Bambu Lab Authorization Control System - Revision history

Sojourna: Removed red links; misc.

2026-05-29T02:01:45Z

Removed red links; misc.

Keith: removed content about the cease and desist from this article. it will be moved to a separate article

2026-05-14T12:24:50Z

removed content about the cease and desist from this article. it will be moved to a separate article

Show changes

Keith at 15:10, 13 May 2026

2026-05-13T15:10:43Z

← Older revision		Revision as of 15:10, 13 May 2026
Line 50:		Line 50:

	==Issues with LAN mode requiring authorization==		==Issues with LAN mode requiring authorization==
			{{outdated/section}}
	[[File:Bambu Connect App - Lan Device Discovery without Bambu Login.png\|thumb\|Bambu Connect App - Lan Device Discovery without Bambu Login]]		[[File:Bambu Connect App - Lan Device Discovery without Bambu Login.png\|thumb\|Bambu Connect App - Lan Device Discovery without Bambu Login]]
	Bambu Lab printers have the ability to be controlled over both cloud and LAN. This allowed users to integrate their printers into private networks and maintain full control without having to rely on the manufacturer's server while also allowing cloud access. The new authorization system mandates that even LAN-based operations must go through an authentication process using Bambu Connect to retain full control.<ref name="bambu-connect">{{Cite web \|last=@Nil.lin \|title=Bambu Connect (beta) \|url=https://wiki.bambulab.com/en/software/bambu-connect \|url-status=live \|archive-url=https://ghostarchive.org/archive/CVCtK \|archive-date=2026-03-30 \|access-date=2025-05-01 \|website=[[Bambu Lab]] Wiki}}</ref> Full local access is still possible and unchanged for those not using the cloud.		Bambu Lab printers have the ability to be controlled over both cloud and LAN. This allowed users to integrate their printers into private networks and maintain full control without having to rely on the manufacturer's server while also allowing cloud access. The new authorization system mandates that even LAN-based operations must go through an authentication process using Bambu Connect to retain full control.<ref name="bambu-connect">{{Cite web \|last=@Nil.lin \|title=Bambu Connect (beta) \|url=https://wiki.bambulab.com/en/software/bambu-connect \|url-status=live \|archive-url=https://ghostarchive.org/archive/CVCtK \|archive-date=2026-03-30 \|access-date=2025-05-01 \|website=[[Bambu Lab]] Wiki}}</ref> Full local access is still possible and unchanged for those not using the cloud.
Line 71:		Line 72:

	==Implementation timeline and requirements==		==Implementation timeline and requirements==
	~~<!-- this~~ section ~~seems out of date -->~~		{{outdated/section}}
	The authorization system will be rolled out in phases, starting with the X1 series printers. A beta firmware (version 01.08.03.00) was released on January 17, 2025, with the full release scheduled for late January 2025.<ref name="firmware-update-introducing-new-authorization-control-system-2" /> The P and A series printers will get similar updates at an unspecified future date.		The authorization system will be rolled out in phases, starting with the X1 series printers. A beta firmware (version 01.08.03.00) was released on January 17, 2025, with the full release scheduled for late January 2025.<ref name="firmware-update-introducing-new-authorization-control-system-2" /> The P and A series printers will get similar updates at an unspecified future date.

Line 114:		Line 115:
	-->		-->
	==Impact on functionality==		==Impact on functionality==
			{{outdated/section}}
	While some functionality remains unauthenticated like in previous firmware versions (sending status information from the printer over the network, starting a print job using SD cards), the most important features now require authentication through a closed-source client called Bambu Connect<ref name="bambu-connect" />. These restricted features include:		While some functionality remains unauthenticated like in previous firmware versions (sending status information from the printer over the network, starting a print job using SD cards), the most important features now require authentication through a closed-source client called Bambu Connect<ref name="bambu-connect" />. These restricted features include:

Line 151:		Line 153:

	==Community-driven workarounds and technical alternatives==		==Community-driven workarounds and technical alternatives==
			{{outdated/section}}
	Community members have published workarounds for the firmware restrictions.		Community members have published workarounds for the firmware restrictions.

Keith: commented out a section - see talk page discussion

2026-05-13T15:09:02Z

commented out a section - see talk page discussion

← Older revision		Revision as of 15:09, 13 May 2026
Line 280:		Line 280:
	<blockquote>''User-Agent is not authentication. It is just self-declared client metadata. Any program can set any User-Agent. And the most important part: this comes directly from your own AGPL code.''</blockquote><ref name="pawel-reddit-okg9iih" />		<blockquote>''User-Agent is not authentication. It is just self-declared client metadata. Any program can set any User-Agent. And the most important part: this comes directly from your own AGPL code.''</blockquote><ref name="pawel-reddit-okg9iih" />
	Whichever branch of the severability dilemma Bambu Lab takes in the previous subsection, the impersonation framing relies on Bambu Lab's own AGPL-licensed code generating the very header Bambu Lab calls falsified.		Whichever branch of the severability dilemma Bambu Lab takes in the previous subsection, the impersonation framing relies on Bambu Lab's own AGPL-licensed code generating the very header Bambu Lab calls falsified.
			<!-- section below is largely uncited when it comes to the central assertion that 'only these orgs can sue', so it's comented out until such citation can be found
	===Who can enforce AGPL against Bambu Lab===		===Who can enforce AGPL against Bambu Lab===
	Paweł Jarczak personally cannot bring a direct AGPL enforcement action against Bambu Lab. The right to sue for AGPL violations belongs to the original authors whose code Bambu Lab built on top of: the [https://github.com/slic3r/Slic3r Slic3r contributors],<ref name="slic3r-repo" /> Prusa Research and the [https://github.com/prusa3d/PrusaSlicer/blob/master/LICENSE PrusaSlicer contributors],<ref name="prusaslicer-license" /> and the [https://github.com/SoftFever/OrcaSlicer/blob/main/LICENSE.txt SoftFever / OrcaSlicer maintainers].<ref name="softfever-orcaslicer-license" /> Jarczak's role in any formal complaint is reporter and witness, not plaintiff.		Paweł Jarczak personally cannot bring a direct AGPL enforcement action against Bambu Lab. The right to sue for AGPL violations belongs to the original authors whose code Bambu Lab built on top of: the [https://github.com/slic3r/Slic3r Slic3r contributors],<ref name="slic3r-repo" /> Prusa Research and the [https://github.com/prusa3d/PrusaSlicer/blob/master/LICENSE PrusaSlicer contributors],<ref name="prusaslicer-license" /> and the [https://github.com/SoftFever/OrcaSlicer/blob/main/LICENSE.txt SoftFever / OrcaSlicer maintainers].<ref name="softfever-orcaslicer-license" /> Jarczak's role in any formal complaint is reporter and witness, not plaintiff.
Line 291:		Line 291:
	*'''Electronic Frontier Foundation (EFF).''' Not for AGPL enforcement, but for the maintainer's defensive posture. The [https://www.eff.org/issues/coders Coders' Rights Project] works on the legal issues developers face under DMCA, CFAA, and similar computer-crime laws and provides public guidance for reverse engineering and vulnerability disclosure.<ref name="eff-coders-rights">{{Cite web \|title=Coders' Rights Project \|url=https://www.eff.org/issues/coders \|website=Electronic Frontier Foundation \|access-date=2026-05-10 \|url-status=live}}</ref>		*'''Electronic Frontier Foundation (EFF).''' Not for AGPL enforcement, but for the maintainer's defensive posture. The [https://www.eff.org/issues/coders Coders' Rights Project] works on the legal issues developers face under DMCA, CFAA, and similar computer-crime laws and provides public guidance for reverse engineering and vulnerability disclosure.<ref name="eff-coders-rights">{{Cite web \|title=Coders' Rights Project \|url=https://www.eff.org/issues/coders \|website=Electronic Frontier Foundation \|access-date=2026-05-10 \|url-status=live}}</ref>
	*'''iFixit and The Repair Association.''' Press reach and [[right to repair]] coalition framing. Neither litigates AGPL; both have established media reach and legislative relationships and have publicly tracked the Bambu Lab takedown in their channels.		*'''iFixit and The Repair Association.''' Press reach and [[right to repair]] coalition framing. Neither litigates AGPL; both have established media reach and legislative relationships and have publicly tracked the Bambu Lab takedown in their channels.
			-->
	===Consequences for FOSS forks of corporate-sponsored AGPL projects===		===Consequences for FOSS forks of corporate-sponsored AGPL projects===
	Louis Rossmann publicly pledged $10,000 toward Jarczak's legal defense if Bambu Lab proceeded with a lawsuit in a May 9, 2026 YouTube video,<ref name="rossmann-youtube-pledge" /> and directed an explicit public statement at the company's leadership; Tom's Hardware reported the pledge on May 10, 2026.<ref name="tomshardware-rossmann-pledge" /> The 3D-printing trade press (3Druck, XDA, Tom's Hardware, Manufactur3D) covered the dispute as the immediate flashpoint. Enforcement organizations including the Free Software Foundation, Software Freedom Conservancy, FSFE, and Electronic Frontier Foundation have jurisdiction to bring AGPL claims, but no enforcement action involving Bambu Lab had been announced as of publication. The same question reaches every IoT-device vendor who ships AGPL or GPLv3 components with companion mobile apps and cloud back-ends, and every consumer-electronics company publishing open-source slicers, control panels, or firmware while routing user functionality through proprietary remote services.		Louis Rossmann publicly pledged $10,000 toward Jarczak's legal defense if Bambu Lab proceeded with a lawsuit in a May 9, 2026 YouTube video,<ref name="rossmann-youtube-pledge" /> and directed an explicit public statement at the company's leadership; Tom's Hardware reported the pledge on May 10, 2026.<ref name="tomshardware-rossmann-pledge" /> The 3D-printing trade press (3Druck, XDA, Tom's Hardware, Manufactur3D) covered the dispute as the immediate flashpoint. Enforcement organizations including the Free Software Foundation, Software Freedom Conservancy, FSFE, and Electronic Frontier Foundation have jurisdiction to bring AGPL claims, but no enforcement action involving Bambu Lab had been announced as of publication. The same question reaches every IoT-device vendor who ships AGPL or GPLv3 components with companion mobile apps and cloud back-ends, and every consumer-electronics company publishing open-source slicers, control panels, or firmware while routing user functionality through proprietary remote services.

Morphior: corrected Jarczak’s name

2026-05-13T14:01:25Z

corrected Jarczak’s name

Keith: added comment

2026-05-13T12:44:54Z

added comment

← Older revision		Revision as of 12:44, 13 May 2026
Line 200:		Line 200:
	In April 2026, Bambu Lab sent a cease-and-desist communication to the developer of a third-party OrcaSlicer fork that had restored direct printer control after the Authorization Control System rollout. The project was wiped from public view the same day the threat was delivered, and the developer published a summary of Bambu Lab's allegations but not the letter itself, citing Bambu Lab's refusal to authorize publication.<ref name="jarczak-readme" />{{CitationNeeded}} The full public-record account includes a parallel May 7, 2026 Bambu Lab blog post and three same-day public Reddit replies from the maintainer.		In April 2026, Bambu Lab sent a cease-and-desist communication to the developer of a third-party OrcaSlicer fork that had restored direct printer control after the Authorization Control System rollout. The project was wiped from public view the same day the threat was delivered, and the developer published a summary of Bambu Lab's allegations but not the letter itself, citing Bambu Lab's refusal to authorize publication.<ref name="jarczak-readme" />{{CitationNeeded}} The full public-record account includes a parallel May 7, 2026 Bambu Lab blog post and three same-day public Reddit replies from the maintainer.

	The Reddit communications between Bambu Lab and the developer have been saved on the wiki at [[File:Bambu_communications_with_developer.pdf\|page=1\|400px]].		The Reddit communications between Bambu Lab and the developer have been saved on the wiki at [[File:Bambu_communications_with_developer.pdf\|page=1\|400px]].<!-- this can be replaced with a proper citation once Louis uploads it to his website or something-->

	===OrcaSlicer===		===OrcaSlicer===

Keith: added link to the pdf of communications with the developer

2026-05-13T12:43:00Z

added link to the pdf of communications with the developer

← Older revision		Revision as of 12:43, 13 May 2026
Line 199:		Line 199:

	In April 2026, Bambu Lab sent a cease-and-desist communication to the developer of a third-party OrcaSlicer fork that had restored direct printer control after the Authorization Control System rollout. The project was wiped from public view the same day the threat was delivered, and the developer published a summary of Bambu Lab's allegations but not the letter itself, citing Bambu Lab's refusal to authorize publication.<ref name="jarczak-readme" />{{CitationNeeded}} The full public-record account includes a parallel May 7, 2026 Bambu Lab blog post and three same-day public Reddit replies from the maintainer.		In April 2026, Bambu Lab sent a cease-and-desist communication to the developer of a third-party OrcaSlicer fork that had restored direct printer control after the Authorization Control System rollout. The project was wiped from public view the same day the threat was delivered, and the developer published a summary of Bambu Lab's allegations but not the letter itself, citing Bambu Lab's refusal to authorize publication.<ref name="jarczak-readme" />{{CitationNeeded}} The full public-record account includes a parallel May 7, 2026 Bambu Lab blog post and three same-day public Reddit replies from the maintainer.

			The Reddit communications between Bambu Lab and the developer have been saved on the wiki at [[File:Bambu_communications_with_developer.pdf\|page=1\|400px]].

	===OrcaSlicer===		===OrcaSlicer===

Keith: added a bunch of citation neededs, removed a bunch of original legal analysis/opinion, added comments, removed ampersands

2026-05-12T02:06:36Z

added a bunch of citation neededs, removed a bunch of original legal analysis/opinion, added comments, removed ampersands

Show changes

Louis at 18:20, 11 May 2026

2026-05-11T18:20:05Z

Can't load revision 53343

at 16:32, 11 May 2026

2026-05-11T16:32:09Z

Can't load revision 53341

← Older revision		Revision as of 14:01, 13 May 2026
Line 7:		Line 7:
	}}		}}

	On January 16, 2025, the 3D-printer manufacturer '''[[Bambu Lab]]''' announced that future firmwares for its 3D printers would introduce an authorization and authentication mechanism for printer connection and control, [[Deceptive language frequently used against consumers\|in the name of security]].<ref name="firmware-update-introducing-new-authorization-control-system-2">{{Cite web \|last=Bambu Kidd \|date=2025-01-16 \|title=Firmware Update Introducing New Authorization Control System \|url=https://blog.bambulab.com/firmware-update-introducing-new-authorization-control-system-2/ \|url-status=live \|archive-url=https://ghostarchive.org/archive/qwL63 \|archive-date=2026-03-07 \|website=[[Bambu Lab]] Blog}}</ref> The change restricted the use of third-party accessories and slicers such as Panda Touch and OrcaSlicer, and it gated print initiation, motion control, fan and hotend control, AMS configuration, calibrations, remote video, and firmware upgrade behind a Bambu-issued authentication path.<ref name="firmware-update-introducing-new-authorization-control-system-2" /> Bambu Lab also publishes its own slicer, [https://github.com/bambulab/BambuStudio Bambu Studio], under the [[GNU Affero General Public License\|AGPL-3.0]],<ref name="bambustudio-license">{{Cite web \|title=BambuStudio LICENSE (AGPL-3.0 verbatim) \|url=https://github.com/bambulab/BambuStudio/blob/master/LICENSE \|website=GitHub \|publisher=Bambu Lab \|access-date=2026-05-10 \|url-status=live}}</ref> while its [[Terms of Service\|Terms of Use]] § 3.4 forbid users to modify, copy, reverse engineer, or create derivatives of "the Product."<ref name=":2">{{Cite web \|date=2024-04-24 \|title=Terms of Use \|url=https://bambulab.com/en-us/policies/terms \|url-status=live \|archive-url=https://ghostarchive.org/archive/vPu9I \|archive-date=2026-03-09 \|access-date=2025-05-01 \|website=[[Bambu Lab]]}}</ref> In April 2026, Bambu Lab sent a private cease-and-desist demand to a Polish community fork maintainer, ~~Pawel~~ Jarczak, who had restored direct printer control on top of that AGPL source; on May 7, 2026, Bambu Lab published a blog post recharacterizing the dispute as "impersonation" through "falsified identity metadata" rather than as a question about open-source rights.<ref name="bambu-blog-record-straight">{{Cite web \|title=Setting the record straight on Cloud Access and Community \|url=https://blog.bambulab.com/setting-the-record-straight-on-cloud-access-and-community/ \|website=Bambu Lab Blog \|publisher=Bambu Lab \|date=2026-05-07 \|access-date=2026-05-10 \|url-status=live}}</ref><ref name="jarczak-readme">{{Cite web \|last=Jarczak \|first=Pawel \|title=OrcaSlicer-bambulab — This is the end…. \|url=https://github.com/jarczakpawel/OrcaSlicer-bambulab \|url-status=live \|archive-url=https://web.archive.org/web/20260430001537/https://github.com/jarczakpawel/OrcaSlicer-bambulab \|archive-date=2026-04-30 \|access-date=2026-05-04 \|website=[[GitHub]]}}</ref>		On January 16, 2025, the 3D-printer manufacturer '''[[Bambu Lab]]''' announced that future firmwares for its 3D printers would introduce an authorization and authentication mechanism for printer connection and control, [[Deceptive language frequently used against consumers\|in the name of security]].<ref name="firmware-update-introducing-new-authorization-control-system-2">{{Cite web \|last=Bambu Kidd \|date=2025-01-16 \|title=Firmware Update Introducing New Authorization Control System \|url=https://blog.bambulab.com/firmware-update-introducing-new-authorization-control-system-2/ \|url-status=live \|archive-url=https://ghostarchive.org/archive/qwL63 \|archive-date=2026-03-07 \|website=[[Bambu Lab]] Blog}}</ref> The change restricted the use of third-party accessories and slicers such as Panda Touch and OrcaSlicer, and it gated print initiation, motion control, fan and hotend control, AMS configuration, calibrations, remote video, and firmware upgrade behind a Bambu-issued authentication path.<ref name="firmware-update-introducing-new-authorization-control-system-2" /> Bambu Lab also publishes its own slicer, [https://github.com/bambulab/BambuStudio Bambu Studio], under the [[GNU Affero General Public License\|AGPL-3.0]],<ref name="bambustudio-license">{{Cite web \|title=BambuStudio LICENSE (AGPL-3.0 verbatim) \|url=https://github.com/bambulab/BambuStudio/blob/master/LICENSE \|website=GitHub \|publisher=Bambu Lab \|access-date=2026-05-10 \|url-status=live}}</ref> while its [[Terms of Service\|Terms of Use]] § 3.4 forbid users to modify, copy, reverse engineer, or create derivatives of "the Product."<ref name=":2">{{Cite web \|date=2024-04-24 \|title=Terms of Use \|url=https://bambulab.com/en-us/policies/terms \|url-status=live \|archive-url=https://ghostarchive.org/archive/vPu9I \|archive-date=2026-03-09 \|access-date=2025-05-01 \|website=[[Bambu Lab]]}}</ref> In April 2026, Bambu Lab sent a private cease-and-desist demand to a Polish community fork maintainer, Paweł Jarczak, who had restored direct printer control on top of that AGPL source; on May 7, 2026, Bambu Lab published a blog post recharacterizing the dispute as "impersonation" through "falsified identity metadata" rather than as a question about open-source rights.<ref name="bambu-blog-record-straight">{{Cite web \|title=Setting the record straight on Cloud Access and Community \|url=https://blog.bambulab.com/setting-the-record-straight-on-cloud-access-and-community/ \|website=Bambu Lab Blog \|publisher=Bambu Lab \|date=2026-05-07 \|access-date=2026-05-10 \|url-status=live}}</ref><ref name="jarczak-readme">{{Cite web \|last=Jarczak \|first=Pawel \|title=OrcaSlicer-bambulab — This is the end…. \|url=https://github.com/jarczakpawel/OrcaSlicer-bambulab \|url-status=live \|archive-url=https://web.archive.org/web/20260430001537/https://github.com/jarczakpawel/OrcaSlicer-bambulab \|archive-date=2026-04-30 \|access-date=2026-05-04 \|website=[[GitHub]]}}</ref>

	==Controversy regarding firmware updates==		==Controversy regarding firmware updates==
Line 208:		Line 208:
	The Authorization Control System announced on January 16, 2025 gated print initiation, motion control, fan and hotend temperature control, AMS configuration, calibrations, remote video, and firmware upgrade behind a Bambu-issued authentication path. Owners who installed the new firmware could no longer send print jobs from third-party slicers directly over the local network; they had to route those jobs through a new closed-source middleware, Bambu Connect.<ref name="firmware-update-introducing-new-authorization-control-system-2" /> SoftFever was not given API keys for Bambu Connect and stated publicly that direct print sending from OrcaSlicer would not be supported going forward.<ref name=":1" />		The Authorization Control System announced on January 16, 2025 gated print initiation, motion control, fan and hotend temperature control, AMS configuration, calibrations, remote video, and firmware upgrade behind a Bambu-issued authentication path. Owners who installed the new firmware could no longer send print jobs from third-party slicers directly over the local network; they had to route those jobs through a new closed-source middleware, Bambu Connect.<ref name="firmware-update-introducing-new-authorization-control-system-2" /> SoftFever was not given API keys for Bambu Connect and stated publicly that direct print sending from OrcaSlicer would not be supported going forward.<ref name=":1" />

	=== OrcaSlicer-bambulab fork===		===OrcaSlicer-bambulab fork===
	On April 23, 2026, the developer ~~Pawel~~ Jarczak (GitHub user <code>jarczakpawel</code>) made a public fork named OrcaSlicer-bambulab at <code>github.com/jarczakpawel/OrcaSlicer-bambulab</code>. The fork restored the ability to send print jobs from OrcaSlicer directly to Bambu Lab printers without routing through Bambu Connect.<ref name="xda-jarczak" /> According to Jarczak's own description, the fork worked by reaching the printer through a Linux-side workflow Bambu Lab had not yet disabled, and was built on publicly available Bambu Studio source code combined with the developer's own integration layer; it did not redistribute Bambu Lab's proprietary networking plugin binaries.<ref name="jarczak-readme" /><ref name="3druck-jarczak">{{Cite web \|date=2026-04-30 \|title=Developer ends OrcaSlicer fork after Bambu Lab threatens legal action \|url=https://3druck.com/en/programs/developer-terminates-orcaslicer-fork-after-bambu-lab-threatens-to-sue-32156744/ \|url-status=live \|access-date=2026-05-04 \|website=3Druck.com}}</ref> Jarczak also maintained a sibling fork at <code>github.com/jarczakpawel/BambuStudio-BMCU</code> that added support for a third-party multi-color unit (BMCU); that repository remained live as of May 9, 2026.<ref name="jarczak-bmcu">{{Cite web \|last=Jarczak \|first=Pawel \|title=BambuStudio-BMCU \|url=https://github.com/jarczakpawel/BambuStudio-BMCU \|website=GitHub \|access-date=2026-05-10 \|url-status=live}}</ref>		On April 23, 2026, the developer Paweł Jarczak (GitHub user <code>jarczakpawel</code>) made a public fork named OrcaSlicer-bambulab at <code>github.com/jarczakpawel/OrcaSlicer-bambulab</code>. The fork restored the ability to send print jobs from OrcaSlicer directly to Bambu Lab printers without routing through Bambu Connect.<ref name="xda-jarczak" /> According to Jarczak's own description, the fork worked by reaching the printer through a Linux-side workflow Bambu Lab had not yet disabled, and was built on publicly available Bambu Studio source code combined with the developer's own integration layer; it did not redistribute Bambu Lab's proprietary networking plugin binaries.<ref name="jarczak-readme" /><ref name="3druck-jarczak">{{Cite web \|date=2026-04-30 \|title=Developer ends OrcaSlicer fork after Bambu Lab threatens legal action \|url=https://3druck.com/en/programs/developer-terminates-orcaslicer-fork-after-bambu-lab-threatens-to-sue-32156744/ \|url-status=live \|access-date=2026-05-04 \|website=3Druck.com}}</ref> Jarczak also maintained a sibling fork at <code>github.com/jarczakpawel/BambuStudio-BMCU</code> that added support for a third-party multi-color unit (BMCU); that repository remained live as of May 9, 2026.<ref name="jarczak-bmcu">{{Cite web \|last=Jarczak \|first=Pawel \|title=BambuStudio-BMCU \|url=https://github.com/jarczakpawel/BambuStudio-BMCU \|website=GitHub \|access-date=2026-05-10 \|url-status=live}}</ref>

	===Cease and desist===		===Cease and desist===
Line 222:		Line 222:

	*'''January 16, 2025.''' Bambu Lab announced "Firmware Update: Introducing the New Authorization Control System," describing the firmware-gated authorization model.<ref name="firmware-update-introducing-new-authorization-control-system-2" />		*'''January 16, 2025.''' Bambu Lab announced "Firmware Update: Introducing the New Authorization Control System," describing the firmware-gated authorization model.<ref name="firmware-update-introducing-new-authorization-control-system-2" />
	*'''Spring 2026.''' ~~Pawel~~ Jarczak published <code>OrcaSlicer-bambulab</code> and a sibling repository <code>BambuStudio-BMCU</code> on GitHub.<ref name="jarczak-readme" /><ref name="jarczak-bmcu" />		*'''Spring 2026.''' Paweł Jarczak published <code>OrcaSlicer-bambulab</code> and a sibling repository <code>BambuStudio-BMCU</code> on GitHub.<ref name="jarczak-readme" /><ref name="jarczak-bmcu" />
	*'''Late April 2026.''' Bambu Lab contacted Jarczak privately on Reddit and demanded removal of the OrcaSlicer fork. Per Jarczak's public README, Bambu Lab's allegations were impersonation of Bambu Studio, bypass of authorization controls, ToS violation, reverse engineering, and the potential for modified forks to send arbitrary commands to printers.<ref name="jarczak-readme" />		*'''Late April 2026.''' Bambu Lab contacted Jarczak privately on Reddit and demanded removal of the OrcaSlicer fork. Per Jarczak's public README, Bambu Lab's allegations were impersonation of Bambu Studio, bypass of authorization controls, ToS violation, reverse engineering, and the potential for modified forks to send arbitrary commands to printers.<ref name="jarczak-readme" />
	*'''Around April 23, 2026.''' Jarczak removed the <code>OrcaSlicer-bambulab</code> repository voluntarily, and replaced its contents with a public archive notice; <code>jarczakpawel/BambuStudio-BMCU</code> remained live as of May 9, 2026.<ref name="jarczak-readme" /><ref name="jarczak-bmcu" />		*'''Around April 23, 2026.''' Jarczak removed the <code>OrcaSlicer-bambulab</code> repository voluntarily, and replaced its contents with a public archive notice; <code>jarczakpawel/BambuStudio-BMCU</code> remained live as of May 9, 2026.<ref name="jarczak-readme" /><ref name="jarczak-bmcu" />
Line 282:		Line 282:

	===Who can enforce AGPL against Bambu Lab===		===Who can enforce AGPL against Bambu Lab===
	~~Pawel~~ Jarczak personally cannot bring a direct AGPL enforcement action against Bambu Lab. The right to sue for AGPL violations belongs to the original authors whose code Bambu Lab built on top of: the [https://github.com/slic3r/Slic3r Slic3r contributors],<ref name="slic3r-repo" /> Prusa Research and the [https://github.com/prusa3d/PrusaSlicer/blob/master/LICENSE PrusaSlicer contributors],<ref name="prusaslicer-license" /> and the [https://github.com/SoftFever/OrcaSlicer/blob/main/LICENSE.txt SoftFever / OrcaSlicer maintainers].<ref name="softfever-orcaslicer-license" /> Jarczak's role in any formal complaint is reporter and witness, not plaintiff.		Paweł Jarczak personally cannot bring a direct AGPL enforcement action against Bambu Lab. The right to sue for AGPL violations belongs to the original authors whose code Bambu Lab built on top of: the [https://github.com/slic3r/Slic3r Slic3r contributors],<ref name="slic3r-repo" /> Prusa Research and the [https://github.com/prusa3d/PrusaSlicer/blob/master/LICENSE PrusaSlicer contributors],<ref name="prusaslicer-license" /> and the [https://github.com/SoftFever/OrcaSlicer/blob/main/LICENSE.txt SoftFever / OrcaSlicer maintainers].<ref name="softfever-orcaslicer-license" /> Jarczak's role in any formal complaint is reporter and witness, not plaintiff.

	The institutional capacity for AGPL enforcement on these facts sits with several organizations:		The institutional capacity for AGPL enforcement on these facts sits with several organizations:

← Older revision		Revision as of 02:01, 29 May 2026
Line 1:		Line 1:
	{{IncidentCargo		{{IncidentCargo
	\|Company=Bambu Lab		\|Company=Bambu Lab
	\|StartDate=2025~~-01-16~~		\|StartDate=16 January 2025
			\|EndDate=
	\|Status=Active		\|Status=Active
	\|Type=Post-purchase terms change		\|Type=Post-purchase terms change
Line 44:		Line 45:
	Bambu Lab has stated that the authorization system is in place in order to protect against "remote hacks," "printer exposure," and "abnormal traffic or attacks". The cited security incidents have specific context:		Bambu Lab has stated that the authorization system is in place in order to protect against "remote hacks," "printer exposure," and "abnormal traffic or attacks". The cited security incidents have specific context:

	*The "remote hacks" cited as an example in the article followed a reported security vulnerability in a 3D printer product; according to Bitdefender's reporting, the researcher infected machines to display a harmless message in order to publicize the unpatched flaw.<ref>{{Cite web \|last=Cluley \|first=Graham \|date=2024-03-01 \|title=Someone is hacking 3D printers to warn owners of a security flaw \|url=https://www.bitdefender.com/en-au/blog/hotforsecurity/someone-is-hacking-3d-printers-to-warn-owners-of-a-security-flaw?ref=blog.bambulab.com \|url-status=live \|archive-url=https://web.archive.org/web/20260216002646/https://www.bitdefender.com/en-au/blog/hotforsecurity/someone-is-hacking-3d-printers-to-warn-owners-of-a-security-flaw?ref=blog.bambulab.com \|archive-date=2026-02-16 \|access-date=2025-05-01 \|website=[[Bitdefender]]}}</ref>		*The "remote hacks" cited as an example in the article followed a reported security vulnerability in a 3D printer product; according to Bitdefender's reporting, the researcher infected machines to display a harmless message in order to publicize the unpatched flaw.<ref>{{Cite web \|last=Cluley \|first=Graham \|date=2024-03-01 \|title=Someone is hacking 3D printers to warn owners of a security flaw \|url=https://www.bitdefender.com/en-au/blog/hotforsecurity/someone-is-hacking-3d-printers-to-warn-owners-of-a-security-flaw?ref=blog.bambulab.com \|url-status=live \|archive-url=https://web.archive.org/web/20260216002646/https://www.bitdefender.com/en-au/blog/hotforsecurity/someone-is-hacking-3d-printers-to-warn-owners-of-a-security-flaw?ref=blog.bambulab.com \|archive-date=2026-02-16 \|access-date=2025-05-01 \|website=Bitdefender}}</ref>
	*In the article cited about printer exposure, the hack was carried out largely because of user misconfiguration.<ref>{{Cite web \|last=Ms. Smith \|date=2018-09-05 \|title=Over 3,700 exposed 3D printers open to remote attackers \|url=https://www.csoonline.com/article/566223/over-3700-exposed-3d-printers-open-to-remote-attackers.html?ref=blog.bambulab.com \|url-status=live \|archive-url=https://web.archive.org/web/20260216002556/https://www.csoonline.com/article/566223/over-3700-exposed-3d-printers-open-to-remote-attackers.html?ref=blog.bambulab.com \|archive-date=2026-02-16 \|access-date=2025-05-01 \|website=[[CSO]]}}</ref>		*In the article cited about printer exposure, the hack was carried out largely because of user misconfiguration.<ref>{{Cite web \|last=Ms. Smith \|date=2018-09-05 \|title=Over 3,700 exposed 3D printers open to remote attackers \|url=https://www.csoonline.com/article/566223/over-3700-exposed-3d-printers-open-to-remote-attackers.html?ref=blog.bambulab.com \|url-status=live \|archive-url=https://web.archive.org/web/20260216002556/https://www.csoonline.com/article/566223/over-3700-exposed-3d-printers-open-to-remote-attackers.html?ref=blog.bambulab.com \|archive-date=2026-02-16 \|access-date=2025-05-01 \|website=CSO}}</ref>
	*The "abnormal traffic" can be mitigated by steps Bambu has already put in place, as detailed in their own article on the matter.<ref>{{Cite web \|title=Summary of Security Incident Responses and Abnormal Cloud Traffic \|url=https://wiki.bambulab.com/en/security-incidents-cloud-traffic?ref=blog.bambulab.com \|url-status=live \|archive-url= \|archive-date= \|access-date=2025-05-01 \|website=[[Bambu Lab]] Wiki}}</ref>		*The "abnormal traffic" can be mitigated by steps Bambu has already put in place, as detailed in their own article on the matter.<ref>{{Cite web \|title=Summary of Security Incident Responses and Abnormal Cloud Traffic \|url=https://wiki.bambulab.com/en/security-incidents-cloud-traffic?ref=blog.bambulab.com \|url-status=live \|archive-url= \|archive-date= \|access-date=2025-05-01 \|website=[[Bambu Lab]] Wiki}}</ref>
	*"Other malicious devices in the LAN" can be partially mitigated by steps Bambu has already put in place, as detailed in their own article on the matter.<ref>{{Cite web \|last=@SpaghettiMonster \|date=2022-11-25 \|title=Answering network security concerns for our printers \|url=https://blog.bambulab.com/answering-network-security-concerns/ \|url-status=live \|archive-url=https://ghostarchive.org/archive/CE0Ii \|archive-date=2026-03-30 \|access-date=2025-05-01 \|website=[[Bambu Lab]] Blog}}</ref>		*"Other malicious devices in the LAN" can be partially mitigated by steps Bambu has already put in place, as detailed in their own article on the matter.<ref>{{Cite web \|last=@SpaghettiMonster \|date=2022-11-25 \|title=Answering network security concerns for our printers \|url=https://blog.bambulab.com/answering-network-security-concerns/ \|url-status=live \|archive-url=https://ghostarchive.org/archive/CE0Ii \|archive-date=2026-03-30 \|access-date=2025-05-01 \|website=[[Bambu Lab]] Blog}}</ref>
Line 58:		Line 59:
	**Confidentiality required by US Law: this is in conflict with users that have to comply with internal U.S. government classified information handling regulations.{{CitationNeeded}}		**Confidentiality required by US Law: this is in conflict with users that have to comply with internal U.S. government classified information handling regulations.{{CitationNeeded}}
	*'''Loss of offline independence while also using cloud''': Before, users could have hybrid offline setups. The requirement for authentication removes this option unless users revert to older firmware versions; Bambu Lab initially indicated rollback would not be permitted, though The Verge later reported that users could still downgrade and use LAN access keys while signed into the cloud.		*'''Loss of offline independence while also using cloud''': Before, users could have hybrid offline setups. The requirement for authentication removes this option unless users revert to older firmware versions; Bambu Lab initially indicated rollback would not be permitted, though The Verge later reported that users could still downgrade and use LAN access keys while signed into the cloud.
	*'''Increased complexity''': The added authentication layer complicates workflows for users who built custom setups or relied on third-party integrations for LAN control while retaining cloud functionality.<ref name=":4">{{Cite web \|~~last~~=@edlboston \|date=2023~~-01~~ \|title=Full Non-Cloud Based Network Option Needed \|url=https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643 \|url-status=live \|archive-url=https://ghostarchive.org/archive/1ee4F \|archive-date=2026-03-30 \|access-date=2025-05-01 \|website=[[Bambu Lab]] Community Forum \|quote=Yes, I know about the LAN mode. But as has been stated by many people, things like the camera will not work, nor will the Handy app. There is no technical reason that these are bound to the cloud. This is the problem and why I titled this FULL Non-Cloud Network.}}</ref>		*'''Increased complexity''': The added authentication layer complicates workflows for users who built custom setups or relied on third-party integrations for LAN control while retaining cloud functionality.<ref name=":4">{{Cite web \|author=edlboston \|date=Jan 2023 \|title=Full Non-Cloud Based Network Option Needed \|url=https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643 \|url-status=live \|archive-url=https://ghostarchive.org/archive/1ee4F \|archive-date=2026-03-30 \|access-date=2025-05-01 \|website=[[Bambu Lab]] Community Forum \|quote=Yes, I know about the LAN mode. But as has been stated by many people, things like the camera will not work, nor will the Handy app. There is no technical reason that these are bound to the cloud. This is the problem and why I titled this FULL Non-Cloud Network.}}</ref>

	*LAN-Only mode in Orca Slicer is implemented by passing API Calls to the installed proprietary Bambu Network Plug-In (unlike BTT and other solutions that did indeed communicate with printer directly via MQTT protocol).		*LAN-Only mode in Orca Slicer is implemented by passing API Calls to the installed proprietary Bambu Network Plug-In (unlike BTT and other solutions that did indeed communicate with printer directly via MQTT protocol).
Line 69:		Line 70:

	===X1E firmware 01.01.02.00 LAN-mode connection failure===		===X1E firmware 01.01.02.00 LAN-mode connection failure===
	Newly received X1E printers with firmware 01.01.02.00 will not connect to the Bambu Studio using the Lan only method password. Bambu Studio identifies the un-logged printer but will not allow a connection to the printer. Only after connection / account pairing is done over the Bambu Handy app by giving internet access to the PC and Printer then using the cloud service connection will Lan only communication and login work.<ref>{{Cite web \|last= \|date=2024~~-09~~ \|title=Connect X1E to stand-alone computer \|url=https://forum.bambulab.com/t/connect-x1e-to-stand-alone-computer/101474 \|url-status=live \|archive-url=https://web.archive.org/web/20260223033045/https://forum.bambulab.com/t/connect-x1e-to-stand-alone-computer/101474 \|archive-date=2026-02-23 \|access-date=2025-05-01 \|website=[[Bambu Lab]] Community Forum}}</ref>		Newly received X1E printers with firmware 01.01.02.00 will not connect to the Bambu Studio using the Lan only method password. Bambu Studio identifies the un-logged printer but will not allow a connection to the printer. Only after connection / account pairing is done over the Bambu Handy app by giving internet access to the PC and Printer then using the cloud service connection will Lan only communication and login work.<ref>{{Cite web \|last= \|date=Sep 2024 \|title=Connect X1E to stand-alone computer \|url=https://forum.bambulab.com/t/connect-x1e-to-stand-alone-computer/101474 \|url-status=live \|archive-url=https://web.archive.org/web/20260223033045/https://forum.bambulab.com/t/connect-x1e-to-stand-alone-computer/101474 \|archive-date=2026-02-23 \|access-date=2025-05-01 \|website=[[Bambu Lab]] Community Forum}}</ref>

	==Implementation timeline and requirements==		==Implementation timeline and requirements==
Line 226:		Line 227:
	==Customer reactions==		==Customer reactions==

	Customer reactions on community forums and Reddit were negative.<ref>{{Cite web \|last=@hho \|date=2025-01-15 \|title=Bambu Studio 1.10.2 Public Beta \|url=https://forum.bambulab.com/t/bambu-studio-1-10-2-public-beta/134549/4 \|url-status=live \|archive-url=https://ghostarchive.org/archive/ahrz6 \|archive-date=2026-03-30 \|access-date=2025-05-01 \|website=[[Bambu Lab]] Community Forum \|quote=Improvements Introduce authorization and authentication protection mechanism: Bambu Studio now supports signing and encrypting control commands sent to printers when the printer supports authorization and authentication protection. The printer will determine whether the commands can be executed. Hmmm. This reads suspiciously vague. It could mean that Bambu printers get an onboard permission handling, so that you can "lock down" your printer and set what commands can be run. But it could also mean that Bambu printers in (or of?) the future will only run Gcode encrypted and signed by Bambu Studio…}}</ref><ref>{{Cite web \|last=@iranintoavan \|title=Firmware Update Introducing New Authorization Control System \|url=https://old.reddit.com/r/BambuLab/comments/1i2psvz/firmware_update_introducing_new_authorization/ \|url-status=live \|archive-url=http://web.archive.org/web/20250403012526/https://old.reddit.com/r/BambuLab/comments/1i2psvz/firmware_update_introducing_new_authorization/ \|archive-date=2025-04-03 \|access-date=2025-05-01 \|website=Old [[Reddit]]}}</ref> Bambu Lab has historically pushed cloud-based printer interaction while offering limited LAN mode functionality<ref name=":4" />. Many customers argue that the security issues this locked-down firmware claims to address are actually consequences of the company's cloud-based design choices rather than inherent risks of local network control.<ref name="bambulab-forum-134549/12" /> After the announcement, Bambu Lab's Trustpilot page recorded a wave of one-star reviews citing the firmware restrictions as the reason for the rating.<ref>{{Cite web \|title=Bambu Lab \|url=https://www.trustpilot.com/review/bambulab.com?sort=recency \|archive-url=https://web.archive.org/web/20250119162028/https://www.trustpilot.com/review/bambulab.com?sort=recency \|archive-date=2025-01-19 \|website=~~[[Trustpilot]]~~}}</ref>		Customer reactions on community forums and Reddit were negative.<ref>{{Cite web \|last=@hho \|date=2025-01-15 \|title=Bambu Studio 1.10.2 Public Beta \|url=https://forum.bambulab.com/t/bambu-studio-1-10-2-public-beta/134549/4 \|url-status=live \|archive-url=https://ghostarchive.org/archive/ahrz6 \|archive-date=2026-03-30 \|access-date=2025-05-01 \|website=[[Bambu Lab]] Community Forum \|quote=Improvements Introduce authorization and authentication protection mechanism: Bambu Studio now supports signing and encrypting control commands sent to printers when the printer supports authorization and authentication protection. The printer will determine whether the commands can be executed. Hmmm. This reads suspiciously vague. It could mean that Bambu printers get an onboard permission handling, so that you can "lock down" your printer and set what commands can be run. But it could also mean that Bambu printers in (or of?) the future will only run Gcode encrypted and signed by Bambu Studio…}}</ref><ref>{{Cite web \|last=@iranintoavan \|title=Firmware Update Introducing New Authorization Control System \|url=https://old.reddit.com/r/BambuLab/comments/1i2psvz/firmware_update_introducing_new_authorization/ \|url-status=live \|archive-url=http://web.archive.org/web/20250403012526/https://old.reddit.com/r/BambuLab/comments/1i2psvz/firmware_update_introducing_new_authorization/ \|archive-date=2025-04-03 \|access-date=2025-05-01 \|website=Old [[Reddit]]}}</ref> Bambu Lab has historically pushed cloud-based printer interaction while offering limited LAN mode functionality<ref name=":4" />. Many customers argue that the security issues this locked-down firmware claims to address are actually consequences of the company's cloud-based design choices rather than inherent risks of local network control.<ref name="bambulab-forum-134549/12" /> After the announcement, Bambu Lab's Trustpilot page recorded a wave of one-star reviews citing the firmware restrictions as the reason for the rating.<ref>{{Cite web \|title=Bambu Lab \|url=https://www.trustpilot.com/review/bambulab.com?sort=recency \|archive-url=https://web.archive.org/web/20250119162028/https://www.trustpilot.com/review/bambulab.com?sort=recency \|archive-date=2025-01-19 \|website=TrustPilot}}</ref>

	As of publication, '''no changes have been announced for owners who never sign their printers into the Bambu cloud service'''. Past firmware updates allowed pairing the slicer via IP address and access key and performing offline firmware updates without ever signing the printer into the cloud, keeping local functionality unchanged.<ref name="firmware-update-introducing-new-authorization-control-system-2" />		As of publication, '''no changes have been announced for owners who never sign their printers into the Bambu cloud service'''. Past firmware updates allowed pairing the slicer via IP address and access key and performing offline firmware updates without ever signing the printer into the cloud, keeping local functionality unchanged.<ref name="firmware-update-introducing-new-authorization-control-system-2" />

	==Comparisons to similar practices by other companies==		==Comparisons to similar practices by other companies==

	Bambu Lab's new authorization and authentication requirements have been compared to a number of practices by traditional printer manufacturers, such as [[HP]] and [[Epson]], who have faced backlash and litigation over [[digital rights management]] (DRM) practices in 2D printers.{{CitationNeeded}}		Bambu Lab's new authorization and authentication requirements have been compared to a number of practices by traditional printer manufacturers, such as [[HP]] and [[Epson]], who have faced backlash and litigation over [[digital rights management]] (DRM) practices in 2D printers.{{CitationNeeded}}

	A parallel from the 3D-printing industry is the 3D-printer manufacturer [[MakerBot]], whose 2012 shift from open-source, DIY-focused machines to closed-source, proprietary machines drove customers to less-expensive open-source competitors, as documented by Hackaday's 2016 obituary of the company.<ref>{{Cite web \|last=Benchoff \|first=Brian \|date=2016-04-28 \|title=The MakerBot Obituary \|url=https://hackaday.com/2016/04/28/the-makerbot-obituary/ \|url-status=live \|archive-url=http://web.archive.org/web/20251208222057/https://hackaday.com/2016/04/28/the-makerbot-obituary/ \|archive-date=2025-12-08 \|access-date=2025-05-01 \|website=[[Hackaday]]}}</ref> MakerBot was also accused of asserting ownership over publicly available, open-source designs uploaded to its 3D print repository, Thingiverse.<ref>{{Cite web \|last=Biggs \|first=John \|date=2014-05-28 \|title=MakerBot Responds To Critics Who Claim It Is Stealing Community IP \|url=https://techcrunch.com/2014/05/28/makerbot-responds-to-critics-who-claim-it-is-stealing-community-ip/ \|url-status=live \|archive-url=http://web.archive.org/web/20251111041317/https://techcrunch.com/2014/05/28/makerbot-responds-to-critics-who-claim-it-is-stealing-community-ip/ \|archive-date=2025-11-11 \|access-date=2025-05-01 \|website=[[TechCrunch]]}}</ref>		A parallel from the 3D-printing industry is the 3D-printer manufacturer [[MakerBot]], whose 2012 shift from open-source, DIY-focused machines to closed-source, proprietary machines drove customers to less-expensive open-source competitors, as documented by Hackaday's 2016 obituary of the company.<ref>{{Cite web \|last=Benchoff \|first=Brian \|date=2016-04-28 \|title=The MakerBot Obituary \|url=https://hackaday.com/2016/04/28/the-makerbot-obituary/ \|url-status=live \|archive-url=http://web.archive.org/web/20251208222057/https://hackaday.com/2016/04/28/the-makerbot-obituary/ \|archive-date=2025-12-08 \|access-date=2025-05-01 \|website=Hackaday}}</ref> MakerBot was also accused of asserting ownership over publicly available, open-source designs uploaded to its 3D print repository, Thingiverse.<ref>{{Cite web \|last=Biggs \|first=John \|date=2014-05-28 \|title=MakerBot Responds To Critics Who Claim It Is Stealing Community IP \|url=https://techcrunch.com/2014/05/28/makerbot-responds-to-critics-who-claim-it-is-stealing-community-ip/ \|url-status=live \|archive-url=http://web.archive.org/web/20251111041317/https://techcrunch.com/2014/05/28/makerbot-responds-to-critics-who-claim-it-is-stealing-community-ip/ \|archive-date=2025-11-11 \|access-date=2025-05-01 \|website=TechCrunch}}</ref>