Reverse Engineering Bambu Connect

https://wiki.rossmanngroup.com/wiki/Reverse_Engineering_Bambu_Connect

by pabs3 • 2 years ago

532 362 2 years ago

wiki.rossmanngroup.com

ClassyJacket• 2 years ago

I'm so happy Bambu is getting what's coming to them after screwing us so badly <3

BWStearns• 2 years ago

What did they do?

adenta2• 2 years ago

They are locking down their software so you have to use it

bradfitz• 2 years ago

https://hackaday.com/2025/01/17/new-bambu-lab-firmware-updat... has a summary that caught me up. I feel like it must be missing some of the story though.

bdcravens4• 2 years ago

They used a plugin to communicate print jobs (and other integrations), so that third party software could be used pretty seamlessly. Now they're moving to a new authentication model, and will be requiring users to send files to a separate print app. (Bambu Connect) It adds friction to the process, especially for those who were looking to run print jobs at scale, using "print farm" software or building their own solutions.

adenta2• 2 years ago

The A1 mini was my first printer and it just works.

Is there another brand that is idiot proof?

bdcravens4• 2 years ago

Not yet, but other brands are stepping up their quality. I just bought a Creality K2 Plus, and it's almost on par with my X1C (and has some features I prefer, like the CFS, their version of the AMS)

0_____0• 2 years ago

I've been using a Prusa Mk2 for years no with no real issues. Doesn't have the bells and whistles but it does, like, consistently work.

Eventually I'll get a used FormLabs setup. Once I have a shop space set up.

sho_hn• 2 years ago

If you buy a Prusa in non-kit form, it's not any harder to unbox or operate, and more reliable, while generally achieving somewhat better results. Without phoning home and while maintaining the software Bambu forked theirs from.

A recent review coming to a similar conclusion was Maker Muse' review of bedslingers.

It's a channel I respect a lot, because he has over the years relentlessly disclosed emails of companies trying to bribe or lean on him, or threaten him, and refused to play along.

Most other 3D printing content is essentially paid advertising -- including, I suspect, the carefully constructed brand narrative of Bambu as the first "fire and forget" printers, as if they somehow elevated the art form, when really the user experience is not substantially different.

You do not need to tinker or problem-solve with other modern well-reviewing printers, nor do they fail more prints. My MK4 hasn't failed a single print in a year (i.e. since I bought it), and I haven't had to do any sort of maintenance.

rqtwteye• 2 years ago

I bought an A1 after years of fiddling with an Ender. It made 3D printing fun again.

The whole situation reminds me of drones. DJI is (maybe) questionable but their products are without competition when you look at price and quality. Bambu products are also fantastic.

On second thought TP-Link fits too. My TP-Link mesh network just works perfectly. So do their smart plugs.

mitthrowaway2• 2 years ago

I am an idiot, and my Prusa MK3S+ (bought assembled, not as a kit) has been me-proof for years, and delivered fantastic print quality all along. My wife is not a techie and she gets good use out of it too. Their newer printers seem to be even better.

Polizeiposaune2• 2 years ago

Based on recommendations here a couple years ago I built a Prusa Mk3 from a kit (right before the mk4 came out). Building it took a while but I think was a worthwhile investment of my time and I think of it as a system I can understand rather than as a black box.

I had a little bit of trouble with it maybe six months ago (repeatedly tripped offline during prints from a thermal issue) but Prusa's online support talked me through recalibrating it and it's been trouble-free since then.

nicman237• 2 years ago

flashforge is pretty good and by design easy to root.

it is running klipper internally and there are mods to run a completely open source stack (with blobs)

DrBenCarson4• 2 years ago

If you’re looking for a CoreXY machine that can handle more industrial filaments for reasonable money, check out QIDI

throwaway48476• 2 years ago

If 3D printing isn't kept open source there's going to be laws about what you can and can't print that will kill innovation.

s0rce• 2 years ago

The bambu printers haven't been open source.

franga20002• 2 years ago

I can't imagine the printers being open source or not mattering for that, nor can I see any reasonable government banning printing of specific things. If something is illegal to own or manufacture, that already applies to 3D printers just as much as it did to CNC machines or any other method.

floating-io2• 2 years ago

Are you so sure?

https://www.nysenate.gov/legislation/bills/2025/A2228?utm_ca...

Not quite the same, and hopefully likely to fail if it hasn't already, but it shows that interest exists in regulating 3D printers. When enough interest exists, things will happen.

JMHO.

K0balt7• 2 years ago

Yet they have made it so that sophisticated printers must include firmware that refuses to print banknotes.

arduinomancer• 2 years ago

Doubt it

2D printers are not open source and you can still print pretty much anything

gaoryrt• 2 years ago

I don't think you can print cash/paper money.

K0balt7• 2 years ago

No, you can’t. Printer manufacturers are required to prevent printing certain kinds of images on sophisticated printers. And they also print watermarks unique to your printer on every page.

dymk• 2 years ago

Why would some law being passed depend on open source? If anything, that would push some senator to regulate even harder.

c0nsumer9• 2 years ago

I've been following along with a lot of this, because having picked up one of their printers about a month ago, I was immediately very nonplussed with the security. It took some work to get it running isolated on an IoT VLAN, yet still usable from my main machine.

Thus, on first blush, I welcome security improvements from them, but I'm also anxious to see what they hold.

I do wonder where this is going with the keys, because I've seen a lot of "OH LOOK WE HAVE THE KEYS" but nothing about what the keys are used for or how they are useful. Or if they are even useful.

Hopefully there'll be more interesting news about this soon and some solid, technical info.

lvturner4• 2 years ago

My understanding is that if I want to print via LAN, I have to auth against Bambu's internet servers, which is most definitely something I don't want.

Actually for my use case this doesn't work at all -- my printers are region locked to China, but I'm not currently in China so I can't connect to those servers -- meaning (I think!) if I upgrade their firmware, I can't print via LAN on my own local network... which just leaves a bad taste in my mouth.

These are great printers, but there's no need for that.

c0nsumer9• 2 years ago

Can you link to some specific detail on that, because I keep seeing that claim, but without any technical info.

I have a P1S which currently can print completely isolated from the internet. Unfortunately (or maybe not?) the new firmware isn't available for my printer, so I can't dig into it myself yet.

But I'd really like to see some sort of "when I try to do X it tries to connect to Y" or "I used to be able to do X, and now Y is required as demonstrated here".

Something more than the current hearsay and pitchforks echo chamber.

ipv6ipv42• 2 years ago

It's vendor lock-in (or DRM), not security. Security would be a protocol based on a user specific secret that doesn't inherently require locking down anything to Bambu Lab only software (think username/password). Vendor lock-in is about locking the user into using Bambu Lab software, which is what we see here.

You would never allow your bank account to be secured with something akin to Bambu Lab's "security fix".

hWuxH2• 1 year ago

- what the key is used for: signing critical operations, most notably print and gcode commands: https://git.devminer.xyz/archive/bambu-connect/src/commit/47..., list of known MQTT commands: https://github.com/Doridian/OpenBambuAPI/blob/main/mqtt.md

- what the firmware does: verify these operations, meaning it can reject MQTT messages with an invalid/missing signature from third party software

- the big flaw with that approach: by extracting the key, third party software can get full access again

- improvement to security: none (that obfuscation layer doesn't prevent anything if the printer/cloud were vulnerable)

authentication stays the same as before: https://git.devminer.xyz/archive/bambu-connect/src/commit/47...

spaceguillotine• 2 years ago

Bambu should be working on scaling their consumables and customer service, it takes weeks to resolve any tickets, 8 days to a first response has been normal for them.

freefruit• 2 years ago

What can't you fix? All the issues I've had you could find a video on YouTube on what to do.

dawnerd3• 2 years ago

It’s kind of a joke they think they’re ready to roll out a print farm subscription when they can’t even keep basic filament in stock, or like you said even provide basic support. They’ve grown far too quickly.

NelsonMinar• 2 years ago

I am angry at the bait-and-switch Bambu is pulling. I bought one of their printers in the Black Friday sale on the understanding it was reasonably hackable and open. Now they're trying to lock it down so I can't print on my own printer without using their approved software and DRM chain. It's outrageous.

More info on the hacking (the first in what may be a long stupid fight): https://hackaday.com/2025/01/19/bambu-connects-authenticatio...

gjsman-10002• 2 years ago

standing it was reasonably hackable and open

Not sure where you got this idea from. Despite the hacking, print from SD Card remains an option, and the device does not need an internet connection for initial setup. Version 01.08.02.00 is the first firmware version that supports offline updating, even if it is also the latest version.

nialv72• 2 years ago

bait-and-switch? We, those who advocate for open source 3D printers, saw it coming from miles away. This has very very clearly been their plan all along, they themselves said as much (e.g. they are doing the "apple model"). They have been very transparent about this, yet people still fell for it.

hooverd2• 2 years ago

Open source didn't compete on quality for price. I could pay 2k plus 40 hours of my time for a Voron or buy something that just works. I think Prusa only put out their CoreXY offering after they realized Bambu was eating their lunch. The Apple model works because people want to print rather than tinker.

DrBenCarson4• 2 years ago

AFAIK, Apple has never retroactively removed functionality from devices people already purchased

Selling a walled garden is one thing, building walls around a garden you already bought is another thing entirely

maverwa• 2 years ago

As someone who recently bought a bambu printer, I have to agree: I am not surprised. Still disappointed, but in no way surprised. The "apple experience" is why I went for a bambu device (along with the price, and some excellent recommendations from friends). I was even surpised that the "LAN Mode" actually works somewhat good. Should have got a prusa...

BoredPositron• 2 years ago

Come on even makerbot wasn’t that blatant. I believe a lot of us haven’t seen it coming.

LeoPanthera• 2 years ago

"Fell for it" implies that everyone buying a Bambu printer expected some degree of openness. Maybe some customers actually want an "Apple model", where the device mostly looks after itself and "just works" as much as possible.

stavros2• 2 years ago

I bought a printer. It had some stuff. I didn't want that stuff to be gone after I bought it. That's a bait-and-switch, because they didn't explicitly say "be aware, that stuff is going away on Jan 2025".

junon• 2 years ago

Good for you. Kind of a non sequitur, though, and gaslight-ey at that.

nullstyle3• 2 years ago

no, it hasn't been their clear plan all along, and blaming the victims is not advocating for open source 3d printers. Fully open source, DIY 3d printers that are available today suck compared to Bambu. The commercial offerings built on top of Orca (I have a magneto X) suck compared to bambu.

The 3d printing community just slapped down heygears for similar BS to what bambu is pulling right now. Once Bambu hire some better software devs and sort out their issues, open access will return, I bet.

asveikau• 2 years ago

I got into 3d printing a few years ago and noticed the same, bambu made me nervous for exactly this.

But the fanboyism and shilling in the 3d printing community is intense. If you mentioned these misgivings you'd get flamed. If you bought or enjoyed another printer people would advise you to sell it and buy Bambu. Lots of people in various threads seemed to defer to that kind of expert advice.

I think there is/was a similar fanaticism for Prusa going on, but it seems a little less at the forefront since Bambu.

Gigachad2• 2 years ago

You can print of an SD card without any special software or online services, the same as you can on Prusa printers. It's just the server/internet stuff that's locked down. Which I wish was open too, but it's still has fully unrestricted local printing functionality.

hatsunearu5• 2 years ago

https://www.reddit.com/r/BambuLab/comments/1i548m9/this_is_p...

Looks like it's not true?

mattclarkdotnet• 2 years ago

That makes as much sense as saying you bought an Apple laptop expecting it to be hackable

i5heu• 2 years ago

Is this a defect under the EU law?

If so one could get a refund :)

NietTim• 2 years ago

on the understanding it was reasonably hackable and open

I, honestly, have no idea why you thought that. Bambulab has been under fire from the very beginning about not being open at all and not contributing back to the open source community they're build on.

I bought one of their printers during black friday too, it took me a long time to get over the fact that it isn't an open printer, and I never want to go back to tinkering for hours to get meh quality prints.

mls-pl4• 2 years ago

And let them be closed-source as long as they give you ability to print without calling home or even without internet connection.

madeofpalk3• 2 years ago

on the understanding it was reasonably hackable and open

Where did this understanding come from? I'm pretty happy with my Bambu printer, but I was never under any understanding that it was hackable, let alone open. Since the beginning I was slightly frustrated at the RFID fillament spools not being open-enough for others.

nico• 2 years ago

If you are looking for alternatives, I highly recommend the Qidi q1 pro

Despite an initial issue with the hot end (which was easy and fast enough to fix with help from support). I’ve been really happy with it

It prints pretty much anything. Fast, reliable and very cheap compared to equivalent printers in the market

ActionHank2• 2 years ago

Voron for life

dspillett2• 2 years ago

on the understanding it was reasonably hackable and open

While this lock down doesn't seem right it is far from unexpected, I question the amount of research done prior to your Black Friday purchase (BF and well-thought-out-decisions often do not go hang-in-hand!)…

I bought one (an A1 with the multi-material add-on) some months before that in full knowledge that the company would prefer to funnel people into a walled garden because if you look anywhere you'll find proponents of other makes warning that exactly this is possible & likely, with the "must take many steps to print without talking to their servers" being the key evidence in those warnings.

Good reasons to buy a BBL machine (at least my reasoning when I did):

* They work out of the box more so than many of the competition (many will say "X is better or better value, if you spend Y amount of time tuning" which while often correct, I wasn't looking to spend that time tuning), certainly more so than others at similar prices.

* QoL features (good auto leveling, dynamic flow control) that weren't exactly ubiquitous on similarly priced or cheaper machines.

* Certainly in the case of the newest A1/A1-Mini line: a working MMU option cheaper than you find in other ranges (some manufacturers have started addressing this and the out-of-box experience, in their product lines, 2025 could be an interesting year), and very easy nozzle changes (useful if you want to both do detailed minis (without going resin) and mostly larger items).

* For me, the handling of the A1 issues early last year (quickly acknowledging a potential safety issue and publishing mitigation guidelines, full recall or fix-at-home options when it became clear the issue was more significant) was a point in their favour wrt after-sales giving-a-shit. Obviously not a point against others as we don't know how they'd react until it happens, of course. There are regular complaints of slow support response more generally, but there are for other printer manufacturers too and, well, pretty much all consumer facing industry these days.

* The official documentation & videos, maintenance & troubleshooting guides etc, seemed to me to be more coherent than some other offerings (though searching for "<my problem> reddit" is still a thing!).

Absolutely terrible reasons to buy into BBL, long before this storm:

* Openness (software). From the get go their offering has the trappings of a more controlled garden than the 3D printing community were used to.

* Openness (hardware). While there are some compatible 3rd party after-market parts, there isn't the able-to-build-your-own feel you see elsewhere with people using different extruder nozzles, cooling options, and so on.

--------

This isn't a great analogy, but: BBL is an Apple (though not quite on price) to the rest of the 3D printing industry's Linux and it only takes a small amount of information to see that before buying.

If I upgrade (or have to replace, or just decide to get a second) then maybe I'll go elsewhere. I'm more confident I could get other others working well, manufacturers are addressing the points that have allowed BBL to take so much of the market & mindshare in a short time, but the key thing against BBL (not being open like much of the rest of 3D printing) is something I was well aware of when buying (it did make me think twice) so I can't be too mad about it.

Now if they try stop people using 3rd party filament, like the traditional printing industry with ink & toner, which is far from impossible, then I'll feel they've conned me.

dspillett2• 2 years ago

An extra point that it is too late to edit in, on openness wrt software: unlike some companies we could all mention, they are playing right with the slicer software. It is heavily based on earlier AGPL3 licensed software and their work is correctly licensed also: https://github.com/bambulab/BambuStudio/blob/master/LICENSE

There might be some question as to whether anything like the connectivity layer that sits between BS and the printer that currently isn't open, should also be AGPL. I'll leave discussion of how AGPL and losly linked components do/n't work together to people with more experience in the area…

op00to6• 2 years ago

“Hackable” and “open” were never advertised or officially supported by Bambu. It is foolish to make a purchase decision based on an unsupported and unadvertised feature, and while you can be angry that seems silly.

dagmx• 2 years ago

I don’t understand why you think it was hackable or open?

Since the launch of the X1, it’s been closed firmware and tightly controlled. That’s always been the compromise people make to get one.

I’d really like to understand what bait and switch you think has happened, and what you could do before with officially sanctioned methods that you can’t now?

ActionHank2• 2 years ago

They were selling at or sometimes below the price point of printers that you build yourself.

They're good products, and they are clearly selling at a low enough price point to push for market capture.

The pricing, special features tied into their own AMS + filaments, special features tied into their own slicer. These all indicate that they were building towards this sort of behaviour.

gamblor956• 2 years ago

Bambu has never advertised their printers as hackable or open. Indeed, they advertise the exact opposite: that you won't need to do anything to it to get it to work.

That people can hack the Bambu printers is a bonus.

snapetom• 2 years ago

Sorry, but if you did research on Bambu's and came away with them being open and hackable, you didn't do enough research.

I dove into 3D printing a year ago. I settled on the P1S because its reputation for "just working" and good for beginners. I wasn't interested in attaching a Pi to it, run Klipper on it, I wasn't interested in steep learning curves and choosing from a myriad of slicers. I wasn't interested in "calibrating more than printing" with the Enders that one friend warned me about. I needed it for one simple, but big project and it worked great.

Since then I expanded to getting the enclosure, AMS, and messing around with Orca. The Bambu is very accomodating to learn and grow more and I don't regret the decision at all.

bhhaskin3• 2 years ago

I think people are making a big nothing burger out of this.

Bambu is patching a security issue. Personally I don't want any device or application to send any old G-code to my printer. Like say command the printer to basically destroy itself.

Could this lead to completely locking it down in the future? Yes. But they could do that anyways.

I think this is a way to stop getting their pants sued off.

If they really wanted to lock it down they could just make it so everything has to go through their servers and require files to be signed before being read from SD cards.

But instead we really have a half ass attempt.

myself2482• 2 years ago

"Security" on behalf of the user is a complete red herring. You can't print to my 2d printer or my 3d printer, but I can, with "any old device or application". Because they're on my network, not public on the internet.

bhhaskin3• 2 years ago

I disagree. These devices can easily burn down people's homes if given bad G-code. Then they would be sued into the dirt for a security whole a mile wide. Looking at the changes this is about liability.

ipv6ipv42• 2 years ago

Bambu is patching a security issue.

This isn't a security fix. As a security protocol, it wouldn't pass any kind of security audit. A security fix would be something based on a per user credential, not on obscurity.

Personally I don't want any device or application to send any old G-code to my printer.

Username/password over TLS would do that better than what Bambu Lab is proposing, as an extremely simplistic example.

mls-pl4• 2 years ago

And LAN-only mode should work without any external connections yet it looks like it'll require it for authentication. That defeats the whole idea of LAN-only!

hWuxH2• 1 year ago

Username/password over TLS would do that better than what Bambu Lab is proposing

Already works that way and isn't affected by this update: https://wiki.bambulab.com/en/security-incidents-cloud-traffi..., https://github.com/Doridian/OpenBambuAPI/blob/main/mqtt.md#l...

Mashimo5• 2 years ago

Bambu is patching a security issue. Personally I don't want any device or application to send any old G-code to my printer. Like say command the printer to basically destroy itself.

Why not implement some kind of open authentication? One that other slicers can implement.

userbinator• 2 years ago

I'm not surprised that 3D printers are turning out to be as hostile as 2D ones. As usual these days, "security" is the excuse.

goda90• 2 years ago

There's so much open source software, firmware, and hardware out there for FDM 3D printers, I doubt they'll ever get as bad as regular printers. It's much more a tinkerers world than 2D printing ever would be.

jopsen2• 2 years ago

Are regular printers that bad, if buy brother?

I bought a B/W laser printer and have been generally impressed with the lack of BS that came a long with it.

It did ask for toner once, so I bought something from a third-party.

gjsman-10002• 2 years ago

Admittedly, the printing system for 2D Printers is a nightmare. Windows Secured Core PCs, for example, disable all 3rd party printing drivers and only support open driverless standards for printing like Mopria. According to people who have looked at it, let’s just say CUPS in macOS and Linux is not very likely to be a paragon of security, having an RCE scare 3 months ago.

If the printing stacks within operating systems are trash, who knows what horrors your network-connected printer firmware has. (Locking down 3rd party ink cartridges in the name of security - what’s an ink cartridge going to do? Buffer overflow the data it sends to the printer? Oh wait, maybe the printer is that dumb and we’re overthinking this, and it’s more inexcusable than first glance suggests.)

rustcleaner• 2 years ago

With 3D printing out for a while now, there's zero good reason IMHO that there isn't a 2D-plotter retrofit which allows someone to attach one or more [colored] pencils or pens. I'm really shocked the overpriced ink monopolies weren't attacked in this manner, as a young child I distinctly remember a kiosk in a grocery store which 'printed' messages and images on blank cards using colored pencils, for customer order. None of this is remotely new.

krisoft2• 2 years ago

there's zero good reason IMHO that there isn't a 2D-plotter retrofit which allows someone to attach one or more [colored] pencils or pens

This is a thing. Obviously.

https://urish.medium.com/how-to-turn-your-3d-printer-into-a-...

Only a randomly selected tutorial.

I'm really shocked the overpriced ink monopolies weren't attacked in this manner,

Inkjet and laser printers easily print whole page 300 DPI raster images in seconds. Plotters need vectorial data and their printing speed depends on how complicated what you are printing. These things simply don’t serve the same use case. You can do nice art and heart warming cards with a plotter, but you can’t hit print on your boarding card / dhl label / word document and expect your plotter to give you what you see on your screen.

None of this is remotely new.

I agree that none of this is remotely new. Plenty of people tinker with plotters for fun and profit. There are even pre-packaged consumer centric solutions where you pay the price of convenience with lack of freedoms. (See the similar debacle around the Cricut plotters.)

bsder• 2 years ago

I'm really shocked the overpriced ink monopolies weren't attacked in this manner

Because those of us who understand mostly don't care. Those who know bought a Brother laser printer and got on with life.

When those who understand need genuine inkjet prints, we go to a store that owns a printer that is several orders of magnitude better than we will ever need and pay them a pittance to get it printed.

That having been said, I really do wish we had an open source laser printer because, at some point, Brother is going to pull this same bullshit.

lucasoshiro• 2 years ago

Well, at least you can build a 3D printer at home. I built mine years ago (https://lucasoshiro.github.io/hardware-en/2020-06-14-3d_prin...) nowadays you can even build a better one.

whatever1• 2 years ago

You thought you would be able to print copies of commercial things in the comfort of your home? RIAA would like a word with you.

mvdtnz• 2 years ago

Author could start with what this actually is. "An Electron App with Security through Obscurity principles" doesn't tell me much.

dangus5• 2 years ago

I personally think the outrage I've seen on this issue is generally not justified.

In general people are just scared of change and on top of that are playing telephone on the details of the change, assuming the worst intentions from Bambu like they're trying to be the next HP.

I have seen a lot of misinformation on this topic, and I think that in that sense it's a good idea to read the actual announcement details to get a better read on Bambu's intentions: https://blog.bambulab.com/firmware-update-introducing-new-au...

A voice in Bambu's defense on this issue would say:

1. The new firmware isn't out, it's still in beta, and the new connect software is also in beta. This stuff isn't done and nobody has been forced to use it or even had it presented as an OTA update yet. The problems highlighted in this wiki page are very possibly problems that Bambu is aware of and intends to fix before release.

2. Bambu in their blog article stated that they are working on integration code so that third party slicers like Orca Slicer can more directly interface with Bambu Connect (see the FAQ section)

3. There are multiple statements on this blog page where Bambu acknowledges the workflow disruption and emphasizes the things they intend to do and do not intend to do, such as "It’s important to note that this update is not intended to restrict third-party software use. In fact, we’ve actively collaborated with third-party print farm management software providers in the past and continue to support such partnerships. To further improve the user experience, we are introducing a new software solution that will address these limitations and enhance overall print farm management capabilities."

4. People who don't run huge print farms don't seem to be impacted by this. Remember that Bambu claims to be a consumer tech company, right there in the "About Us" section. They are trying to make printers that are easy to use and require minimal tinkering. For a normal person, sending a slice file from Orca Slicer to a separate app (adding literally one step) is not a big deal, you're doing that once per print in a world where typical prints take hours to complete. And with that in mind, Bambu is still saying they intend to provide an integration solution to Orca Slicer in the future to streamline that process.

Whether not the software design is a good architecture is an entirely different issue, and as a beta product I'm not sure we can judge that quite yet. Perhaps they should have hardened their network API more rather than introducing a new app? Perhaps they shouldn't have announced this so publicly before they had a solution for third-party integrations ready?

hatsunearu5• 2 years ago

I mean a reasonable ask would be why can't they push this off until all of that is taken care of?

dangus5• 2 years ago

I think to be fair to them that's literally what they're doing? They're just announcing it ahead of time while it's in beta so we all know about it.

"Starting January 17th, users will have access to the beta firmware"

"Launching first for X Series printers, with P and A Series updates planned for future release"

Szpadel• 2 years ago

well, it's they really meant improving security they didn't do great job, as you can see people broke this security in a day

blocking printing from sdcard in Lan mode basically deny any claims that this change was poorly communicated improvement

dangus5• 2 years ago

They broke the security of a beta product. That’s why it’s beta and not a released product.

LAN mode didn’t exist when this product was first sold, and it was never implemented through the SD card. It was meant to be used through Bambu Studio over your local network.

“Not implemented/not yet implemented” != “blocked”

Someone who bought a Bambu Lab printer early on actually has more ability to use it without a cloud service now than they did when the product was new. Just about everyone who owns a Bambu Lab printer already signed up for a cloud-connected printer.

https://wiki.bambulab.com/en/p1/manual/p1p-firmware-release-...

Spunkie• 2 years ago

Their "update" is a bunch of hand wavy corporate PR bullshit.

Their idea of "working with" the people impacted by this change is just give them a couple of days notice that they are about to be fucked over.

Also the whole "it's just a beta" is such a stupid point I don't even want to respond to it. Truly idiotic.

They are positioning themselves to build a proper walled garden.

That entire blog post could be sumed up as "We know we are doing a shit thing but We. Don't. Care. So it would be great if y'all could just shut up about it until it's more ready."

dangus5• 2 years ago

What do you mean "a couple days notice?" A couple days notice for optional beta firmware availability for only one model with other models having completely undefined release dates. This supposed "short notice" is factually inaccurate.

You can read the blog post that way if you want and insinuate the most negative possible interpretation, but I'm just going through why I choose not to do that.

For one thing, I'm failing to see how this supposed "walled garden" is going to magically materialize and benefit them financially. The best answer I get from all the alarmed people surrounding this subject is that they'll want to charge monthly fees for premium features in the software, especially to print farm owners.

But they don't operate in a competitive vacuum and that would instantly shift users to their competition. Print farm users pay off their equipment very quickly. I've seen cost breakdowns done by actual print farm operators online and the initial and ongoing machine cost is essentially the smallest part of the cost of doing business. Print farmers would pretty much switch away to other brands instantly if Bambu started charging fees for print farm scale.

If they charge even a Netflix-like fee of someting like $20/month, that essentially pays for a $1000 Prusa printer minus the cost of a Bambu printer in only 3 years. They have no room to charge monthly fees against comptetition.

hamandcheese• 2 years ago

Does anyone know what this key is actually used for, and what it enables?

onemoresoop• 2 years ago

I got an A1 mini about a month ago and so far it’s been decent as a beginners printer. I transfer models to the printer via the microSD card and refused to install their networking software on my machine because I don’t trust it’s safe enough. Im also very reluctant to get updates whenever they’re pushed. Maybe im spooked by past bricked devices so I keep all my devices dumb and offline as much as I can.

franga20002• 2 years ago

I was very against Bambu in the beginning for their lack of proper network (not cloud!) support. Then they added LAN mode and I actually considered getting one. Luckily I was lazy and never got around to it. What the fuck Bambu?? Security, really? Not even HP dares to make that excuse...

moooo992• 2 years ago

I mean, I technically see why authentication may be something they want to consider, especially for the less technically inclined users that Bambu is very obviously targeting.

However, this can be easily achieved without bricking every single third party integration. That should simple be a toggle in the settings that works entirely local

iamsaitam• 2 years ago

HP just straight locks you out of your printer unless you pay ransom every month..

JoshTriplett2• 2 years ago

All HP printers still give you the option of paying full price for ink cartridges and owning the printer. The rental model is one they try very hard to steer you into, with lots of dark patterns, but you can still use HP printers with no account and no subscription ink model.

jdietrich• 2 years ago

Bambu Lab have been quite explicit about this. Their consumer-grade printers rely on a cloud service; for people who want or need printing over a private LAN, they offer the X1E.

https://store.bambulab.com/products/x1e

nullc3• 2 years ago

That hasn't been true for years, the regular X1C has an officially supported lan mode and works fine without any of the cloud stuff. (I believe the smaller ones do too, but I haven't used them so I can't speak to them).

ChrisArchitect• 2 years ago

Bambu Lab is a Chinese tech company that designs and manufactures 3D printers

https://en.wikipedia.org/wiki/Bambu_Lab

wongarsu3• 2 years ago

They disrupted the 3d printer market with printers that just work out-of-the-box at at price points where you typically only get enthusiast products that require a lot of tinkering.

A lot of their business model is seemingly based on making long-term sales from consumables. Their solution for multi-color printing is more convenient to use with filament sold by them because they embed information about the filament on proprietary RFID tags.

A couple days ago they announced locking down the API for their most expensive line of printers, locking most API calls to only their own software because of "security". Users are obviously upset.

Rumours for the reasons range from protecting themselves from user mods that replicate the RFID functionality on any filament by configuring the printer via API calls, to Bambu Labs wanting to launch some kind of subscription service for print farms.

imtringued2• 2 years ago

Bambu Lab filament pricing is very similar to Sunlu pricing if you purchase the same minimum quantities as Sunlu, but Bambu Lab has a wider variety of filament that people actually want. The only thing that really helps them make more money is wasteful multi-color printing.

ThouYS• 2 years ago

I wish Prusa weren't asleep at the wheel, then we would have bought a core one (that is, the hypothetical variant with large build volume and same quality as bambulab).

Instead, we bought a P1S, which is, technically speaking, a fantastic machine.

teruakohatu• 2 years ago

Not really asleep at the wheel. More like they invented the wheel, produced the open source slicer (a fork of the original slicer but vastly improved), which was then used by Bambu who could manufacture a printer for less in China rather than in the EU.

Prusa themselves run 600 printers. They are commercial grade. If I was using a printer for commercial design or prototyping I would go with Prusa. Not only because I would prefer my designs were not sent overseas by an always cloud connected printer.

Netcob• 2 years ago

I got my first 3d printer, an MK3S+ a year ago. Pretty late in its lifecycle, but I wanted to spend more time printing than fixing issues.

And it definitely worked! I got the kit and built it within 10h or so (very enjoyable time actually, like building LEGO as a kid) and have printed lots of stuff ever since. During that entire year I only had a clogged extruder one time and had to take that apart a bit. Any other issues I've had were either due to bad filaments or my own errors (not taking long overhangs or low adhesion seriously while slicing).

And all this time I have been using it completely offline with OctoPrint on an RPi.

the_mitsuhiko• 2 years ago

which was then used by Bambu who could manufacture a printer for less in China rather than in the EU.

I'm not at all convinced that Prusa's main issue is the cost. Yes, cost is a huge part of it, but the other one is also just usability. When the X1C launched and later the A1, there was a huge difference in usability between what Prusa and Bambu had. Prusa is catching up and that is good. But they will have to do more on that front still, and the higher cost is less of a concern. It becomes a problem when the more expensive printer is worse too.

bborud3• 2 years ago

I ThouYS may have a point. It seems to me that Prusa were tempted to go after the prosumer/pro market and invested a lot of time and engineering horsepower into higher spec machines (Prusa XL, HT90) and resin printers (SL1S).

A lot of 3D printer companies have tried to go this route. It is not a strategy that tends to succeed.

I don't know their sales numbers, but I would be willing to bet that the ROI on those printers is nowhere near their bread-and-butter, high volume, mass market models.

I think their priority should have been to build something like the Core One (a P1S killer) rather than these expensive and risky forays into pro/prosumer land. The Core one is, realistically speaking, at least 24 months late to market. This was avoidable.

Everyone who operates a 3D printing farm, and who isn't a complete muppet, knows that closed down products like those of Bambu Labs are risky. Both because some 3D printer manufacturers kind of have a history of being dickish, and because the big boys are coming after Bambu labs with their patent lawsuits and whatnot. There are clear risks in dealing with companies like Bambu.

Dealing with Prusa involves significantly less risk. This reduced risk has value. You can charge a bit more for Prusa products due to the reputation of the company.

Most people I know who own 3D printers would rather have done business with Prusa. But Prusa only had the MK4 on offer and were burning cash on, let's be frank, irrelevant vanity projects.

Yes, Prusa were very much asleep at the wheel. Or at least, they had some strategic lapses in judgement. Let's hope they understand their customer base better now. I'd be happy to be a bit patient with them if it means we can get something that performs like Bambu printers, but from Prusa.

I'll even be willing to pay perhaps as much as 20% more just because I trust Prusa more than Bambu.

animex• 2 years ago

Wow, so the actual content is also sent to the cloud? Not just authentication/metadata? Massive overreach. Imagine a inkjet/laser printer company sending every page you printed to their servers? (actually I wouldn't be surprised if HP does this already)

albrewer• 1 year ago

I sold a mk3s because I could never get it to work to my satisfaction. I tried for weeks, trying everything I could find on the internet, using filament supplied by Prusa.

Eventually the print head crashed into a failed print overnight, fusing nearly the entire head inside a ball of PLA filament that formed after the printer happily carried on shoving out molten plastic.

I didn't have another 3d printer to print the replacement parts. I was so frustrated with it at that point I just got rid of it.

Until I can treat a 3d printer like a Brother laser printer (forget about it for 9 months at a time and then have it work perfectly when I need it with zero maintenance), I don't think I'll invest in another one.

KennyBlanken• 2 years ago

Unpacking app.asar without fixing it first will result in an encrypted main.js file and 100 GB of decoy files generated, don't try it.

I know it's not exactly a zip bomb, but it's kinda close, and goddamn, that's obnoxious.

mikelovenotwar• 2 years ago

Commentary on the situation from Louis Rossmann https://www.youtube.com/watch?v=aIyaDD8onIE

dgrabla• 2 years ago

I have Bambu, Qidi and Creality printers. Qidi is a good compromise between open and 'print-quality-out-of-the-box'. My Q1 pro is easy to hack, but I have not done anything to it because it prints pretty much as well as Bambu.

MezzoDelCammin• 2 years ago

I'm kinda curious what will this lockdown do to the efforts to replace their controller and/or firmware with something more open. Something like [1]

It's nice to have a private key to their cloud authentication, but ultimately it's the printers firmware that's the issue. While Bambu owns and updates that, they can change the keys basically anytime they decide that they had enough of the alternative Bambu Connect servers that people will inevitably create with the current keys.

[1] https://github.com/ChazLayyd/Bambu-Lab-Klipper-Conversion

xyst• 2 years ago

I’m not familiar with the 3D printing space, but seems like this reverse engineering was inspired by the companies move to clamp down on security of these devices. [1]

From what I understand, this new auth system would make third party integrations (ie, “OrcaSlicer”) obsolete and users would be limited to controlling the device via Bambu Connect. This update impacts users who control the device via HomeAssistant and “print farm management” users. I guess first party support for users with fleets of these printers is dogshit, thus the need for third party software.

Seems after 3 days of community feedback/outrage, the company is backtracking on the Bambu Connect only route. Instead offering a “Developer Mode” option in firmware which on the surface seems to be what the impacted users need. [2]

In response, we’ve made the decision to implement an optional LAN mode feature, to provide advanced users with more control and flexibility.
Standard Mode (Default): By default, LAN mode will include an authorization process that ensures robust security
Developer Mode (Optional): For advanced users of the X1, P1, A1, and A1 Mini who prefer full control over their network security, an option will be available to leave the MQTT channel, live stream, and FTP open. This feature must be manually enabled on the printer, and users who select this option will assume full responsibility for securing their local network environment. Please note that Bambu Lab will not be able to provide customer support for this mode, as the communication protocols are not officially supported.

Seems this resolves the community concerns. Or am I missing something?

[1] https://blog.bambulab.com/firmware-update-introducing-new-au...

[2] https://blog.bambulab.com/updates-and-third-party-integratio...

modderation• 2 years ago

That's a useful step, but the options are still Full Cloud Dependency or DIY with Zero Security.

Why haven't they implemented rudimentary access control with printer-side Basic Auth (or the equivalents auth for MQTT and FTP). Add optional SSL support to prevent tampering/MITM on a potentially hostile network, and the unauthenticated access concerns listed in [1] should disappear.

Any problems related to potentially damaging instructions should be best-effort mitigated by the firmware and otherwise indemnified by a "your own fault for using a third-party slicer" clause in the EULA.

Bambu Labs shouldn't need to be in the authentication/authorization path, unless we're actively using their cloud environment.

asah• 2 years ago

Their response:

https://blog.bambulab.com/updates-and-third-party-integratio...

hn87262• 2 years ago

Honestly, the response is not that great. Right off the bat they're just going on the defensive, enumerating "false claims" that printer will require subscription etc. But the concern wasn't that Bambu _will_ do that, but that they _could_ do that, and generally that inserting Bambu's infrastructure as a mandatory step in the printing pipeline is _not great_.

Then, the first point in their `truth about the update` section:

This is NOT about limiting third-party software. We're creating Bambu Connect specifically to ensure continued third-party integration while enhancing security. We're actively working with developers like Orca Slicer to implement this integration.

The `we're actively working` with Orca was already addressed by the OrcaSlicer developer [0]

Bambu informed me of this change two days before their announcement.

and Bambu's idea of "working with" is helping to implement redirect from Orca to their own software that would actually start the print. Seems like limiting third-party software to me.

This is beta testing, not a forced update. The choice is yours.

This is bizarre, surely beta firmware is intended to be release firmware at some point? If anything, the community outrage proved beta track to work as intended.

About Panda Touch. We reached out to BTT as soon as we became aware of their product. We warned them that using exploited MQTT protocols...

Also addressed by BQ in [1], tl;dr they tried to work with Bambu but didn't get much response, only a warning that the MQTT might stop working in a future update. So technically Bambu _reached out_, but only to say "don't improve our product". In the end, Bambu is screwing over their customers more than BQ

Further down they still go and defend their decision

When using third-party slicing software like Orca Slicer, the difference in users experience is not much.

and proceed to demonstrate that Orca Slicer will _easily_ open the new app which will be able to start the printing. Which is exactly what the community complained about, and doesn't address things like missing Linux support.

Finally, they're presenting a diagram showing how the new flow looks like. Except the diagram is missing any details about what the new software does — it doesn't show how, when and why the new software communicates with the cloud.

For someone with even cursory understanding of security, the changes just don't make much sense, and Bambu is not doing much to explain the security protocols they're trying to implement. For all I know they just slapped a private certificate somewhere in the Bambu Connect app and started signing requests to the printer, which doesn't improve security at all if the private key is already public

[0] https://github.com/SoftFever/OrcaSlicer/issues/8063#issuecom...

[1] https://old.reddit.com/r/BIGTREETECH/comments/1i5lzzf/latest...

elcapitan• 2 years ago

As a precaution, I've blocked my A1 mini from Internet access on the router, and will not apply any firmware updates anymore. I will also not update Bambu Studio anymore (or completely switch to Orcaslicer). I was already using LAN mode exclusively.

Kind of annoying, but I'm not desperately waiting for Firmware updates, everything works fine so far.

05• 2 years ago

RMS was right

shul• 2 years ago

Bambu sent out a clarification in their blog, you should read it

broadsidepicnic• 2 years ago

no need linking it, tho

blutack• 2 years ago

I'm interested what others think of their existing design and whether there are any fundamental security issues that will be resolved by their proposed change.

They are proposing requiring a secret signed certificate to carry out any actions beyond monitoring for both the cloud and local (on printer) MQTT servers. These certificates would be issued at the discretion of Bambu by their CSR, currently only for "Bambu Studio" their slicer, Bambu Handy (their mobile app) and "Bambu Connect" which will enable upload G-Code generated by third party slicer (a workaround for existing functionality being removed). This "secret" certificate has already been extracted from the Bambu Connect application as per the article as their new security model requires embedded this certificate into desktop applications.

The current design:

https://github.com/Doridian/OpenBambuAPI/blob/main/mqtt.md

Connecting to their cloud MQTT requires a username and token already. These details are obtained via a HTTPS request to their login server using your bambu account (which requires a valid email & possibly captcha) to obtain a token. The cloud MQTT is TLS secured, although this is just to encrypt the traffic (aka HTTPS), it is not mutual authentication.

Connecting to the MQTT server hosted on the printer (aka LAN mode) requires a fixed username and a local access token (a random 8 digit number). This can be found via the physical display of the printer in a menu (or apparently cloud MQTT!?). This access token can be refreshed via a menu option again physically at the printer. To be clear, this token only allows to you connect directly to the local MQTT server running on the IP address of the printer, so in most environments this should only be the local network. This is also the password for the FTP server that can be used to upload/download sliced 3mf/gcode files.

Personally - this design seems ok to me? With an MQTT service properly configured to isolate user accounts from each other, this is a pattern widely deployed for embedded devices (Azure IoT, AWS IoT etc).

I don't see how the "DDOS" related issues they are claiming would be related to this specific design. If the issue is in the login server - well, that's prior to authentication anyway so nothing they are doing here will fix that.

If it's problems with your cloud MQTT service not being properly isolated - maybe fix that? If the DDOS is at L2, auth isn't going to help. You require logins tied to an email, you can block clients that misbehave once they are logged in.

Nobody is brute forcing the local MQTT server via XSS or something, because JS doesn't allow for raw TCP connections. Are they concerned about malicious software already on the network? Then rate limiting on the printer side or switch to a random length alphanum LAN token to increase keyspace.

I'm curious what more qualified people think, I cannot see any justications for their proposed design improving security. So either;

a) They've decided they are incapable of properly securing their MQTT cloud stuff and instead of fixing that just want to assume every client connected to their cloud MQTT servers is fully trusted. I'm sure that'll work great. Doesn't justify adding this to the local MQTT servers on the printers - if anything that reduces security, as to roll certificates you now have a long tail of printer firmware updates.

b) It's not about security

vanillax• 2 years ago

This is all nonsense. I just got a a1, and its my first 3d printer. I dont have any expertise. Ive been able to use the Bambu App and Maker world and basically control+P. Ive print about 10 things so far in the first week. I dont see why people are mad. They made the apple of printers. It just works(tm). I dont need anything else. People just get so upset over nothing.

mmorriso2• 2 years ago

I tend to agree. I've built a Prusa previously and my P1S is just so much more reliable, it's the first printer I've been able to recommend to friends and colleagues who I wouldn't expect to enjoy tinkering with a printer but would enjoy printing.

I have simply not had a failed print, it's incredible. I have so much confidence in the unit that I now keep two rolls of the same colour loaded and if I find a cool model while out and about, I just print it with full trust it'll be waiting for me by the time I get home. Amazing progress.

nirav72• 2 years ago

I've been on the fence about purchasing a Bambu. But given the amount of time I've spent over the past few years having to tweak my ender 3 V2 and CR-10- I was leaning towards finally splurging on a X1C.

Question to those more familiar with the bambu software ecosystem - do these recent changes to authentication require a constant online connection to print anything from a machine on the LAN? I'm assuming printing via microSD will still be possible?

d1str02• 2 years ago

I’m not familiar with Bambu, I’m a Prusa user, but if I had to guess you would always be able to print via microSD. It would be wildly unpopular to disable local printing.

mmorriso2• 2 years ago

Currently, LAN mode and local SD card printing does not require an internet connection. I have my printer in a bottom of the yard bungalow, without internet, and it works fine.

jchw• 2 years ago

I bought a Bambu Lab printer recently, and made the decision that if I did connect it to LAN, I'd make damn sure that it did not have an Internet connection, even though there is a LAN mode toggle in the firmware it shipped with. Although I am definitely paranoid about Internet-of-Shit bait'n'switch techniques, at the time I was mostly thinking in terms of geopolitical bullshit rather than capitalistic shenanigans. No particular reason to distrust Bambu Lab themselves at the time, at least more than any other company.

Obviously, hingsight is 20:20, but it's just a reminder: your cynicism is warranted. Don't trust anyone any more than you absolutely have to.

DoctorOetker3• 2 years ago

according to [0] the ipcam is logging video even when the camera is disabled.

I suggest we collectively print Tiananmen Square Tank Man scenes.

[0] https://www.reddit.com/r/BambuLab/comments/1i548m9/comment/m...

buckle80172• 2 years ago

these printers have spaghetti detection so it actually makes sense the camera is always on

DoctorOetker3• 2 years ago

it does not make sense: spaghetti can be detected without logging it, just process and evaluate frames, and if necessary accumulate multiple evaluations (not images) to achieve better signal to noise ratio.

wpm2• 2 years ago

Spaghetti detection is supposed to happen on-device.

bigiain• 2 years ago

I suggest we collectively print Tiananmen Square Tank Man scenes.

Anyone got a link to a good .stl?

DoctorOetker3• 2 years ago

we will have to make one, I suggest we also use machine translation to include the historical background into the print in their own language.

whatevermang• 2 years ago

Maybe I'm the exception here, but I slice my files and then load them to an SD card and walk them over to my printer. It's not high tech, but since you can't clear the build plate without physically being there, I don't see much of a change. If I really wanted to monitor the build I suppose I could just point a webcam at it rather than use the existing one. But since it prints flawlessly most of the time it seems unnecessary.

GuB-422• 1 year ago

you can't clear the build plate without physically being there

BambuLabs printers may not support this but some people do it. The idea is to use the print head to knock the part out of the bed and into a bin. Probably not worth the hassle for personal use and you may need to design the part a certain way to make it possible, but it is useful for mass production.

dlgeek2• 2 years ago

What I don't get...BambuSlicer is open source. And, not only is it open source, it's a fork of PrussaSlicer, so Bambu doesn't have the ability to re-license it.

It's licensed under the Affero GPL which is very strict about the licensing of derived works. That license requires Bambu to include the source code to any additions they make, including all of the logic, keys, etc. that they're baking into any binary distributions. If they don't, they're violating the copyright rights of Prussa and many others.

So, either Bambu has to open source all of this, which defeats the purpose (given that it's already leaked, that's gonna happen anyway) or they have to route everything through a separate program for their own slicer.

whatsthatabout• 2 years ago

BambuConnect is not part of BambuStudio - That's intentional, so BambuLab does not need to share/open-source it.

The current implementation (the Bambu network plugin thingy) isn't a part of it either, it's downloaded by the client when BambuStudio is opened.

dlgeek2• 1 year ago

They claimed that studio wouldn't need connect.

I don't know AGPL well enough to know if a plugin is considered a derived work but it sure seems to imply it:

For example, Corresponding Source includes interface definition files associated with source files for the work, and the source code for shared libraries and dynamically linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those subprograms and other parts of the work.

Reverse Engineering Bambu Connect

Related Stories