Bambu Lab Authorization Control System: Difference between revisions
TasmanianRex (talk | contribs) mNo edit summary |
reference formatting |
||
| Line 1: | Line 1: | ||
On January 16, 2025, the 3D-printer manufacturer Bambu Lab announced that future firmwares for their 3D printers would introduce an authorization and authentication protection mechanism for their connection and control, in the name of security. This mechanism restricts the use of third party accessories and slicers, such as Panda Touch and OrcaSlicer. Bambu has stated the following:<blockquote>''"This change is mitigating any risk of remote hacks or printer exposure issues that have happened in the past and also lower the risk of abnormal traffic or attacks."''<ref name="firmware-update-introducing-new-authorization-control-system-22">https://blog.bambulab.com/firmware-update-introducing-new-authorization-control-system-2/</ref><ref>https://all3dp.com/4/bambu-lab-limits-third-party-printer-control-with-new-security-update/</ref></blockquote> | On January 16, 2025, the 3D-printer manufacturer '''[[Bambu Lab]]''' announced that future firmwares for their 3D printers would introduce an authorization and authentication protection mechanism for their connection and control, in the name of security. This mechanism restricts the use of third party accessories and slicers, such as Panda Touch and OrcaSlicer. Bambu has stated the following:<blockquote>''"This change is mitigating any risk of remote hacks or printer exposure issues that have happened in the past and also lower the risk of abnormal traffic or attacks."''<ref name="firmware-update-introducing-new-authorization-control-system-22">{{Cite web |last=@BambuKidd |date=16 Jan 2025 |title=Firmware Update Introducing New Authorization Control System |url=https://blog.bambulab.com/firmware-update-introducing-new-authorization-control-system-2/ |url-status=live |archive-url=https://archive.is/ejq3R |archive-date=16 Jan 2025 |access-date=1 May 2025 |website=Bambu Lab Blog}}</ref><ref>{{Cite web |last=Kohut |first=Adam |date=16 Jan 2025 |title=Bambu Lab Limits Third-Party Printer Control with New Security Update |url=https://all3dp.com/4/bambu-lab-limits-third-party-printer-control-with-new-security-update/ |url-status=live |access-date=1 May 2025 |website=all3dp.com}}</ref></blockquote> | ||
==Controversy regarding firmware updates== | ==Controversy regarding firmware updates== | ||
| Line 5: | Line 5: | ||
===Potential for remote disabling of printers=== | ===Potential for remote disabling of printers=== | ||
A significant concern raised by the community revolves around the wording in Bambu Lab's [[Terms of Service]] and firmware update announcements. Critics and users argue that the phrasing leaves open the possibility for the manufacturer to remotely disable printers that are not updated to the latest firmware. Specifically, Bambu Lab's Terms of Service<ref>https://bambulab.com/en-us/policies/terms</ref> states that printers '''"may block new print jobs"''' if updates are not applied, which some users interpret as a potential pathway for forced obsolescence.<ref name="firmware-update-introducing-new-authorization-control-system-2">https://blog.bambulab.com/firmware-update-introducing-new-authorization-control-system-2/</ref> While defenders of Bambu Lab point out that offline modes such as SD-card printing and LAN-only setups would remain functional, others point out that the Terms of Service do not explicitly limit this restriction to cloud-based printing. This ambiguity has led to speculation that Bambu Lab could enforce broader limitations, effectively rendering printers inoperable for users who choose not to update.<ref>https://old.reddit.com/r/BambuLab/comments/1i45iy2/bambu_lab_reserves_the_right_to_brick_your/</ref> | A significant concern raised by the community revolves around the wording in Bambu Lab's [[Terms of Service]] and firmware update announcements. Critics and users argue that the phrasing leaves open the possibility for the manufacturer to remotely disable printers that are not updated to the latest firmware. Specifically, Bambu Lab's Terms of Service<ref name=":2">{{Cite web |date=24 Apr 2024 |title=Terms of Use |url=https://bambulab.com/en-us/policies/terms |url-status=live |archive-url=https://archive.is/KZqib |archive-date=27 Jan 2025 |access-date=1 May 2025 |website=[[Bambu Lab]]}}</ref> states that printers '''"may block new print jobs"''' if updates are not applied, which some users interpret as a potential pathway for forced obsolescence.<ref name="firmware-update-introducing-new-authorization-control-system-2">https://blog.bambulab.com/firmware-update-introducing-new-authorization-control-system-2/</ref> While defenders of Bambu Lab point out that offline modes such as SD-card printing and LAN-only setups would remain functional, others point out that the Terms of Service do not explicitly limit this restriction to cloud-based printing. This ambiguity has led to speculation that Bambu Lab could enforce broader limitations, effectively rendering printers inoperable for users who choose not to update.<ref name=":3">{{Cite web |last=@nickjohnson |title=Bambu Lab reserves the right to brick your printer until you update the firmware |url=https://old.reddit.com/r/BambuLab/comments/1i45iy2/bambu_lab_reserves_the_right_to_brick_your/ |url-status=live |access-date=1 May 2025 |website=Old Reddit}}</ref> | ||
====Editing of initial announcement==== | ====Editing of initial announcement==== | ||
Bambu users were concerned they would not be able to utilize their printer if they did not install this update, due to the wording of the blog and the terms of service.<ref>[[:File:Bambu tos screenshot.png]]</ref> This caused confusion since users report that Bambu's blog post dated January 16th<ref | Bambu users were concerned they would not be able to utilize their printer if they did not install this update, due to the wording of the blog and the terms of service.<ref>[[:File:Bambu tos screenshot.png]]</ref> This caused confusion since users report that Bambu's blog post dated January 16th<ref name="firmware-update-introducing-new-authorization-control-system-22" /> specifically says the following:<blockquote> | ||
====<sup>What happens if I never upgrade to this firmware?</sup>==== | ====<sup>What happens if I never upgrade to this firmware?</sup>==== | ||
<sup>You may continue using an older firmware version that does not include the new security updates; however, this means the printers may miss out on important security fixes or bug patches included in newer versions. We highly encourage updating to the latest firmware version for the best experience and enhanced security.</sup></blockquote>However, '''this was not present on the day of the announcement.''' A snapshot of their webpage from archive.is demonstrates this section did not exist on the day of the announcement, when community members voiced their concerns.<ref | <sup>You may continue using an older firmware version that does not include the new security updates; however, this means the printers may miss out on important security fixes or bug patches included in newer versions. We highly encourage updating to the latest firmware version for the best experience and enhanced security.</sup></blockquote>However, '''this was not present on the day of the announcement.''' A snapshot of their webpage from archive.is demonstrates this section did not exist on the day of the announcement, when community members voiced their concerns.<ref name="firmware-update-introducing-new-authorization-control-system-22" /><ref>[[:File:2024-01-16-Firmware Update Introducing New Authorization Control System.pdf]]File:2024-01-16-Firmware Update Introducing New Authorization Control System.pdf</ref> Bambu's response to community feedback<ref>{{Cite web |last=@SpaghettiMonster |date=20 Jan 2025 |title=Updates and Third-Party Integration with Bambu Connect |url=https://blog.bambulab.com/updates-and-third-party-integration-with-bambu-connect/ |url-status=live |access-date=1 May 2025 |website=Bambu Lab Blog}}</ref> references ''"social media posts spreading baseless allegations and untrue claims about Bambu Lab",'' including ''"Firmware updates will block your printer’s ability to print.",'' without mentioning the context for those allegations. The context for those allegations was the lack of inclusion of the ''"What happens if I never upgrade to this firmware?"'' in Bambu's initial announcement alongside their stated terms of service. | ||
This announcement, after the edit in question, clearly states in the header - '''''Updated: January 17, 2025''' - to include additional details and FAQs where the '''What happens if I never upgrade to this firmware?''' among others was added.'' | This announcement, after the edit in question, clearly states in the header - '''''Updated: January 17, 2025''' - to include additional details and FAQs where the '''What happens if I never upgrade to this firmware?''' among others was added.'' | ||
As per webpage oldest snapshot from '''archive.is''' <ref | As per webpage oldest snapshot from '''archive.is'''<ref name="firmware-update-introducing-new-authorization-control-system-22" /> dated 16 Jan 2025 17:31 UTC there are two references if choosing to stay on the old firmware:<blockquote> | ||
====<sup> Important Information for End Users </sup>==== | ====<sup> Important Information for End Users </sup>==== | ||
<sup>2. Old Firmware Option: | <sup>2. Old Firmware Option: | ||
| Line 31: | Line 31: | ||
===Debate over "bricking" terminology=== | ===Debate over "bricking" terminology=== | ||
''The debate has also "''extended to the definition of 'bricking':" Some community members assert that if a printer is unable to accept new print jobs without an update, it effectively becomes non-functional and qualifies as being "bricked." Others counter that as long as certain offline functionalities remain (such as SD-card printing) the term does not accurately apply.<ref | ''The debate has also "''extended to the definition of 'bricking':" Some community members assert that if a printer is unable to accept new print jobs without an update, it effectively becomes non-functional and qualifies as being "bricked." Others counter that as long as certain offline functionalities remain (such as SD-card printing) the term does not accurately apply.<ref name=":3" /> | ||
===Privacy policy issues=== | ===Privacy policy issues=== | ||
Bambu Lab's privacy policy, under "Personal Data that we collect," explicitly states: "3D Model in each client ('Printing Files') and other information related to the print job we may store, including start times, finish times, filament consumption and other relevant information."<ref>https://bambulab.com/en-us/policies/privacy</ref> This contradicts their claim that they do not monitor 3D prints. Additionally, the privacy policy webpage is notably excluded from the Wayback Machine, raising concerns about transparency and accountability in their data practices.<ref>https://web.archive.org/web/20250000000000*/https://bambulab.com/en-us/policies/privacy</ref> | Bambu Lab's privacy policy, under "Personal Data that we collect," explicitly states: "3D Model in each client ('Printing Files') and other information related to the print job we may store, including start times, finish times, filament consumption and other relevant information."<ref>{{Cite web |date=25 Mar 2025 |title=Privacy Policy |url=https://bambulab.com/en-us/policies/privacy |url-status=live |access-date=1 May 2025 |website=[[Bambu Lab]]}}</ref> This contradicts their claim that they do not monitor 3D prints. Additionally, the privacy policy webpage is notably excluded from the Wayback Machine, raising concerns about transparency and accountability in their data practices.<ref>https://web.archive.org/web/20250000000000*/https://bambulab.com/en-us/policies/privacy</ref> | ||
===Community strategies to deal with risks=== | ===Community strategies to deal with risks=== | ||
| Line 40: | Line 40: | ||
*Operating printers exclusively in offline modes. | *Operating printers exclusively in offline modes. | ||
*Utilizing LAN connections or VPN setups: this requires an access key from the printer (previously, you could use your cloud credentials over LAN). | *Utilizing LAN connections or VPN setups: this requires an access key from the printer (previously, you could use your cloud credentials over LAN). | ||
*Exploring alternative firmware or third-party scripts to restore full functionality.<ref | *Exploring alternative firmware or third-party scripts to restore full functionality.<ref name=":3" /> | ||
==Bambu Lab's justification and rebuttal== | ==Bambu Lab's justification and rebuttal== | ||
Bambu Lab has stated that the authorization system is in place in order to protect against "remote hacks," "printer exposure," and "abnormal traffic or attacks." There are, however, several ways to mitigate these risks without the loss of user control that their system causes: | Bambu Lab has stated that the authorization system is in place in order to protect against "remote hacks," "printer exposure," and "abnormal traffic or attacks." There are, however, several ways to mitigate these risks without the loss of user control that their system causes: | ||
*'''The "remote hacks" that were cited as an example in the article seem to be a direct result of the 3D-printer vendor not responding properly to a reported security vulnerability in their product.<ref> | *'''The "remote hacks" that were cited as an example in the article seem to be a direct result of the 3D-printer vendor not responding properly to a reported security vulnerability in their product.<ref>{{Cite web |last=Cluley |first=Graham |date=1 Mar 2024 |title=Someone is hacking 3D printers to warn owners of a security flaw |url=https://www.bitdefender.com/en-au/blog/hotforsecurity/someone-is-hacking-3d-printers-to-warn-owners-of-a-security-flaw?ref=blog.bambulab.com |url-status=live |access-date=1 May 2025 |website=Bitdefender}}</ref> Therefore, in order to get attention, the researcher decided to infect machines and display a harmless message to spread publicity.''' Properly responding to security vulnerabilities, working to patch them quickly, and working with the security community (who would be more than happy to help secure products) would be some ways to prevent this. | ||
*In the article cited about printer exposure, the hack was carried out largely because of user misconfiguration.<ref> | *In the article cited about printer exposure, the hack was carried out largely because of user misconfiguration.<ref>{{Cite web |last=Ms. Smith |date=5 Sep 2018 |title=Over 3,700 exposed 3D printers open to remote attackers |url=https://www.csoonline.com/article/566223/over-3700-exposed-3d-printers-open-to-remote-attackers.html?ref=blog.bambulab.com |url-status=live |access-date=1 May 2025 |website=CSO}}</ref> Printer exposure can be mitigated by offering more convenient ways to securely expose printers to the internet, so that users are not tempted to allow unauthenticated access over the network. | ||
*The "abnormal traffic" can be mitigated by steps Bambu has already put in place, as detailed in their own article on the matter.<ref> | *The "abnormal traffic" can be mitigated by steps Bambu has already put in place, as detailed in their own article on the matter.<ref>{{Cite web |title=Summary of Security Incident Responses and Abnormal Cloud Traffic |url=https://wiki.bambulab.com/en/security-incidents-cloud-traffic?ref=blog.bambulab.com |url-status=live |access-date=1 May 2025 |website=Bambu Lab Wiki}}</ref> | ||
*"Other malicious devices in the LAN" can be partially mitigated by steps Bambu has already put in place, as detailed in their own article on the matter.<ref>https://blog.bambulab.com/answering-network-security-concerns/</ref> Another mitigation is to add stronger authentication mechanisms, rather than using a weak pre-shared LAN access code as is currently the case. | *"Other malicious devices in the LAN" can be partially mitigated by steps Bambu has already put in place, as detailed in their own article on the matter.<ref>{{Cite web |last=@SpaghettiMonster |date=25 Nov 2022 |title=Answering network security concerns for our printers |url=https://blog.bambulab.com/answering-network-security-concerns/ |url-status=live |access-date=1 May 2025 |website=Bambu Lab Blog}}</ref> Another mitigation is to add stronger authentication mechanisms, rather than using a weak pre-shared LAN access code as is currently the case. | ||
==Issues with LAN mode requiring authorization== | ==Issues with LAN mode requiring authorization== | ||
[[File:Bambu Connect App - Lan Device Discovery without Bambu Login.png|thumb|Bambu Connect App - Lan Device Discovery without Bambu Login]] | [[File:Bambu Connect App - Lan Device Discovery without Bambu Login.png|thumb|Bambu Connect App - Lan Device Discovery without Bambu Login]] | ||
Bambu Lab printers have the ability to be controlled over both cloud and LAN. This allowed users to integrate their printers into private networks and maintain full control without having to rely on the manufacturer's server while also allowing cloud access. The new authorization system mandates that even LAN-based operations must go through an authentication process using Bambu Connect to retain full control.<ref name="bambu-connect">https://wiki.bambulab.com/en/software/bambu-connect</ref> Full local access is still possible and unchanged for those not using the cloud. | Bambu Lab printers have the ability to be controlled over both cloud and LAN. This allowed users to integrate their printers into private networks and maintain full control without having to rely on the manufacturer's server while also allowing cloud access. The new authorization system mandates that even LAN-based operations must go through an authentication process using Bambu Connect to retain full control.<ref name="bambu-connect">{{Cite web |title=Bambu Connect (beta) |url=https://wiki.bambulab.com/en/software/bambu-connect |url-status=live |access-date=1 May 2025 |website=Bambu Lab Wiki}}</ref> Full local access is still possible and unchanged for those not using the cloud. | ||
This change has drawn criticism for many reasons: | This change has drawn criticism for many reasons: | ||
| Line 58: | Line 58: | ||
**Confidentiality required by US Law - This is in conflict with those that have to comply with 18 CFR § 3a.61, 32 CFR § 117.15, 32 CFR § 2001.47, and other restrictions. | **Confidentiality required by US Law - This is in conflict with those that have to comply with 18 CFR § 3a.61, 32 CFR § 117.15, 32 CFR § 2001.47, and other restrictions. | ||
*'''Loss of offline independence while also using cloud''': Before, users could have hybrid offline setups. The requirement for authentication removes this option unless users revert to older firmware versions, which Bambu does not allow people to do once they have updated to the firmware using the new scheme. | *'''Loss of offline independence while also using cloud''': Before, users could have hybrid offline setups. The requirement for authentication removes this option unless users revert to older firmware versions, which Bambu does not allow people to do once they have updated to the firmware using the new scheme. | ||
*'''Increased complexity''': The added authentication layer complicates workflows for users who built custom setups or relied on third-party integrations for LAN control while retaining cloud functionality.<ref>https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643</ref> | *'''Increased complexity''': The added authentication layer complicates workflows for users who built custom setups or relied on third-party integrations for LAN control while retaining cloud functionality.<ref name=":4">{{Cite web |last=@edlboston |date=Jan 2023 |title=Yes, I know about the LAN mode. But as has been stated by many people, things like the camera will not work, nor will the Handy app. There is no technical reason that these are bound to the cloud. This is the problem and why I titled this FULL Non-Cloud Network. |url=https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643 |url-status=live |access-date=1 May 2025 |website=Bambu Lab Community Forum}}</ref> | ||
It is worth noting that: | It is worth noting that: | ||
| Line 70: | Line 70: | ||
===Precedents and comparisons=== | ===Precedents and comparisons=== | ||
Critics have likened this potential functionality to similar cases in other industries where manufacturers remotely restrict product features. Notable examples include [[HP]]'s printer firmware updates that [[HP Instant Ink|rendered third-party ink cartridges unusable]] and Tesla's software locks on second-hand vehicles. These parallels suggest a broader trend of manufacturers [[Retroactively amended purchase|using software to control hardware capabilities post-purchase]].<ref>https://www.classaction.org/hp-printer-lawsuit</ref><ref>https://www.wired.com/story/tesla-remote-disable-used-car-features/</ref> | Critics have likened this potential functionality to similar cases in other industries where manufacturers remotely restrict product features. Notable examples include [[HP]]'s printer firmware updates that [[HP Instant Ink|rendered third-party ink cartridges unusable]] and Tesla's software locks on second-hand vehicles. These parallels suggest a broader trend of manufacturers [[Retroactively amended purchase|using software to control hardware capabilities post-purchase]].<ref name=":5">https://www.classaction.org/hp-printer-lawsuit</ref><ref>https://www.wired.com/story/tesla-remote-disable-used-car-features/</ref> | ||
===X1E firmware 01.01.02.00 LAN only connection "BUG"=== | ===X1E firmware 01.01.02.00 LAN only connection "BUG"=== | ||
Newly received X1E printers with firmware 01.01.02.00 will not connect to the Bambu Studio using the Lan only method password. Bambu Studio identifies the un-logged printer but will not allow a connection to the printer. Only after connection / account paring is done over the Bambu Handy app by giving internet access to the PC and Printer then utilizing the cloud service connection will Lan only communication and login work.<ref>https://forum.bambulab.com/t/connect-x1e-to-stand-alone-computer/101474</ref> | Newly received X1E printers with firmware 01.01.02.00 will not connect to the Bambu Studio using the Lan only method password. Bambu Studio identifies the un-logged printer but will not allow a connection to the printer. Only after connection / account paring is done over the Bambu Handy app by giving internet access to the PC and Printer then utilizing the cloud service connection will Lan only communication and login work.<ref>{{Cite web |last= |date=Sep 2024 |title=Connect X1E to stand-alone computer |url=https://forum.bambulab.com/t/connect-x1e-to-stand-alone-computer/101474 |url-status=live |access-date=1 May 2025 |website=Bambu Lab Community Forum}}</ref> | ||
==Implementation timeline and requirements== | ==Implementation timeline and requirements== | ||
| Line 105: | Line 105: | ||
===Reduced home-automation capabilities=== | ===Reduced home-automation capabilities=== | ||
While basic status monitoring remains available (e.g., print-progress updates in Home Assistant), the new firmware removes the ability for home-automation systems to control printer functions. Users can no longer: | While basic status monitoring remains available (e.g., print-progress updates in Home Assistant), the new firmware removes the ability for home-automation systems to control printer functions. Users can no longer: | ||
*Start or stop prints remotely using Home Assistant, BTT Panda Touch,<ref name=":0">https://www.facebook.com/BIGTREETECH/posts/pfbid0SNZGxvf7NRdmyVgHf6y9yNedNbU2RrCfdT8gugTSD4AYfr5BHneNF9H1EbwyYiJEl</ref> or other third-party accessories or software interfaces | *Start or stop prints remotely using Home Assistant, BTT Panda Touch,<ref name=":0">{{Cite web |last=@BIGTREETECH |date=17 Jan 2025 |title=Dear Users, Recently Bambu announced some significant changes to how authorization will work with some of their coming firmware updates for the X series (X1, X1C, X1E) of their printers. We want to use this post to explain how it will affect the Panda Touch and how you can still retain full functionality. | ||
The announcement in question can be read here: https://blog.bambulab.com/firmware-update-introducing.../ Below is a bullet point list of the key points and implications from this announcement: - The new authorization control system will be rolled out to the X range of printers on the 23rd of January 2025. - No mention is made of an exact release schedule for the P and A series printers. - The new authorization method will likely limit the control available to third party devices and software on all X series machines. This includes software like Home Assistant, Orca Slicer and the Panda Touch. - A and P series machines will retain full third party software and device control until Bambu release a similar firmware update for those machines. - The firmware updates are optional and any users who wish to retain third party device or software control can choose not to perform the update. - We have reached out to Bambu to try and obtain more information and we will keep users updated as Bambu provides feedback that is approved for public release. Our recommendation is to remain on your current firmware so that you can retain the use of the Panda Touch until we have more clarity about the situation. Sincerely, The BIQU/BIGTREETECH team. |url=https://www.facebook.com/BIGTREETECH/posts/pfbid0SNZGxvf7NRdmyVgHf6y9yNedNbU2RrCfdT8gugTSD4AYfr5BHneNF9H1EbwyYiJEl |url-status=live |access-date=1 May 2025 |website=[[Facebook]]}}</ref> or other third-party accessories or software interfaces | |||
*Control printer temperatures or cooling | *Control printer temperatures or cooling | ||
*Automate printer behaviors based on sensor data or events | *Automate printer behaviors based on sensor data or events | ||
*Access camera feeds through third-party applications<ref name="bambulab-forum-135400/9">https://forum.bambulab.com/t/this-new-auth-system-will-make-me-sell-my-printers/135400/9</ref> | *Access camera feeds through third-party applications<ref name="bambulab-forum-135400/9">{{Cite web |last=@hho |date=16 Jan 2025 |title=Am I wrong in understanding that Bambu Connect is just a upgraded version of what used to be the network plugin? The difference is that it’s not a plugin anymore. The only API offered is signing/sending .3mf files – everything else is only in Bambu Connect, but not available to other tools anymore: No syncing AMS filaments, no access to cloud-synced print profiles, no manually moving/heating the printer, no monitoring progress, no access to the camera etc. So yeah, Orca could probably implement a new “Send” button, but the “Device” Tab will be gone and preparing prints would also be a lot worse… I still don’t fully understand why they’re doing this. If they did it to Bambu Studio as well, then it would make more sense (not linking their closed-source plugin against the GPLd slicer anymore, finally complying with the license), but as it stands it seems they’ll only kneecap Orca (and any goodwill in the community around it). |url=https://forum.bambulab.com/t/this-new-auth-system-will-make-me-sell-my-printers/135400/9 |url-status=live |access-date=1 May 2025 |website=Bambu Lab Community Forum}}</ref> | ||
===Permanent nature of the update=== | ===Permanent nature of the update=== | ||
Once a printer is updated to the new firmware, users can still revert to previous versions that allows full control of the printer using LAN mode access key while signed into the cloud.<ref>https://www.theverge.com/2025/1/21/24349031/bambu-3d-printer-update-authentication-filament-subscription-lock-answers - | Once a printer is updated to the new firmware, users can still revert to previous versions that allows full control of the printer using LAN mode access key while signed into the cloud.<ref>{{Cite web |last=Hollister |first=Sean |date=22 Jan 2025 |title=Here’s what Bambu will — and won’t — promise after its controversial 3D printer update |url=https://www.theverge.com/2025/1/21/24349031/bambu-3d-printer-update-authentication-filament-subscription-lock-answers |url-status=live |access-date=1 May 2025 |website=The Verge}}</ref> The option still exists to disable the cloud service. | ||
The manufacturer states this change is required for security, but community members note that many of the security vulnerabilities being addressed stem from Bambu's own cloud-centric design choices rather than inherent risks of local network control<ref name="bambulab-forum-134549/12">https://forum.bambulab.com/t/bambu-studio-1-10-2-public-beta/134549/12</ref>. The update forces users into using Bambu Connect middleware if they want to retain limited cloud functionality. | The manufacturer states this change is required for security, but community members note that many of the security vulnerabilities being addressed stem from Bambu's own cloud-centric design choices rather than inherent risks of local network control<ref name="bambulab-forum-134549/12">{{Cite web |date=14 Jan 2025 |title=Bambu Studio 1.10.2 Public Beta |url=https://forum.bambulab.com/t/bambu-studio-1-10-2-public-beta/134549/12 |url-status=live |access-date=1 May 2025 |website=Bambu Lab Community Forum}}</ref>. The update forces users into using Bambu Connect middleware if they want to retain limited cloud functionality. | ||
This can be characterised as a significant post-purchase reduction in functionality for existing owners who bought their printers with the understanding they could use third-party software and home-automation tools, but also only affects users actively choosing to use Bambu Cloud at the same time. The nature of the printer update is used to demonstrate how manufacturers can use software updates to unilaterally modify the capabilities of hardware products after purchase, although in this case the changes affect only people already choosing to use the cloud service<ref name=" | This can be characterised as a significant post-purchase reduction in functionality for existing owners who bought their printers with the understanding they could use third-party software and home-automation tools, but also only affects users actively choosing to use Bambu Cloud at the same time. The nature of the printer update is used to demonstrate how manufacturers can use software updates to unilaterally modify the capabilities of hardware products after purchase, although in this case the changes affect only people already choosing to use the cloud service<ref name=":4" />. | ||
For users that would want to use a third-party slicer while using their cloud service, Bambu would require those users to download and install Bambu Connect in order to send gcode wirelessly over LAN or over the cloud. While Bambu claims that they were in contact with SoftFever, the developer of OrcaSlicer, as of writing, SoftFever still does not have any keys for Bambu Connect and the new firmware is only available as opt-in beta at the moment.<ref name=":1">https://x.com/fever_soft/status/1880630570809795034?t=qJyh4SGFZFllcYrqexGW-Q | For users that would want to use a third-party slicer while using their cloud service, Bambu would require those users to download and install Bambu Connect in order to send gcode wirelessly over LAN or over the cloud. While Bambu claims that they were in contact with SoftFever, the developer of OrcaSlicer, as of writing, SoftFever still does not have any keys for Bambu Connect and the new firmware is only available as opt-in beta at the moment.<ref name=":1">{{Cite web |last=@fever_soft |date=18 Jan 2025 |title=This is definitely a bummer. I was negotiating for an authorization key to allow OrcaSlicer to communicate with their device like BambuStudio does, but today I was told they won't support this. Only their slicer can send prints directly; others must use their Bambu Connect application |url=https://x.com/fever_soft/status/1880630570809795034?t=qJyh4SGFZFllcYrqexGW-Q |url-status=live |access-date=1 May 2025 |website=[[X]]}}</ref> | ||
==Impact on functionality== | ==Impact on functionality== | ||
| Line 128: | Line 129: | ||
*Home automation integration beyond basic status monitoring | *Home automation integration beyond basic status monitoring | ||
Previously, third-party software such as OrcaSlicer<ref name="orca-slicer-issue8063">https://github.com/SoftFever/OrcaSlicer/issues/8063</ref> could interact with Bambu Lab printers via the open-source Bambu Studio and proprietary network plug-ins. While Bambu Connect provides a limited URL-based API to initiate prints, most functionality previously openly available is now restricted to Bambu's ecosystem<ref name="bambulab-forum-135400/9" />. | Previously, third-party software such as OrcaSlicer<ref name="orca-slicer-issue8063">{{Cite web |date=16 Jan 2025 |title=FW 1.08.03.00 from Bambu WILL BREAK ORCASLICER for X, P and A series #8063 |url=https://github.com/SoftFever/OrcaSlicer/issues/8063 |url-status=live |access-date=1 May 2025 |website=GitHub}}</ref> could interact with Bambu Lab printers via the open-source Bambu Studio and proprietary network plug-ins. While Bambu Connect provides a limited URL-based API to initiate prints, most functionality previously openly available is now restricted to Bambu's ecosystem<ref name="bambulab-forum-135400/9" />. | ||
Previously, third-party accessories such as Panda Touch would allow users to control their printers with a standalone device. Panda Touch was especially popular amongst P series printer owners since P series printers contain a monochromatic screen with a D-pad by default for printer control whereas Panda Touch is a full-color touch screen that had a small battery so that way users could reposition and detach their Panda Touch off their printers if needed. Users would be able to queue up jobs, jog printer motors, and connect to multiple printers at once in order to monitor print jobs. According to Big Tree Tech (BTT), the manufacturer of the Panda Touch, they urge users of Panda Touch not to update firmware any further since doing so would foreseeably permanently break compatibility with users' printers and their Panda Touch. <ref name=":0" /> | Previously, third-party accessories such as Panda Touch would allow users to control their printers with a standalone device. Panda Touch was especially popular amongst P series printer owners since P series printers contain a monochromatic screen with a D-pad by default for printer control whereas Panda Touch is a full-color touch screen that had a small battery so that way users could reposition and detach their Panda Touch off their printers if needed. Users would be able to queue up jobs, jog printer motors, and connect to multiple printers at once in order to monitor print jobs. According to Big Tree Tech (BTT), the manufacturer of the Panda Touch, they urge users of Panda Touch not to update firmware any further since doing so would foreseeably permanently break compatibility with users' printers and their Panda Touch. <ref name=":0" /> | ||
| Line 175: | Line 176: | ||
==LAN mode and blocked internet access== | ==LAN mode and blocked internet access== | ||
At the time of writing user Tzeny15 on reddit, has authored a five step guide to blocking internet access for the Bambu P1S as a precaution in case the manufacturer attempts to limit functionality for printers without the newest firmware. <ref> https://www.reddit.com/r/BambuLab/comments/1i4vp5i/lan_mode_with_live_view_remote_monitoringcontrol/</ref> | At the time of writing user Tzeny15 on reddit, has authored a five step guide to blocking internet access for the Bambu P1S as a precaution in case the manufacturer attempts to limit functionality for printers without the newest firmware.<ref> {{Cite web |last=@Tzeny15 |title=LAN mode with live view, remote monitoring+control and blocked internet access - a five step guide |url=https://www.reddit.com/r/BambuLab/comments/1i4vp5i/lan_mode_with_live_view_remote_monitoringcontrol/ |url-status=live |access-date=1 May 2025 |website=[[Reddit]]}}</ref> | ||
[[Bambu Lab LAN mode guide|Read the full guide here.]] | [[Bambu Lab LAN mode guide|Read the full guide here.]] | ||
| Line 192: | Line 193: | ||
===Re-engineering printer-control electronics=== | ===Re-engineering printer-control electronics=== | ||
ChazLayyd's Bambu Lab Klipper Conversion project is currently in an incomplete stage<ref>https://github.com/ChazLayyd/Bambu-Lab-Klipper-Conversion</ref><ref> | ChazLayyd's Bambu Lab Klipper Conversion project is currently in an incomplete stage<ref>{{Cite web |last=@ChazLayyd |title=Running Klipper on a Bambu Lab machine by replacing it's internal electronics with readily available open-source hardware. |url=https://github.com/ChazLayyd/Bambu-Lab-Klipper-Conversion |url-status=live |access-date=1 May 2025 |website=GitHub}}</ref><ref>[https://discord.gg/W6B5mBejuC DhazLayyd's Discord Community]</ref>. While the project was not made in response to Bambu's announcement, there has been a wave of new public interest in this specific project. ChazLayyd's documentation instructs P1S owners to non-destructively remove the old control electronics that run Bambu's proprietary software and instructs P1S owners to install off-the-shelf control components so that the existing motor connectors and other critical electronics can communicate with the newly-installed off-the-shelf control components. | ||
https://discord.gg/W6B5mBejuC</ref>. While the project was not made in response to Bambu's announcement, there has been a wave of new public interest in this specific project. ChazLayyd's documentation instructs P1S owners to non-destructively remove the old control electronics that run Bambu's proprietary software and instructs P1S owners to install off-the-shelf control components so that the existing motor connectors and other critical electronics can communicate with the newly-installed off-the-shelf control components. | |||
===Advocacy for open-ecosystem support=== | ===Advocacy for open-ecosystem support=== | ||
| Line 219: | Line 218: | ||
*The requirement to manually export and import files through Bambu Connect creates additional labor | *The requirement to manually export and import files through Bambu Connect creates additional labor | ||
*Integration with existing business systems and workflows becomes more difficult or impossible | *Integration with existing business systems and workflows becomes more difficult or impossible | ||
*Professional users with more than 20 printers report the new workflow as "an absolute nightmare"<ref>https://forum.bambulab.com/t/this-new-auth-system-will-make-me-sell-my-printers/135400/4</ref> | *Professional users with more than 20 printers report the new workflow as "an absolute nightmare"<ref>{{Cite web |last=@drakko |date=16 Jan 2025 |title=Oh, the beta version. Luckily, I don’t allow new firmware on my machine, not until I see multiple validations from trustworthy users. So, in this respect I’m safe. Also, I never trust a beta version, no matter how reliable the releaser is. Thx for the clarification @Square3D . Appreciated. |url=https://forum.bambulab.com/t/this-new-auth-system-will-make-me-sell-my-printers/135400/4 |url-status=live |access-date=1 May 2025 |website=Bambu Lab Community Forum}}</ref> | ||
The solution to the above is not to sign the printer into the cloud. Keeping the printer signed in would be a security oversight in this use case on the part of the print farm. | The solution to the above is not to sign the printer into the cloud. Keeping the printer signed in would be a security oversight in this use case on the part of the print farm. | ||
| Line 230: | Line 229: | ||
*Operational data is processed through Bambu's servers while on a different network. The camera feed, on the other hand, is always peer-to-peer. | *Operational data is processed through Bambu's servers while on a different network. The camera feed, on the other hand, is always peer-to-peer. | ||
*Users have limited visibility into how their data is collected, stored, and used in the cloud | *Users have limited visibility into how their data is collected, stored, and used in the cloud | ||
*The system creates dependence on Bambu's cloud services availability for basic printer functionality<ref name=" | *The system creates dependence on Bambu's cloud services availability for basic printer functionality<ref name=":4" /> | ||
While Bambu Lab maintains that cloud processing is necessary for security and functionality, community members argue this represents unnecessary data collection that could be handled locally<ref name="bambulab-forum-134549/12" />. The company's cloud infrastructure costs are significant, leading some users to speculate that future monetization of the cloud services may be planned<ref name="bambulab-forum-3643/5">https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643/5</ref>. Therefore, people should assess if their use case mandates the use of the cloud service and disable it when it doesn't. | While Bambu Lab maintains that cloud processing is necessary for security and functionality, community members argue this represents unnecessary data collection that could be handled locally<ref name="bambulab-forum-134549/12" />. The company's cloud infrastructure costs are significant, leading some users to speculate that future monetization of the cloud services may be planned<ref name="bambulab-forum-3643/5">{{Cite web |last=@NeverDie |date=Jan 2025 |title=I’m not disagreeing, but as a short-term workaround, are you able to write the print files to an SD card and then print from that? I’m too new to have tried it myself, but I thought that was at least an option. |url=https://forum.bambulab.com/t/full-non-cloud-based-network-option-needed/3643/5 |url-status=live |access-date=1 May 2025 |website=Bambu Lab Community Forum}}</ref>. Therefore, people should assess if their use case mandates the use of the cloud service and disable it when it doesn't. | ||
This shift from local control to cloud-dependent operation is part of a broader trend in consumer devices, where manufacturers use security concerns to justify increased data collection and reduced customer control over devices they bought and paid for. Privacy-conscious users should operate their printers in LAN-only mode to avoid cloud connectivity. | This shift from local control to cloud-dependent operation is part of a broader trend in consumer devices, where manufacturers use security concerns to justify increased data collection and reduced customer control over devices they bought and paid for. Privacy-conscious users should operate their printers in LAN-only mode to avoid cloud connectivity. | ||
| Line 238: | Line 237: | ||
==Customer reactions== | ==Customer reactions== | ||
Customer reactions have been overwhelmingly negative.<ref>https://forum.bambulab.com/t/bambu-studio-1-10-2-public-beta/134549/4</ref><ref>https://old.reddit.com/r/BambuLab/comments/1i2psvz/firmware_update_introducing_new_authorization/</ref> Bambu Lab has historically pushed cloud-based printer interaction while offering limited LAN mode functionality<ref name=" | Customer reactions have been overwhelmingly negative.<ref>{{Cite web |last=@hho |date=15 Jan 2025 |title=Improvements Introduce authorization and authentication protection mechanism: Bambu Studio now supports signing and encrypting control commands sent to printers when the printer supports authorization and authentication protection. The printer will determine whether the commands can be executed. Hmmm. This reads suspiciously vague. It could mean that Bambu printers get an onboard permission handling, so that you can “lock down” your printer and set what commands can be run. But it could also mean that Bambu printers in (or of?) the future will only run Gcode encrypted and signed by Bambu Studio… |url=https://forum.bambulab.com/t/bambu-studio-1-10-2-public-beta/134549/4 |url-status=live |access-date=1 May 2025 |website=Bambu Lab Community Forum}}</ref><ref>{{Cite web |last=@iranintoavan |title=Firmware Update Introducing New Authorization Control System |url=https://old.reddit.com/r/BambuLab/comments/1i2psvz/firmware_update_introducing_new_authorization/ |url-status=live |access-date=1 May 2025 |website=Old Reddit}}</ref> Bambu Lab has historically pushed cloud-based printer interaction while offering limited LAN mode functionality<ref name=":4" />. Many customers argue that the security issues this locked-down firmware claims to address are actually consequences of the company's cloud-based design choices rather than inherent risks of local network control,<ref name="bambulab-forum-134549/12" ,="" which="" continues="" to="" infuriate="" users="" who="" are="" now="" told="" that="" security="" is="" the="" justification="" for="" a="" loss="" of="" freedom.="" as="" result="" announcement="" shift,="" customer="" ratings="" on="" sites="" like="" trustpilot="" rapidly="" dropped,<ref>https://www.trustpilot.com/review/bambulab.com?sort=recency</ref> with many reviews citing the restrictions as the reason for the bad reviews. | ||
The shift raises privacy concerns as the restricted LAN mode functionality will now push more users into Bambu's cloud infrastructure for processing user print data, including file names and print settings. | The shift raises privacy concerns as the restricted LAN mode functionality will now push more users into Bambu's cloud infrastructure for processing user print data, including file names and print settings. | ||
| Line 251: | Line 250: | ||
*'''Forced updates''': Firmware updates have rendered third-party ink cartridges incompatible, forcing users to purchase proprietary consumables. | *'''Forced updates''': Firmware updates have rendered third-party ink cartridges incompatible, forcing users to purchase proprietary consumables. | ||
*'''Restricted features''': Scanner/printer combos that will not scan if the ink is empty. | *'''Restricted features''': Scanner/printer combos that will not scan if the ink is empty. | ||
*'''Consumer backlash''': Users criticized these updates as anti-consumer, with some pursuing [[class action lawsuit|class-action lawsuits]] for deceptive practices.<ref | *'''Consumer backlash''': Users criticized these updates as anti-consumer, with some pursuing [[class action lawsuit|class-action lawsuits]] for deceptive practices.<ref name=":5" /> | ||
Like 2D printers, Bambu Lab's update restricts functionality previously available to users and pushes them toward proprietary software and cloud-based control. | Like 2D printers, Bambu Lab's update restricts functionality previously available to users and pushes them toward proprietary software and cloud-based control. | ||
A parallel specific to the 3D-printing industry can also be drawn from the now-defunct 3D-printer manufacturer [[MakerBot]], whose shift from open-source, DIY-focused machines in 2012 to closed-source, proprietary machines (similarly to Bambu Labs), ultimately drove customers to less-expensive, open-source competitors.<ref>https://hackaday.com/2016/04/28/the-makerbot-obituary/</ref> MakerBot was also accused of asserting ownership over publicly available, open-source designs uploaded to its 3D print repository, Thingiverse.<ref>https://techcrunch.com/2014/05/28/makerbot-responds-to-critics-who-claim-it-is-stealing-community-ip/</ref> These factors contributed to MakerBot steadily losing their position and reputation as an industry leader, before getting absorbed by rival Ultimaker in 2022. | A parallel specific to the 3D-printing industry can also be drawn from the now-defunct 3D-printer manufacturer [[MakerBot]], whose shift from open-source, DIY-focused machines in 2012 to closed-source, proprietary machines (similarly to Bambu Labs), ultimately drove customers to less-expensive, open-source competitors.<ref>{{Cite web |last=Benchoff |first=Brian |date=28 Apr 2016 |title=The MakerBot Obituary |url=https://hackaday.com/2016/04/28/the-makerbot-obituary/ |url-status=live |access-date=1 May 2025 |website=hackaday.com}}</ref> MakerBot was also accused of asserting ownership over publicly available, open-source designs uploaded to its 3D print repository, Thingiverse.<ref>{{Cite web |last=Biggs |first=John |date=28 May 2014 |title=MakerBot Responds To Critics Who Claim It Is Stealing Community IP |url=https://techcrunch.com/2014/05/28/makerbot-responds-to-critics-who-claim-it-is-stealing-community-ip/ |url-status=live |access-date=1 May 2025 |website=TechCrunch}}</ref> These factors contributed to MakerBot steadily losing their position and reputation as an industry leader, before getting absorbed by rival Ultimaker in 2022. | ||
==TOS restricting development of third party devices and accessories== | ==TOS restricting development of third party devices and accessories== | ||
It is understood that the following section has been part of the Bambu Lab TOS at least since January 2024,<ref>https://archive.is/uVLEG</ref> with some users suggesting that the purpose is to restrict development, while others argue that this is a standard clause used by companies around the world<ref> | It is understood that the following section has been part of the Bambu Lab TOS at least since January 2024,<ref>{{Cite web |last=@X1Plus |title=X1plus community Bambu Lab firmware - A win for everyone? |url=https://www.reddit.com/r/3Dprinting/comments/18zaay0/x1plus_community_bambu_lab_firmware_a_win_for/kggqg4n/ |url-status=dead |archive-url=https://archive.is/uVLEG |archive-date=27 Jan 2025 |access-date=1 May 2025 |website=[[Reddit]]}}</ref> with some users suggesting that the purpose is to restrict development, while others argue that this is a standard clause used by companies around the world<ref>{{Cite web |last=@mflexx |title=Not updated. And this part is shared by pretty much every company that has ever existed on this planet. That's just blatant karma farming at this point. |url=https://www.reddit.com/r/BambuLab/comments/1ibhhg7/updated_tos_shots_fired/m9i78kj/ |archive-url=https://archive.is/kKlFU |archive-date=27 Jan 2025 |access-date=1 May 2025 |website=[[Reddit]]}}</ref>. | ||
“ 3.1 You may not use Bambu Lab technology or Bambu Lab intellectual property to develop software or design, develop, manufacture, sell, or license third-party devices/accessories associated with Bambu Lab Product without Bambu Lab's prior consent.”<ref | “ 3.1 You may not use Bambu Lab technology or Bambu Lab intellectual property to develop software or design, develop, manufacture, sell, or license third-party devices/accessories associated with Bambu Lab Product without Bambu Lab's prior consent.”<ref name=":2" /> | ||
==References== | ==References== | ||