta/134549/4</ref><ref>https://old.reddit.com/r/BambuLab/comments/1i2psvz/firmware_update_introducing_new_authorization/</ref> Bambu Lab has historically pushed cloud-based printer interaction while offering limited LAN mode functionality.<ref>https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643/9</ref> Many customers argue that the security issues this locked-down firmware claims to address are actually consequences of the company's cloud-based design choices rather than inherent risks of local network control,<ref>https://forum.bambulab.com/t/bambu-studio-1-10-2-public-beta/134549/12</ref> which continues to infuriate users who are now told that security is the justification for a loss of freedom. As a result of the announcement of the shift, customer ratings on sites like Trustpilot rapidly dropped,<ref>https://www.trustpilot.com/review/bambulab.com?sort=recency</ref> with many reviews citing the restrictions as the reason for the bad reviews.

The shift raises privacy concerns as user print data, including file names, print settings, and camera feeds, must now pass through Bambu's cloud infrastructure.

Many community members and customers ask whether the significant costs of maintaining and deploying this cloud infrastructure might lead to future monetization of these now-mandatory services,<ref>https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643/5</ref> with subscriptions required for features that once worked with local access.

It should be noted, however, that so far '''no changes have been made or indicated for those not using the cloud service'''. Past firmware updates made it possible to avoid using the cloud service completely by allowing pairing the slicer via IP address and access key and doing offline firmware updates without having to sign the printer into the service, not even temporarily, keeping local functionality unchanged.

== Comparisons to similar practices by other companies ==

Bambu Lab's new authorization and authentication requirements have been compared to a number of practices by traditional printer manufacturers, such as [[HP]] or [[Epson]], who have also faced backlash around their handling of [[digital-rights management]] (DRM){{Citation needed}}. These comparisons address:
* '''Forced updates''': Firmware updates have rendered third-party ink cartridges incompatible, forcing users to purchase proprietary consumables.
* '''Restricted features''': Scanner/printer combos that will not scan if the ink is empty.
* '''Consumer backlash''': Users criticized these updates as anti-consumer, with some pursuing [[class action lawsuit|class-action lawsuits]] for deceptive practices.<ref>https://www.classaction.org/hp-printer-ink-firmware-lawsuit</ref>

Like 2D printers, Bambu Lab's update restricts functionality previously available to users and pushes them toward proprietary software and cloud-based control.

A parallel specific to the 3D-printing industry can also be drawn from the now-defunct 3D-printer manufacturer [[MakerBot]], whose shift from open-source, DIY-focused machines in 2012 to closed-source, proprietary machines (similarly to Bambu Labs), ultimately drove customers to less-expensive, open-source competitors.<ref>https://hackaday.com/2016/04/28/the-makerbot-obituary/</ref> MakerBot was also accused of asserting ownership over publicly available, open-source designs uploaded to its 3D print repository, Thingiverse.<ref>https://techcrunch.com/2014/05/28/makerbot-responds-to-critics-who-claim-it-is-stealing-community-ip/</ref> These factors contributed to MakerBot steadily losing their position and reputation as an industry leader, before getting absorbed by rival Ultimaker in 2022.

== References ==

<references/>
[[Category:Bambu Lab]]

Bambu Lab Authorization Control System

2025-01-19T23:08:54Z

Lomanic: deduplicate <ref>

[[Category:Feature Ransom]]

On January 16, 2025, the 3D-printer manufacturer [[:wikipedia:Bambu Lab|Bambu Lab]] announced that future firmwares for their 3D printers would introduce an authorization and authentication protection mechanism for their connection and control, in the name of security. Bambu has stated the following:<blockquote>''"This change is mitigating any risk of remote hacks or printer exposure issues that have happened in the past and also lower the risk of abnormal traffic or attacks."''<ref name="firmware-update-introducing-new-authorization-control-system-2">https://blog.bambulab.com/firmware-update-introducing-new-authorization-control-system-2/</ref><ref>https://all3dp.com/4/bambu-lab-limits-third-party-printer-control-with-new-security-update/</ref></blockquote>

== Controversy regarding firmware updates ==
[[File:Bambu tos screenshot.png|alt=bambu terms stating print jobs may not function properly if update is not performed to new firmware which is highly limiting. |thumb|Bambu terms regarding printer functionality & potential for disrupted print jobs if users do not update to a new firmware that radically restricts the autonomy of the owner of the printer]]

=== Potential for remote disabling of printers ===
A significant concern raised by the community revolves around the wording in Bambu Lab's [[Terms of Service]] and firmware update announcements. Critics and users argue that the phrasing leaves open the possibility for the manufacturer to remotely disable printers that are not updated to the latest firmware. Specifically, Bambu Lab's Terms of Service<ref>https://bambulab.com/en-us/policies/terms</ref> states that printers may block "new print jobs" if updates are not applied, which some users interpret as a potential pathway for forced obsolescence<ref name="firmware-update-introducing-new-authorization-control-system-2" />. The announcement, however, specifically says, "'''What happens if I never upgrade to this firmware?''' ''You may continue using an older firmware version that does not include the new security updates; however, this means the printers may miss out on important security fixes or bug patches included in newer versions.''"<ref name="firmware-update-introducing-new-authorization-control-system-2" />

While defenders of Bambu Lab point out that offline modes such as SD-card printing and LAN-only setups would remain functional, others point out that the Terms of Service do not explicitly limit this restriction to cloud-based printing. This ambiguity has led to speculation that Bambu Lab could enforce broader limitations, effectively rendering printers inoperable for users who choose not to update.<ref>https://old.reddit.com/r/BambuLab/comments/1i45iy2/bambu_lab_reserves_the_right_to_brick_your/</ref>

=== Debate over "bricking" terminology ===
The debate has also extended to the definition of "bricking." Some community members assert that if a printer is unable to accept new print jobs without an update, it effectively becomes non-functional and qualifies as being "bricked." Others counter that as long as certain offline functionalities remain (such as SD-card printing) the term does not accurately apply.<ref>https://old.reddit.com/r/BambuLab/comments/1i45iy2/bambu_lab_reserves_the_right_to_brick_your/m7sezlg/</ref>

=== Community Strategies to Deal with Risks ===
Users have discussed strategies to avoid possible disruptions, including:
* Operating printers exclusively in offline modes.
* Utilizing LAN connections or VPN setups: this requires an access key from the printer (previously, you could use your cloud credentials over LAN).
* Exploring alternative firmware or third-party scripts to restore full functionality<ref>https://old.reddit.com/r/BambuLab/comments/1i45iy2/bambu_lab_reserves_the_right_to_brick_your/m7t8i7r/</ref>.

== Bambu Lab's justification and rebuttal ==
Bambu Lab has stated that the authorization system is in place in order to protect against "remote hacks," "printer exposure," and "abnormal traffic or attacks." There are, however, several ways to mitigate these risks without the loss of user control that their system causes:

* '''The "remote hacks" that were cited as an example in the article seem to be a direct result of the 3D-printer vendor not responding properly to a reported security vulnerability in their product.<ref>[https://www.bitdefender.com/en-au/blog/hotforsecurity/someone-is-hacking-3d-printers-to-warn-owners-of-a-security-flaw?ref=blog.bambulab.com https://www.bitdefender.com/en-au/blog/hotforsecurity/someone-is-hacking-3d-printers-to-warn-owners-of-a-security-flaw]</ref> Therefore, in order to get attention, the researcher decided to infect machines and display a harmless message to spread publicity.''' Properly responding to security vulnerabilities, working to patch them quickly, and working with the security community (who would be more than happy to help secure products) would be some ways to prevent this.
* In the article cited about printer exposure, the hack was carried out largely because of user misconfiguration.<ref>[https://www.csoonline.com/article/566223/over-3700-exposed-3d-printers-open-to-remote-attackers.html?ref=blog.bambulab.com https://www.csoonline.com/article/566223/over-3700-exposed-3d-printers-open-to-remote-attackers.html]</ref> Printer exposure can be mitigated by offering more convenient ways to securely expose printers to the internet, so that users are not tempted to allow unauthenticated access over the network.
* The "abnormal traffic" can be mitigated by steps Bambu has already put in place, as detailed in their own article on the matter<ref>[https://wiki.bambulab.com/en/security-incidents-cloud-traffic?ref=blog.bambulab.com https://wiki.bambulab.com/en/security-incidents-cloud-traffic]</ref>.

== Issues with LAN mode requiring authorization ==

Bambu Lab printers have the ability to be controlled over both cloud and LAN. This allowed users to integrate their printers into private networks and maintain full control without having to rely on the manufacturer's server while also allowing cloud access. The new authorization system mandates that even LAN-based operations must go through an authentication process using Bambu Connect to retain full control.<ref name="bambu-connect">https://wiki.bambulab.com/en/software/bambu-connect</ref> Full local access is still possible and unchanged for those not using the cloud.

This change has drawn criticism for many reasons:
* '''Privacy concerns''': Requiring authentication for LAN mode raises concerns about data being unnecessarily exposed to Bambu Lab's servers, even for local-only operations, though previously, the printer was also connected and could be controlled by the cloud even when sending prints locally.
** Confidentiality required by US Law - This is in conflict with those that have to comply with 18 CFR § 3a.61, 32 CFR § 117.15, 32 CFR § 2001.47, and other restrictions.
* '''Loss of offline independence while also using cloud''': Before, users could have hybrid offline setups. The requirement for authentication removes this option unless users revert to older firmware versions, which Bambu does not allow people to do once they have updated to the firmware using the new scheme.
* '''Increased complexity''': The added authentication layer complicates workflows for users who built custom setups or relied on third-party integrations for LAN control while retaining cloud functionality<ref>https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643</ref>.

=== Precedents and comparisons ===
Critics have likened this potential functionality to similar cases in other industries where manufacturers remotely restrict product features. Notable examples include [[HP]]'s printer firmware updates that [[HP Instant Ink|rendered third-party ink cartridges unusable]] and Tesla's software locks on second-hand vehicles. These parallels suggest a broader trend of manufacturers [[Retroactively amended purchase|using software to control hardware capabilities post-purchase]].<ref>https://www.classaction.org/hp-printer-lawsuit</ref><ref>https://www.wired.com/story/tesla-remote-disable-used-car-features/</ref>

== Implementation Timeline and Requirements ==

The authorization system will be rolled out in phases, starting with the X1 series printers. A beta firmware (version 01.08.03.00) was released on January 17, 2025, with the full release scheduled for January 23, 2025. The P & A series printers will get similar updates at an unspecified future date.

To use printers with the new authorization system, users must update multiple pieces of software:
* Bambu Studio must be updated to version 01.10.02.64 or higher
* Bambu Handy mobile app must be updated to version 2.17.0 or higher
* The new Bambu Connect application must be installed for using third-party slicers

These software updates are mandatory for users who update their firmware. Failing to update all components simultaneously will result in certain printer controls becoming unusable. Users who choose to maintain third-party software compatibility can continue using older firmware versions, though this will not be an option for new printers, which will ship with the authorization system pre-installed.

Bambu Lab states these coordinated updates are necessary because the new authorization system fundamentally changes how the printer validates and accepts commands. The older versions of Bambu Studio and Bambu Handy lack the authentication mechanisms required to interact with printers running the new firmware. The Bambu Connect application was created specifically to provide a controlled interface for third-party software, replacing the previous direct access through network plugins<ref name="firmware-update-introducing-new-authorization-control-system-2" />.

== Impact on third-party integration and user choice ==

=== Changes to third-party access ===
The new authorization system replaces direct network API access with a more limited URL-based interface through Bambu Connect. Third-party software can only interact with the printer by sending specific URL commands to Bambu Connect<ref name="bambu-connect" />. The interface requires three parameters:

* <code>path</code>: The absolute file system path to the 3MF file (e.g., /tmp/cube.gcode.3mf)
* <code>name</code>: The name of the file (e.g., Cube)
* <code>version</code>: A fixed value of 1.0.0 for compatibility

A complete command must be formatted as:<blockquote><syntaxhighlight lang="text">
bambu-connect://import-file?path=%2Ftmp%2Fcube.gcode.3mf&name=Cube&version=1.0.0
</syntaxhighlight></blockquote>This interface only allows basic file transfer and print initiation. All other printer-control functions previously available to third-party software are now exclusive to Bambu's own applications. The path and name parameters must be URL-encoded using encodeURIComponent or equivalent functions<ref name="bambu-connect" />.

=== Reduced home-automation capabilities ===
While basic status monitoring remains available (e.g., print-progress updates in Home Assistant), the new firmware removes the ability for home-automation systems to control printer functions. Users can no longer:
* Start or stop prints remotely using Home Assistant, BTT Panda Touch,<ref name=":0">https://www.facebook.com/BIGTREETECH/posts/pfbid0SNZGxvf7NRdmyVgHf6y9yNedNbU2RrCfdT8gugTSD4AYfr5BHneNF9H1EbwyYiJEl</ref> or other third-party accessories or software interfaces
* Control printer temperatures or cooling
* Automate printer behaviors based on sensor data or events
* Access camera feeds through third-party applications<ref>https://forum.bambulab.com/t/this-new-auth-system-will-make-me-sell-my-printers/135400/9</ref>

=== Permanent nature of the update ===
Once a printer is updated to the new firmware, users cannot revert to previous versions that allows full control of the printer using LAN mode access key while signed into the cloud<ref name="firmware-update-introducing-new-authorization-control-system-2" />. The option still exists to disable the cloud service.

The manufacturer states this change is required for security, but community members note that many of the security vulnerabilities being addressed stem from Bambu's own cloud-centric design choices rather than inherent risks of local network control<ref>https://forum.bambulab.com/t/bambu-studio-1-10-2-public-beta/134549/12</ref>. The update forces users into using Bambu Connect middleware if they want to retain cloud functionality.

This can be characterised as a significant post-purchase reduction in functionality for existing owners who bought their printers with the understanding they could use third-party software and home-automation tools, but also only affects users actively choosing to use Bambu Cloud at the same time. The inability to revert these changes, combined with the mandatory nature of the update for new printers, is used to demonstrate how manufacturers can use software updates to unilaterally modify the capabilities of hardware products after purchase, although in this case the changes affect only people already choosing to use the cloud service<ref>https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643/9</ref>.

For users that would want to use a third-party slicer while using their cloud service, Bambu would require those users to download and install Bambu Connect in order to send gcode wirelessly over LAN or over the cloud. While Bambu claims that they were in contact with SoftFever, the developer of OrcaSlicer, as of writing, SoftFever still does not have any keys for Bambu Connect and the new firmware is only available as opt-in beta at the moment.<ref name=":1">https://x.com/fever_soft/status/1880630570809795034?t=qJyh4SGFZFllcYrqexGW-Q&s=19</ref>

== Impact on functionality ==
While some functionality remains unauthenticated like in previous firmware versions (sending status information from the printer over the network, starting a print job using SD cards), the most important features now require authentication through a new closed-source client called Bambu Connect<ref name="bambu-connect" />. These restricted features include:

* Initializing prints via LAN or cloud mode
* Remote video access to monitor prints
* Controlling motion system, temperature, fans
* AMS settings and calibrations
* Home automation integration beyond basic status monitoring

Previously, third-party software such as OrcaSlicer<ref>https://github.com/SoftFever/OrcaSlicer/issues/8063</ref> could interact with Bambu Lab printers via the open-source Bambu Studio and proprietary network plug-ins. While Bambu Connect provides a limited URL-based API to initiate prints, most functionality previously openly available is now restricted to Bambu's ecosystem<ref>https://forum.bambulab.com/t/this-new-auth-system-will-make-me-sell-my-printers/135400/9</ref>.

Previously, third-party accessories such as Panda Touch would allow users to control their printers with a standalone device. Panda Touch was especially popular amongst P series printer owners since P series printers contain a monochromatic screen with a D-pad by default for printer control whereas Panda Touch is a full-color touch screen that had a small battery so that way users could reposition and detach their Panda Touch off their printers if needed. Users would be able to queue up jobs, jog printer motors, and connect to multiple printers at once in order to monitor print jobs. According to Big Tree Tech (BTT), the manufacturer of the Panda Touch, they urge users of Panda Touch not to update firmware any further since doing so would foreseeably permanently break compatibility with users' printers and their Panda Touch. <ref name=":0" />

== Communication with Panda Touch developers ==

As of writing, no formal communication has happened between Big Tree Tech (BTT), the manufacturer and developer of Panda Touch, and Bambu Labs. Based on their Facebook announcement, BTT stated that they have reached out to Bambu and will update if Bambu responds to their correspondence. <ref name=":0" />

== Communication with OrcaSlicer developers ==

Before the official announcement of the new authorization and authentication, Bambu Lab engaged with the OrcaSlicer development team regarding the changes. This communication has sparked significant discussion within the 3D-printing community, particularly regarding its timing, tone, and implications.

=== Pre-announcement contact ===
Reports from OrcaSlicer demonstrate that Bambu Lab provided limited advance notice of the changes that would render their software incompatible with Bambu printers running the new firmware. The communication emphasized:
* The introduction of Bambu Connect as the only supported method for interacting with third-party slicers.
* The discontinuation of the network plugin API that OrcaSlicer and other tools relied on for printer control.<ref>https://github.com/SoftFever/OrcaSlicer/issues/8063</ref>
* An invitation for OrcaSlicer developers to adapt their software to integrate with the Bambu Connect URL scheme.

The communication lacked the detailed technical documentation that would be necessary for developers to be able to work with the new requirements.

=== How the community viewed these actions ===
This approach has been interpreted by many as a calculated move by Bambu Lab to enforce tighter control over its ecosystem. Primary criticisms of Bambu were:
* '''Lack of transparency''': The limited warning to OrcaSlicer devs suggests that Bambu Lab prioritized internal rollout schedules over community engagement with existing customers. Point to the contrary: The new firmware is in beta and Bambu Connect middleware contains temporary compomises to allow third-party slicers to work as before.
* '''Lack of follow-through:''' As of writing, SoftFever, OrcaSlicer's lead developer, still does not have API keys for Bambu Connect, a necessary layer of Bambu software that would need to be integrated into OrcaSlicer. Bambu's original announcement prominently mentioned OrcaSlicer and gave the impression that Bambu is actively providing the necessary assets so that SoftFever would be able to implement the new software architecture so that OrcaSlicer users are able to still use OrcaSlicer to send gcode to their printers without needing Bambu Connect to be installed as a separate program. The lack of active cooperation does not reflect favorably upon Bambu as it seems like their announcement used OrcaSlicer's name to try to make it seem like Bambu is trying its best to make sure that developers have what they need, but in reality, their inaction seems to show that Bambu is not making a sincere attempt to ensure that OrcaSlicer remains supported. <ref name=":1" />
* '''Disregard for open-source collaboration''': OrcaSlicer is widely used in the community; it is an open-source effort to improve the 3D-printing experience for all customers. By abruptly altering the compatibility landscape, Bambu Lab is seen as undermining good-faith initiatives to improve the ecosystem for everyone. The decision to restrict network APIs in favor of proprietary systems such as Bambu Connect represents a broader industry trend of closing off ecosystems that were once open, removing customer choice, privacy, and freedom.
* '''Token support for third-party tools''': While Bambu Connect provides a workaround for third-party slicer use, it significantly restricts functionality and complicates workflows, leading many to question the sincerity of Bambu's stated support for open-source tools<ref name="bambu-connect" />.
* '''Power imbalance''': As the hardware manufacturer, Bambu Lab has the ability to dictate how its products can be used; often to the detriment of third-party developers and users.
== Community-driven workarounds and technical alternatives ==

The 3D-printing community has begun exploring potential workarounds to restore functionality and user autonomy. These efforts focus on bypassing or mitigating the limitations imposed by the firmware update.

=== Custom firmware development ===
Discussions within the community highlight interest in developing custom firmware as an alternative to Bambu's official updates. One prominent project mentioned in forums is the development of custom firmware for the X1-series printers, such as the "X1Plus Custom Firmware."<ref>https://forum.bambulab.com/t/bambu-studio-1-10-2-public-beta/134549/12</ref> This firmware aims to:
* Restore direct network control and third-party slicer compatibility.
* Re-enable previously available features such as motion-system adjustments, temperature control, and AMS settings without requiring proprietary software.
* Provide users with greater flexibility in integrating printers with home-automation systems and workflows.

However, custom firmware development faces significant challenges, including:
* Limited documentation and proprietary hardware components, which complicate reverse-engineering efforts.
* The potential voiding of warranties and risks of bricking devices.
* Legal concerns regarding intellectual property and bypassing manufacturer-imposed restrictions.

== LAN mode and blocked internet access ==
This is a guide made by the user Tzeny15

https://www.reddit.com/r/BambuLab/comments/1i4vp5i/comment/this/

== Reverse Engineering Bambu Connect ==
{{:Reverse Engineering Bambu Connect}}

''[[Reverse_Engineering_Bambu_Connect|Read more here.]]''

== Community tools and scripts ==
In addition to firmware alternatives, some users have come up with custom scripts and software tools to interface with Bambu Lab printers indirectly. These tools often rely on:
* Reverse-engineering the URL-based commands required by Bambu Connect to enable partial functionality with third-party slicers like OrcaSlicer.
* Creating local server emulations to replicate the network API previously available before the update.

While these tools provide temporary solutions, they don't fully replace the open ecosystem that existed prior to the authorization update.

=== Re-engineering printer-control electronics ===
ChazLayyd's Bambu Lab Klipper Conversion project is currently in an incomplete stage<ref>https://github.com/ChazLayyd/Bambu-Lab-Klipper-Conversion</ref><ref>DhazLayyd's Discord Community

https://discord.gg/W6B5mBejuC</ref>. While the project was not made in response to Bambu's announcement, there has been a wave of new public interest in this specific project. ChazLayyd's documentation instructs P1S owners to non-destructively remove the old control electronics that run Bambu's proprietary software and instructs P1S owners to install off-the-shelf control components so that the existing motor connectors and other critical electronics can communicate with the newly-installed off-the-shelf control components.

=== Advocacy for open-ecosystem support ===
Community members have also organized to advocate for open-source support and rollback options. Suggestions include:
* Allowing an opt-out option for existing users who prefer local network control without cloud dependency.
** It should be pointed out that this has always been possible and past firmware updates made signing into the cloud at any point completely unnecessary. This information continues to be ignored by some.
* Providing an official API for third-party slicers under specific licensing agreements that allow secure authorized usage.<ref>https://github.com/SoftFever/OrcaSlicer/issues/8063</ref>
== Bambu corporate strategy vs maker community values==

=== Impact on professional users and print farms ===
The restrictions imposed by the new authorization system create significant operational challenges for professional users who kept their printers signed into the cloud:

* Print farms can no longer use custom automation systems to manage multiple printers
* Workflows built around third-party software have to be completely redesigned
* The requirement to manually export and import files through Bambu Connect creates additional labor
* Integration with existing business systems and workflows becomes more difficult or impossible
* Professional users with more than 20 printers report the new workflow as "an absolute nightmare"<ref>https://forum.bambulab.com/t/this-new-auth-system-will-make-me-sell-my-printers/135400/4</ref>
The solution to the above is not to sign the printer into the cloud. Keeping the printer signed in would be a security oversight in this use case on the part of the print farm.

=== Privacy and data-collection concerns ===

The shift toward mandatory use of Bambu's software ecosystem raises several privacy and data collection concerns:

* All printer operations must now pass through Bambu's cloud infrastructure when using cloud mode
* User print data, including file names and print settings, becomes visible to Bambu when cloud is used
* Camera feeds and operational data are processed through Bambu's servers while on a different network
* Users have limited visibility into how their data is collected, stored, and used in the cloud
* The system creates dependence on Bambu's cloud services availability for basic printer functionality<ref>https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643/9</ref>

While Bambu Lab maintains that cloud processing is necessary for security and functionality, community members argue this represents unnecessary data collection that could be handled locally.<ref>https://forum.bambulab.com/t/bambu-studio-1-10-2-public-beta/134549/12</ref> The company's cloud infrastructure costs are significant, leading some users to speculate that future monetization of the cloud services may be planned.<ref>https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643/5</ref> Therefore, people should assess if their use case mandates the use of the cloud service and disable it when it doesn't.

This shift from local control to cloud-dependent operation is part of a broader trend in consumer devices, where manufacturers use security concerns to justify increased data collection and reduced customer control over devices they bought and paid for. Privacy-conscious users should operate their printers in LAN-only mode to avoid cloud connectivity.

== Customer reactions ==

Customer reactions have been overwhelmingly negative.<ref>https://forum.bambulab.com/t/bambu-studio-1-10-2-public-beta/134549/4</ref><ref>https://old.reddit.com/r/BambuLab/comments/1i2psvz/firmware_update_introducing_new_authorization/</ref> Bambu Lab has historically pushed cloud-based printer interaction while offering limited LAN mode functionality.<ref>https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643/9</ref> Many customers argue that the security issues this locked-down firmware claims to address are actually consequences of the company's cloud-based design choices rather than inherent risks of local network control,<ref>https://forum.bambulab.com/t/bambu-studio-1-10-2-public-beta/134549/12</ref> which continues to infuriate users who are now told that security is the justification for a loss of freedom. As a result of the announcement of the shift, customer ratings on sites like Trustpilot rapidly dropped,<ref>https://www.trustpilot.com/review/bambulab.com?sort=recency</ref> with many reviews citing the restrictions as the reason for the bad reviews.

The shift raises privacy concerns as user print data, including file names, print settings, and camera feeds, must now pass through Bambu's cloud infrastructure.

Many community members and customers ask whether the significant costs of maintaining and deploying this cloud infrastructure might lead to future monetization of these now-mandatory services,<ref>https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643/5</ref> with subscriptions required for features that once worked with local access.

It should be noted, however, that so far '''no changes have been made or indicated for those not using the cloud service'''. Past firmware updates made it possible to avoid using the cloud service completely by allowing pairing the slicer via IP address and access key and doing offline firmware updates without having to sign the printer into the service, not even temporarily, keeping local functionality unchanged.

== Comparisons to similar practices by other companies ==

Bambu Lab's new authorization and authentication requirements have been compared to a number of practices by traditional printer manufacturers, such as [[HP]] or [[Epson]], who have also faced backlash around their handling of [[digital-rights management]] (DRM){{Citation needed}}. These comparisons address:
* '''Forced updates''': Firmware updates have rendered third-party ink cartridges incompatible, forcing users to purchase proprietary consumables.
* '''Restricted features''': Scanner/printer combos that will not scan if the ink is empty.
* '''Consumer backlash''': Users criticized these updates as anti-consumer, with some pursuing [[class action lawsuit|class-action lawsuits]] for deceptive practices.<ref>https://www.classaction.org/hp-printer-ink-firmware-lawsuit</ref>

Like 2D printers, Bambu Lab's update restricts functionality previously available to users and pushes them toward proprietary software and cloud-based control.

A parallel specific to the 3D-printing industry can also be drawn from the now-defunct 3D-printer manufacturer [[MakerBot]], whose shift from open-source, DIY-focused machines in 2012 to closed-source, proprietary machines (similarly to Bambu Labs), ultimately drove customers to less-expensive, open-source competitors.<ref>https://hackaday.com/2016/04/28/the-makerbot-obituary/</ref> MakerBot was also accused of asserting ownership over publicly available, open-source designs uploaded to its 3D print repository, Thingiverse.<ref>https://techcrunch.com/2014/05/28/makerbot-responds-to-critics-who-claim-it-is-stealing-community-ip/</ref> These factors contributed to MakerBot steadily losing their position and reputation as an industry leader, before getting absorbed by rival Ultimaker in 2022.

== References ==

<references/>
[[Category:Bambu Lab]]

Bambu Lab Authorization Control System

2025-01-19T23:05:50Z

Lomanic: deduplicate <ref>

[[Category:Feature Ransom]]

On January 16, 2025, the 3D-printer manufacturer [[:wikipedia:Bambu Lab|Bambu Lab]] announced that future firmwares for their 3D printers would introduce an authorization and authentication protection mechanism for their connection and control, in the name of security. Bambu has stated the following:<blockquote>''"This change is mitigating any risk of remote hacks or printer exposure issues that have happened in the past and also lower the risk of abnormal traffic or attacks."''<ref name="firmware-update-introducing-new-authorization-control-system-2">https://blog.bambulab.com/firmware-update-introducing-new-authorization-control-system-2/</ref><ref>https://all3dp.com/4/bambu-lab-limits-third-party-printer-control-with-new-security-update/</ref></blockquote>

== Controversy regarding firmware updates ==
[[File:Bambu tos screenshot.png|alt=bambu terms stating print jobs may not function properly if update is not performed to new firmware which is highly limiting. |thumb|Bambu terms regarding printer functionality & potential for disrupted print jobs if users do not update to a new firmware that radically restricts the autonomy of the owner of the printer]]

=== Potential for remote disabling of printers ===
A significant concern raised by the community revolves around the wording in Bambu Lab's [[Terms of Service]] and firmware update announcements. Critics and users argue that the phrasing leaves open the possibility for the manufacturer to remotely disable printers that are not updated to the latest firmware. Specifically, Bambu Lab's Terms of Service<ref>https://bambulab.com/en-us/policies/terms</ref> states that printers may block "new print jobs" if updates are not applied, which some users interpret as a potential pathway for forced obsolescence<ref name="firmware-update-introducing-new-authorization-control-system-2" />. The announcement, however, specifically says, "'''What happens if I never upgrade to this firmware?''' ''You may continue using an older firmware version that does not include the new security updates; however, this means the printers may miss out on important security fixes or bug patches included in newer versions.''"<ref name="firmware-update-introducing-new-authorization-control-system-2" />

While defenders of Bambu Lab point out that offline modes such as SD-card printing and LAN-only setups would remain functional, others point out that the Terms of Service do not explicitly limit this restriction to cloud-based printing. This ambiguity has led to speculation that Bambu Lab could enforce broader limitations, effectively rendering printers inoperable for users who choose not to update.<ref>https://old.reddit.com/r/BambuLab/comments/1i45iy2/bambu_lab_reserves_the_right_to_brick_your/</ref>

=== Debate over "bricking" terminology ===
The debate has also extended to the definition of "bricking." Some community members assert that if a printer is unable to accept new print jobs without an update, it effectively becomes non-functional and qualifies as being "bricked." Others counter that as long as certain offline functionalities remain (such as SD-card printing) the term does not accurately apply.<ref>https://old.reddit.com/r/BambuLab/comments/1i45iy2/bambu_lab_reserves_the_right_to_brick_your/m7sezlg/</ref>

=== Community Strategies to Deal with Risks ===
Users have discussed strategies to avoid possible disruptions, including:
* Operating printers exclusively in offline modes.
* Utilizing LAN connections or VPN setups: this requires an access key from the printer (previously, you could use your cloud credentials over LAN).
* Exploring alternative firmware or third-party scripts to restore full functionality<ref>https://old.reddit.com/r/BambuLab/comments/1i45iy2/bambu_lab_reserves_the_right_to_brick_your/m7t8i7r/</ref>.

== Bambu Lab's justification and rebuttal ==
Bambu Lab has stated that the authorization system is in place in order to protect against "remote hacks," "printer exposure," and "abnormal traffic or attacks." There are, however, several ways to mitigate these risks without the loss of user control that their system causes:

* '''The "remote hacks" that were cited as an example in the article seem to be a direct result of the 3D-printer vendor not responding properly to a reported security vulnerability in their product.<ref>[https://www.bitdefender.com/en-au/blog/hotforsecurity/someone-is-hacking-3d-printers-to-warn-owners-of-a-security-flaw?ref=blog.bambulab.com https://www.bitdefender.com/en-au/blog/hotforsecurity/someone-is-hacking-3d-printers-to-warn-owners-of-a-security-flaw]</ref> Therefore, in order to get attention, the researcher decided to infect machines and display a harmless message to spread publicity.''' Properly responding to security vulnerabilities, working to patch them quickly, and working with the security community (who would be more than happy to help secure products) would be some ways to prevent this.
* In the article cited about printer exposure, the hack was carried out largely because of user misconfiguration.<ref>[https://www.csoonline.com/article/566223/over-3700-exposed-3d-printers-open-to-remote-attackers.html?ref=blog.bambulab.com https://www.csoonline.com/article/566223/over-3700-exposed-3d-printers-open-to-remote-attackers.html]</ref> Printer exposure can be mitigated by offering more convenient ways to securely expose printers to the internet, so that users are not tempted to allow unauthenticated access over the network.
* The "abnormal traffic" can be mitigated by steps Bambu has already put in place, as detailed in their own article on the matter<ref>[https://wiki.bambulab.com/en/security-incidents-cloud-traffic?ref=blog.bambulab.com https://wiki.bambulab.com/en/security-incidents-cloud-traffic]</ref>.

== Issues with LAN mode requiring authorization ==

Bambu Lab printers have the ability to be controlled over both cloud and LAN. This allowed users to integrate their printers into private networks and maintain full control without having to rely on the manufacturer's server while also allowing cloud access. The new authorization system mandates that even LAN-based operations must go through an authentication process using Bambu Connect to retain full control.<ref>https://wiki.bambulab.com/en/software/bambu-connect</ref> Full local access is still possible and unchanged for those not using the cloud.

This change has drawn criticism for many reasons:
* '''Privacy concerns''': Requiring authentication for LAN mode raises concerns about data being unnecessarily exposed to Bambu Lab's servers, even for local-only operations, though previously, the printer was also connected and could be controlled by the cloud even when sending prints locally.
** Confidentiality required by US Law - This is in conflict with those that have to comply with 18 CFR § 3a.61, 32 CFR § 117.15, 32 CFR § 2001.47, and other restrictions.
* '''Loss of offline independence while also using cloud''': Before, users could have hybrid offline setups. The requirement for authentication removes this option unless users revert to older firmware versions, which Bambu does not allow people to do once they have updated to the firmware using the new scheme.
* '''Increased complexity''': The added authentication layer complicates workflows for users who built custom setups or relied on third-party integrations for LAN control while retaining cloud functionality<ref>https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643</ref>.

=== Precedents and comparisons ===
Critics have likened this potential functionality to similar cases in other industries where manufacturers remotely restrict product features. Notable examples include [[HP]]'s printer firmware updates that [[HP Instant Ink|rendered third-party ink cartridges unusable]] and Tesla's software locks on second-hand vehicles. These parallels suggest a broader trend of manufacturers [[Retroactively amended purchase|using software to control hardware capabilities post-purchase]].<ref>https://www.classaction.org/hp-printer-lawsuit</ref><ref>https://www.wired.com/story/tesla-remote-disable-used-car-features/</ref>

== Implementation Timeline and Requirements ==

The authorization system will be rolled out in phases, starting with the X1 series printers. A beta firmware (version 01.08.03.00) was released on January 17, 2025, with the full release scheduled for January 23, 2025. The P & A series printers will get similar updates at an unspecified future date.

To use printers with the new authorization system, users must update multiple pieces of software:
* Bambu Studio must be updated to version 01.10.02.64 or higher
* Bambu Handy mobile app must be updated to version 2.17.0 or higher
* The new Bambu Connect application must be installed for using third-party slicers

These software updates are mandatory for users who update their firmware. Failing to update all components simultaneously will result in certain printer controls becoming unusable. Users who choose to maintain third-party software compatibility can continue using older firmware versions, though this will not be an option for new printers, which will ship with the authorization system pre-installed.

Bambu Lab states these coordinated updates are necessary because the new authorization system fundamentally changes how the printer validates and accepts commands. The older versions of Bambu Studio and Bambu Handy lack the authentication mechanisms required to interact with printers running the new firmware. The Bambu Connect application was created specifically to provide a controlled interface for third-party software, replacing the previous direct access through network plugins<ref name="firmware-update-introducing-new-authorization-control-system-2" />.

== Impact on third-party integration and user choice ==

=== Changes to third-party access ===
The new authorization system replaces direct network API access with a more limited URL-based interface through Bambu Connect. Third-party software can only interact with the printer by sending specific URL commands to Bambu Connect<ref>https://wiki.bambulab.com/en/software/bambu-connect</ref>. The interface requires three parameters:

* <code>path</code>: The absolute file system path to the 3MF file (e.g., /tmp/cube.gcode.3mf)
* <code>name</code>: The name of the file (e.g., Cube)
* <code>version</code>: A fixed value of 1.0.0 for compatibility

A complete command must be formatted as:<blockquote><syntaxhighlight lang="text">
bambu-connect://import-file?path=%2Ftmp%2Fcube.gcode.3mf&name=Cube&version=1.0.0
</syntaxhighlight></blockquote>This interface only allows basic file transfer and print initiation. All other printer-control functions previously available to third-party software are now exclusive to Bambu's own applications. The path and name parameters must be URL-encoded using encodeURIComponent or equivalent functions<ref>https://wiki.bambulab.com/en/software/bambu-connect</ref>.

=== Reduced home-automation capabilities ===
While basic status monitoring remains available (e.g., print-progress updates in Home Assistant), the new firmware removes the ability for home-automation systems to control printer functions. Users can no longer:
* Start or stop prints remotely using Home Assistant, BTT Panda Touch,<ref name=":0">https://www.facebook.com/BIGTREETECH/posts/pfbid0SNZGxvf7NRdmyVgHf6y9yNedNbU2RrCfdT8gugTSD4AYfr5BHneNF9H1EbwyYiJEl</ref> or other third-party accessories or software interfaces
* Control printer temperatures or cooling
* Automate printer behaviors based on sensor data or events
* Access camera feeds through third-party applications<ref>https://forum.bambulab.com/t/this-new-auth-system-will-make-me-sell-my-printers/135400/9</ref>

=== Permanent nature of the update ===
Once a printer is updated to the new firmware, users cannot revert to previous versions that allows full control of the printer using LAN mode access key while signed into the cloud<ref name="firmware-update-introducing-new-authorization-control-system-2" />. The option still exists to disable the cloud service.

The manufacturer states this change is required for security, but community members note that many of the security vulnerabilities being addressed stem from Bambu's own cloud-centric design choices rather than inherent risks of local network control<ref>https://forum.bambulab.com/t/bambu-studio-1-10-2-public-beta/134549/12</ref>. The update forces users into using Bambu Connect middleware if they want to retain cloud functionality.

This can be characterised as a significant post-purchase reduction in functionality for existing owners who bought their printers with the understanding they could use third-party software and home-automation tools, but also only affects users actively choosing to use Bambu Cloud at the same time. The inability to revert these changes, combined with the mandatory nature of the update for new printers, is used to demonstrate how manufacturers can use software updates to unilaterally modify the capabilities of hardware products after purchase, although in this case the changes affect only people already choosing to use the cloud service<ref>https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643/9</ref>.

For users that would want to use a third-party slicer while using their cloud service, Bambu would require those users to download and install Bambu Connect in order to send gcode wirelessly over LAN or over the cloud. While Bambu claims that they were in contact with SoftFever, the developer of OrcaSlicer, as of writing, SoftFever still does not have any keys for Bambu Connect and the new firmware is only available as opt-in beta at the moment.<ref name=":1">https://x.com/fever_soft/status/1880630570809795034?t=qJyh4SGFZFllcYrqexGW-Q&s=19</ref>

== Impact on functionality ==
While some functionality remains unauthenticated like in previous firmware versions (sending status information from the printer over the network, starting a print job using SD cards), the most important features now require authentication through a new closed-source client called Bambu Connect<ref>https://wiki.bambulab.com/en/software/bambu-connect</ref>. These restricted features include:

* Initializing prints via LAN or cloud mode
* Remote video access to monitor prints
* Controlling motion system, temperature, fans
* AMS settings and calibrations
* Home automation integration beyond basic status monitoring

Previously, third-party software such as OrcaSlicer<ref>https://github.com/SoftFever/OrcaSlicer/issues/8063</ref> could interact with Bambu Lab printers via the open-source Bambu Studio and proprietary network plug-ins. While Bambu Connect provides a limited URL-based API to initiate prints, most functionality previously openly available is now restricted to Bambu's ecosystem<ref>https://forum.bambulab.com/t/this-new-auth-system-will-make-me-sell-my-printers/135400/9</ref>.

Previously, third-party accessories such as Panda Touch would allow users to control their printers with a standalone device. Panda Touch was especially popular amongst P series printer owners since P series printers contain a monochromatic screen with a D-pad by default for printer control whereas Panda Touch is a full-color touch screen that had a small battery so that way users could reposition and detach their Panda Touch off their printers if needed. Users would be able to queue up jobs, jog printer motors, and connect to multiple printers at once in order to monitor print jobs. According to Big Tree Tech (BTT), the manufacturer of the Panda Touch, they urge users of Panda Touch not to update firmware any further since doing so would foreseeably permanently break compatibility with users' printers and their Panda Touch. <ref name=":0" />

== Communication with Panda Touch developers ==

As of writing, no formal communication has happened between Big Tree Tech (BTT), the manufacturer and developer of Panda Touch, and Bambu Labs. Based on their Facebook announcement, BTT stated that they have reached out to Bambu and will update if Bambu responds to their correspondence. <ref name=":0" />

== Communication with OrcaSlicer developers ==

Before the official announcement of the new authorization and authentication, Bambu Lab engaged with the OrcaSlicer development team regarding the changes. This communication has sparked significant discussion within the 3D-printing community, particularly regarding its timing, tone, and implications.

=== Pre-announcement contact ===
Reports from OrcaSlicer demonstrate that Bambu Lab provided limited advance notice of the changes that would render their software incompatible with Bambu printers running the new firmware. The communication emphasized:
* The introduction of Bambu Connect as the only supported method for interacting with third-party slicers.
* The discontinuation of the network plugin API that OrcaSlicer and other tools relied on for printer control.<ref>https://github.com/SoftFever/OrcaSlicer/issues/8063</ref>
* An invitation for OrcaSlicer developers to adapt their software to integrate with the Bambu Connect URL scheme.

The communication lacked the detailed technical documentation that would be necessary for developers to be able to work with the new requirements.

=== How the community viewed these actions ===
This approach has been interpreted by many as a calculated move by Bambu Lab to enforce tighter control over its ecosystem. Primary criticisms of Bambu were:
* '''Lack of transparency''': The limited warning to OrcaSlicer devs suggests that Bambu Lab prioritized internal rollout schedules over community engagement with existing customers. Point to the contrary: The new firmware is in beta and Bambu Connect middleware contains temporary compomises to allow third-party slicers to work as before.
* '''Lack of follow-through:''' As of writing, SoftFever, OrcaSlicer's lead developer, still does not have API keys for Bambu Connect, a necessary layer of Bambu software that would need to be integrated into OrcaSlicer. Bambu's original announcement prominently mentioned OrcaSlicer and gave the impression that Bambu is actively providing the necessary assets so that SoftFever would be able to implement the new software architecture so that OrcaSlicer users are able to still use OrcaSlicer to send gcode to their printers without needing Bambu Connect to be installed as a separate program. The lack of active cooperation does not reflect favorably upon Bambu as it seems like their announcement used OrcaSlicer's name to try to make it seem like Bambu is trying its best to make sure that developers have what they need, but in reality, their inaction seems to show that Bambu is not making a sincere attempt to ensure that OrcaSlicer remains supported. <ref name=":1" />
* '''Disregard for open-source collaboration''': OrcaSlicer is widely used in the community; it is an open-source effort to improve the 3D-printing experience for all customers. By abruptly altering the compatibility landscape, Bambu Lab is seen as undermining good-faith initiatives to improve the ecosystem for everyone. The decision to restrict network APIs in favor of proprietary systems such as Bambu Connect represents a broader industry trend of closing off ecosystems that were once open, removing customer choice, privacy, and freedom.
* '''Token support for third-party tools''': While Bambu Connect provides a workaround for third-party slicer use, it significantly restricts functionality and complicates workflows, leading many to question the sincerity of Bambu's stated support for open-source tools.<ref>https://wiki.bambulab.com/en/software/bambu-connect</ref>
* '''Power imbalance''': As the hardware manufacturer, Bambu Lab has the ability to dictate how its products can be used; often to the detriment of third-party developers and users.
== Community-driven workarounds and technical alternatives ==

The 3D-printing community has begun exploring potential workarounds to restore functionality and user autonomy. These efforts focus on bypassing or mitigating the limitations imposed by the firmware update.

=== Custom firmware development ===
Discussions within the community highlight interest in developing custom firmware as an alternative to Bambu's official updates. One prominent project mentioned in forums is the development of custom firmware for the X1-series printers, such as the "X1Plus Custom Firmware."<ref>https://forum.bambulab.com/t/bambu-studio-1-10-2-public-beta/134549/12</ref> This firmware aims to:
* Restore direct network control and third-party slicer compatibility.
* Re-enable previously available features such as motion-system adjustments, temperature control, and AMS settings without requiring proprietary software.
* Provide users with greater flexibility in integrating printers with home-automation systems and workflows.

However, custom firmware development faces significant challenges, including:
* Limited documentation and proprietary hardware components, which complicate reverse-engineering efforts.
* The potential voiding of warranties and risks of bricking devices.
* Legal concerns regarding intellectual property and bypassing manufacturer-imposed restrictions.

== LAN mode and blocked internet access ==
This is a guide made by the user Tzeny15

https://www.reddit.com/r/BambuLab/comments/1i4vp5i/comment/this/

== Reverse Engineering Bambu Connect ==
{{:Reverse Engineering Bambu Connect}}

''[[Reverse_Engineering_Bambu_Connect|Read more here.]]''

== Community tools and scripts ==
In addition to firmware alternatives, some users have come up with custom scripts and software tools to interface with Bambu Lab printers indirectly. These tools often rely on:
* Reverse-engineering the URL-based commands required by Bambu Connect to enable partial functionality with third-party slicers like OrcaSlicer.
* Creating local server emulations to replicate the network API previously available before the update.

While these tools provide temporary solutions, they don't fully replace the open ecosystem that existed prior to the authorization update.

=== Re-engineering printer-control electronics ===
ChazLayyd's Bambu Lab Klipper Conversion project is currently in an incomplete stage<ref>https://github.com/ChazLayyd/Bambu-Lab-Klipper-Conversion</ref><ref>DhazLayyd's Discord Community

https://discord.gg/W6B5mBejuC</ref>. While the project was not made in response to Bambu's announcement, there has been a wave of new public interest in this specific project. ChazLayyd's documentation instructs P1S owners to non-destructively remove the old control electronics that run Bambu's proprietary software and instructs P1S owners to install off-the-shelf control components so that the existing motor connectors and other critical electronics can communicate with the newly-installed off-the-shelf control components.

=== Advocacy for open-ecosystem support ===
Community members have also organized to advocate for open-source support and rollback options. Suggestions include:
* Allowing an opt-out option for existing users who prefer local network control without cloud dependency.
** It should be pointed out that this has always been possible and past firmware updates made signing into the cloud at any point completely unnecessary. This information continues to be ignored by some.
* Providing an official API for third-party slicers under specific licensing agreements that allow secure authorized usage.<ref>https://github.com/SoftFever/OrcaSlicer/issues/8063</ref>
== Bambu corporate strategy vs maker community values==

=== Impact on professional users and print farms ===
The restrictions imposed by the new authorization system create significant operational challenges for professional users who kept their printers signed into the cloud:

* Print farms can no longer use custom automation systems to manage multiple printers
* Workflows built around third-party software have to be completely redesigned
* The requirement to manually export and import files through Bambu Connect creates additional labor
* Integration with existing business systems and workflows becomes more difficult or impossible
* Professional users with more than 20 printers report the new workflow as "an absolute nightmare"<ref>https://forum.bambulab.com/t/this-new-auth-system-will-make-me-sell-my-printers/135400/4</ref>
The solution to the above is not to sign the printer into the cloud. Keeping the printer signed in would be a security oversight in this use case on the part of the print farm.

=== Privacy and data-collection concerns ===

The shift toward mandatory use of Bambu's software ecosystem raises several privacy and data collection concerns:

* All printer operations must now pass through Bambu's cloud infrastructure when using cloud mode
* User print data, including file names and print settings, becomes visible to Bambu when cloud is used
* Camera feeds and operational data are processed through Bambu's servers while on a different network
* Users have limited visibility into how their data is collected, stored, and used in the cloud
* The system creates dependence on Bambu's cloud services availability for basic printer functionality<ref>https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643/9</ref>

While Bambu Lab maintains that cloud processing is necessary for security and functionality, community members argue this represents unnecessary data collection that could be handled locally.<ref>https://forum.bambulab.com/t/bambu-studio-1-10-2-public-beta/134549/12</ref> The company's cloud infrastructure costs are significant, leading some users to speculate that future monetization of the cloud services may be planned.<ref>https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643/5</ref> Therefore, people should assess if their use case mandates the use of the cloud service and disable it when it doesn't.

This shift from local control to cloud-dependent operation is part of a broader trend in consumer devices, where manufacturers use security concerns to justify increased data collection and reduced customer control over devices they bought and paid for. Privacy-conscious users should operate their printers in LAN-only mode to avoid cloud connectivity.

== Customer reactions ==

Customer reactions have been overwhelmingly negative.<ref>https://forum.bambulab.com/t/bambu-studio-1-10-2-public-beta/134549/4</ref><ref>https://old.reddit.com/r/BambuLab/comments/1i2psvz/firmware_update_introducing_new_authorization/</ref> Bambu Lab has historically pushed cloud-based printer interaction while offering limited LAN mode functionality.<ref>https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643/9</ref> Many customers argue that the security issues this locked-down firmware claims to address are actually consequences of the company's cloud-based design choices rather than inherent risks of local network control,<ref>https://forum.bambulab.com/t/bambu-studio-1-10-2-public-beta/134549/12</ref> which continues to infuriate users who are now told that security is the justification for a loss of freedom. As a result of the announcement of the shift, customer ratings on sites like Trustpilot rapidly dropped,<ref>https://www.trustpilot.com/review/bambulab.com?sort=recency</ref> with many reviews citing the restrictions as the reason for the bad reviews.

The shift raises privacy concerns as user print data, including file names, print settings, and camera feeds, must now pass through Bambu's cloud infrastructure.

Many community members and customers ask whether the significant costs of maintaining and deploying this cloud infrastructure might lead to future monetization of these now-mandatory services,<ref>https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643/5</ref> with subscriptions required for features that once worked with local access.

It should be noted, however, that so far '''no changes have been made or indicated for those not using the cloud service'''. Past firmware updates made it possible to avoid using the cloud service completely by allowing pairing the slicer via IP address and access key and doing offline firmware updates without having to sign the printer into the service, not even temporarily, keeping local functionality unchanged.

== Comparisons to similar practices by other companies ==

Bambu Lab's new authorization and authentication requirements have been compared to a number of practices by traditional printer manufacturers, such as [[HP]] or [[Epson]], who have also faced backlash around their handling of [[digital-rights management]] (DRM){{Citation needed}}. These comparisons address:
* '''Forced updates''': Firmware updates have rendered third-party ink cartridges incompatible, forcing users to purchase proprietary consumables.
* '''Restricted features''': Scanner/printer combos that will not scan if the ink is empty.
* '''Consumer backlash''': Users criticized these updates as anti-consumer, with some pursuing [[class action lawsuit|class-action lawsuits]] for deceptive practices.<ref>https://www.classaction.org/hp-printer-ink-firmware-lawsuit</ref>

Like 2D printers, Bambu Lab's update restricts functionality previously available to users and pushes them toward proprietary software and cloud-based control.

A parallel specific to the 3D-printing industry can also be drawn from the now-defunct 3D-printer manufacturer [[MakerBot]], whose shift from open-source, DIY-focused machines in 2012 to closed-source, proprietary machines (similarly to Bambu Labs), ultimately drove customers to less-expensive, open-source competitors.<ref>https://hackaday.com/2016/04/28/the-makerbot-obituary/</ref> MakerBot was also accused of asserting ownership over publicly available, open-source designs uploaded to its 3D print repository, Thingiverse.<ref>https://techcrunch.com/2014/05/28/makerbot-responds-to-critics-who-claim-it-is-stealing-community-ip/</ref> These factors contributed to MakerBot steadily losing their position and reputation as an industry leader, before getting absorbed by rival Ultimaker in 2022.

== References ==

<references/>
[[Category:Bambu Lab]]

Talk:Bambu Lab Authorization Control System

2025-01-19T20:56:11Z

Lomanic: a few things that should be added to the article

I am not a bambu labs customer. I planned to be. But I spoke on their official facebook forum about a problem with a sunlu printer asking if anyone on there may know because the sunlu paths to help were fruitless. Immediately, people were crying that I had mentioned another printer brand and how that was irrelevant but I was pleading to the experts for a bit of help. Moments later, Bambu Lab staff banned me from the group. I binned the plan to become a customer right there. Some of the customer base and indeed the company, are toxic. Now I see this plan to own their customer base and I sure this is illegal with not logical reason - remember an airgapped network has only it's own security issues, one way traffic is a thing - except a poor excuse. Good luck in changing them. I dare say they will refuse all the way.

I am a year long anycubic customer and I feel vibes over there of ignorance and wonder what they plan on doing in the future.<small>—''The preceding [[Wikipedia:Sign your posts on talk pages|unsigned]] comment was added by'' [[User:81.78.58.48|81.78.58.48]] ([[User talk:81.78.58.48|talk]] • [[Special:Contributions/81.78.58.48|contribs]]) 18:07, 19 January 2025 (UTC)</small>

A few things that should be added to the article:
* Bambu Lab published a press release from January 18, 2025 after all the heat they got from [https://blog.bambulab.com/firmware-update-introducing-new-authorization-control-system-2/ the initial blog post] https://drive.google.com/drive/folders/11wl_DqAbSLPVMLZ_8jhlz4lGPLGFQPcp
* And here's a Mastodon user saying that this auth control system is a "DMCA trap", he also mentions precedents in the 3D printing market of ChiTu and Stratasys https://mas.to/@zzt/113848144602929391

The ChiTu/Chirtubox issue seems to be referring to this https://3dprintingindustry.com/news/chitu-systems-and-chitubox-a-lesson-in-fighting-open-source-3d-printing-194783/

Stratatsys may be this event https://arstechnica.com/gadgets/2024/08/stratasys-sues-bambu-lab-over-patents-used-widely-by-consumer-3d-printers/ — [[User:Lomanic|Lomanic]] ([[User talk:Lomanic|talk]]) 20:56, 19 January 2025 (UTC)

Bambu Lab Authorization Control System

2025-01-18T01:12:50Z

Lomanic: remove duplicate title

On 2025-01-16, the 3D printer manufacturer [[:wikipedia:Bambu Lab|Bambu Lab]] announced that future firmwares for their 3D printers would introduce an authorization and authentication protection mechanism for their connection and control, in the name of security ("to protect against remote hacks, printer exposure" and other attacks)<ref>https://blog.bambulab.com/firmware-update-introducing-new-authorization-control-system-2/</ref><ref>https://all3dp.com/4/bambu-lab-limits-third-party-printer-control-with-new-security-update/</ref>.

While some functionality still remains unauthenticated like in the previous firmware versions (sending status information from the printer over the network, starting a print job using SD cards), the most important ones (initiating a print via LAN or cloud mode, remote video access to follow the advancement of a print, controlling motion system, temperature, fans, AMS settings, calibrations, etc.) will require to use a new closed source client called Bambu Connect<ref>https://wiki.bambulab.com/en/software/bambu-connect</ref>.

Previously, 3rd-party software such as OrcaSlicer<ref>https://github.com/SoftFever/OrcaSlicer/issues/8063</ref> would interact with Bambu Lab printers via the open-source Bambu Studio and proprietary network plug-ins. While Bambu Connect provides an API to initiate prints, a lot of functionality previously openly available is now gated behind the closed source Bambu Connect<ref>https://forum.bambulab.com/t/this-new-auth-system-will-make-me-sell-my-printers/135400/9</ref>.

The manufacturer suggests to customers wanting to keep the old behaviour to keep their printer on the older firmware versions without the authentication framework. This won't be an option for consumers buying new printers shipping with the locked down firmware in the future.

Customers reactions are negative<ref>https://forum.bambulab.com/t/bambu-studio-1-10-2-public-beta/134549/4</ref><ref>https://old.reddit.com/r/BambuLab/comments/1i2psvz/firmware_update_introducing_new_authorization/</ref>. Bambu Lab is known for heavily pushing its cloud to interact with its printers to its customers, while offering a limited LAN mode<ref>https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643/9</ref>, some customers assert that the security issues this locked down firmware will counteract are in fact a consequence of this choice<ref>https://forum.bambulab.com/t/bambu-studio-1-10-2-public-beta/134549/12</ref>.

== References ==

<references/>

Bambu Lab Authorization Control System

2025-01-18T01:11:43Z

Lomanic: 1st draft, need someone with more knowledge about 3d printers and Bambu Lab than me

= Bambu Lab Authorization Control System =

On 2025-01-16, the 3D printer manufacturer [[:wikipedia:Bambu Lab|Bambu Lab]] announced that future firmwares for their 3D printers would introduce an authorization and authentication protection mechanism for their connection and control, in the name of security ("to protect against remote hacks, printer exposure" and other attacks)<ref>https://blog.bambulab.com/firmware-update-introducing-new-authorization-control-system-2/</ref><ref>https://all3dp.com/4/bambu-lab-limits-third-party-printer-control-with-new-security-update/</ref>.

While some functionality still remains unauthenticated like in the previous firmware versions (sending status information from the printer over the network, starting a print job using SD cards), the most important ones (initiating a print via LAN or cloud mode, remote video access to follow the advancement of a print, controlling motion system, temperature, fans, AMS settings, calibrations, etc.) will require to use a new closed source client called Bambu Connect<ref>https://wiki.bambulab.com/en/software/bambu-connect</ref>.

Previously, 3rd-party software such as OrcaSlicer<ref>https://github.com/SoftFever/OrcaSlicer/issues/8063</ref> would interact with Bambu Lab printers via the open-source Bambu Studio and proprietary network plug-ins. While Bambu Connect provides an API to initiate prints, a lot of functionality previously openly available is now gated behind the closed source Bambu Connect<ref>https://forum.bambulab.com/t/this-new-auth-system-will-make-me-sell-my-printers/135400/9</ref>.

The manufacturer suggests to customers wanting to keep the old behaviour to keep their printer on the older firmware versions without the authentication framework. This won't be an option for consumers buying new printers shipping with the locked down firmware in the future.

Customers reactions are negative<ref>https://forum.bambulab.com/t/bambu-studio-1-10-2-public-beta/134549/4</ref><ref>https://old.reddit.com/r/BambuLab/comments/1i2psvz/firmware_update_introducing_new_authorization/</ref>. Bambu Lab is known for heavily pushing its cloud to interact with its printers to its customers, while offering a limited LAN mode<ref>https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643/9</ref>, some customers assert that the security issues this locked down firmware will counteract are in fact a consequence of this choice<ref>https://forum.bambulab.com/t/bambu-studio-1-10-2-public-beta/134549/12</ref>.

== References ==

<references/>