Bambu Lab Blog

A lot of the distrust toward Bambu is because they originally announced cloud auth would be required even for printing locally in LAN mode, and only backpedalled on that when they saw the backlash. I'm not sure why their entire domain has been excluded from archive.org but you can still see the original post for now: https://blog.bambulab.com/firmware-update-introducing-new-authorizatio… -- Critical Operations That Require Authorization The following printer operations will require authorization controls: Binding and unbinding the printer. Initiating remote video access. Performing firmware upgrades. Initiating a print job (via LAN or cloud mode). Controlling motion system, temperature, fans, AMS settings, calibrations, etc.

Where do you see that? Seems one can still print via SD cards without any issue. It says: Operations That Do Not Require Authorization The following actions will remain unaffected by the authorization mechanism: Sending status information from the printer (e.g., MQTT status push for tools like HomeAssistant). Starting a print job using SD cards. General operations outside the listed authorization controls. https://blog.bambulab.com/firmware-update-introducing-new-authorizatio…

From their blog post: https://blog.bambulab.com/firmware-update-introducing-new-authorizatio… "Critical Operations That Require Authorization The following printer operations will require authorization controls: Binding and unbinding the printer. Initiating remote video access. Performing firmware upgrades. Initiating a print job (via LAN or cloud mode). Controlling motion system, temperature, fans, AMS settings, calibrations, etc." Now, PERHAPS, I can do that authentication locally... but given the plugin required for OrcaSlicer it doesn't seem likely

There is now a set of critical operations, among them starting printing operations via LAN which "unauthorized third party tools" are no longer allowed to perform. The most interesting information is in this setion and the following one: https://blog.bambulab.com/firmware-update-introducing-new-authorizatio…

Hi there! I’ve been working in the 3D printing industry for 10 years and recently joined Bambu Lab because, in my experience, they offer the best products on the market with an exceptional user experience. I recently wrote an article that might help you decide: https://blog.bambulab.com/why-a-3d-printer-makes-the-perfect-christmas… When choosing a 3D printer for your 6-year-old, user-friendliness is definitely key, and that’s an area where Bambu Lab excels. Printing with your kids is such a rewarding experience! If you have any specific questions, feel free to ask—I’m happy to help.

From their post-mortem: https://blog.bambulab.com/cloud-temporary-outage-investigation > The result was that the print job was successfully completed on the printer, but our cloud service believed it had not been done. When service resumed, the once-jammed job was resent, leading to the unexpected printing of an already finished job. That's why you make message sends in a distributed system idempotent, unless you have a really excellent reason not to. Whatever generated the print job when the user pressed “print” should have generated a unique job id, and when the printer was resent the same job id it should just have replied “Done”.

> I'm not sure why their entire domain has been excluded from archive.org So when they claim “we never said that” it is less easy to prove that to be an, erm, incorrect statement of truth. It could be an accident due to over-doing scraper protection, but given the company's general behaviour of late I'm inclined to consider the negative interpretation more likely. > but you can still see the original post for now: https://blog.bambulab.com/firmware-update-introducing-new-au... I'd hazard a guess that that is not entirely the original post as it was before things erupted. There have been a couple of instances of materially changed posts.

...nope...? the Ukraine war started in 2014 technically. But even if we go to the "current" wave start, that was 24 February 2022[0]. Bambu Labs released their first printer (X1C, on kickstarter) on 31 May 2022, let alone their "must go through cloud service" restriction starting in early 2025[1]. [0]: https://en.wikipedia.org/wiki/Russo-Ukrainian_war [1]: https://blog.bambulab.com/firmware-update-introducing-new-authorizatio…

Lan Only works by making you use the Bambu connect software. If the Bambu Connect software isn't running, Orca cannot start a print job or control the printer. It doesn't sound too onerous, but it should be mentioned that LAN only wasn't added till users gave 'feedback'. I suspect the original intent was Bambu Slicer only. https://blog.bambulab.com/updates-and-third-party-integration-with-bam…

Their response: https://blog.bambulab.com/updates-and-third-party-integration-with-bam…

Some A1 context, they have/had problems with the A1 resulting in a full recall: https://blog.bambulab.com/a1-recall-update/

The statement that Bambu release about it seems ok from the technical side: https://blog.bambulab.com/cloud-temporary-outage-investigation/ There's no real detail as to whether they're really trying to make whole anyone who's printer was damaged. Just the standard "contact us" type of thing: If you were affected by this cloud outage, and your printer has suffered any damage, please don't hesitate to contact our Support Team at Bambu Support. So, bit hard to tell without hearing from any affected users who have contacted their support.

Here's Bambu's response, for the interested: https://blog.bambulab.com/update-for-cloud-downtime/

I’m not familiar with the 3D printing space, but seems like this reverse engineering was inspired by the companies move to clamp down on security of these devices. [1] From what I understand, this new auth system would make third party integrations (ie, “OrcaSlicer”) obsolete and users would be limited to controlling the device via Bambu Connect. This update impacts users who control the device via HomeAssistant and “print farm management” users. I guess first party support for users with fleets of these printers is dogshit, thus the need for third party software. Seems after 3 days of community feedback/outrage, the company is backtracking on the Bambu Connect only route. Instead offering a “Developer Mode” option in firmware which on the surface seems to be what the impacted users need. [2] > In response, we’ve made the decision to implement an optional LAN mode feature, to provide advanced users with more control and flexibility. > Standard Mode (Default): By default, LAN mode will include an authorization process that ensures robust security > Developer Mode (Optional): For advanced users of the X1, P1, A1, and A1 Mini who prefer full control over their network security, an option will be available to leave the MQTT channel, live stream, and FTP open. This feature must be manually enabled on the printer, and users who select this option will assume full responsibility for securing their local network environment. Please note that Bambu Lab will not be able to…

I sorta get what you're saying, and the flowchart here (https://blog.bambulab.com/updates-and-third-party-integration-with-bam… somewhat agrees. But where I disagree is with that cert stuff. 1) That cert is on the /client/ side, not in the printer. It has nothing to do with printer functionality, only with talking to the printer. 2) Expired certs do not mean things automatically get rejected. Using and allowing expired or self-signed certs is routine in the IoT world where certs on devices can't readily be updated. But again, that cert isn't from the printer. 3) Expired certs, just like the self-signed certs that are so commonly used, still result in things being encrypted on the wire. And often that's the point. It seems to me that someone found/exported the cert, and is trying to make all sorts of WHAT-IF or THIS-COULD-MEAN-THE-WORST claims but are lacking some significant understanding. Without understanding the architecture and the rest of the code, and perhaps seeing that cert be used, this is just an artifact found in the distributed beta application.

I personally think the outrage I've seen on this issue is generally not justified. In general people are just scared of change and on top of that are playing telephone on the details of the change, assuming the worst intentions from Bambu like they're trying to be the next HP. I have seen a lot of misinformation on this topic, and I think that in that sense it's a good idea to read the actual announcement details to get a better read on Bambu's intentions: https://blog.bambulab.com/firmware-update-introducing-new-authorizatio… A voice in Bambu's defense on this issue would say: 1. The new firmware isn't out, it's still in beta, and the new connect software is also in beta. This stuff isn't done and nobody has been forced to use it or even had it presented as an OTA update yet. The problems highlighted in this wiki page are very possibly problems that Bambu is aware of and intends to fix before release. 2. Bambu in their blog article stated that they are working on integration code so that third party slicers like Orca Slicer can more directly interface with Bambu Connect (see the FAQ section) 3. There are multiple statements on this blog page where Bambu acknowledges the workflow disruption and emphasizes the things they intend to do and do not intend to do, such as "It’s important to note that this update is not intended to restrict third-party software use. In fact, we’ve actively collaborated with third-party print farm management software…