muesli
BambuLab basically closes down their entire 3D printer ecosystem with this ridiculous cloud authorization system.
Would it really still surprise anyone if DRM'd filaments are next on their agenda? Their printers are good, their prices are cheap, but please, stop supporting this company.
https://blog.bambulab.com/firmware-update-introducing-new-authorization-control-system-2/
muesli
Honestly, get something else. There are other manufacturers that offer you the same experience and (arguably even more) quality for just a little more money.
You get actual open interfaces and standards in return and they support their stuff for many years. You'll not run the risk of being locked out of your own machine and you will be able to print whatever filament you please.
Prusa, RatRig, Voron.
Marcus Noble
@fribbledom well damn! I was wanting to get one of their Printer but now... maybe not
Karel Gillissen
@fribbledom
Ridiculous. I’m not going to install the ‘upgrade’.
muesli
Well yes, except that at this point I fully expect one of their next printer generations to enforce using only tagged & Bambu-authorized filaments.
It'll be HP e-ink cartridges all over again.
Jess
@fribbledom filament DRM? You mean like this? https://forum.bambulab.com/t/if-we-cant-program-our-own-rfid-tags-please-sell-standalone-tags/24556
muesli
Until at some point in the near future:
"We're sorry, but we had to reject printers with outdated firmware versions from connecting to the Bambu cloud. For, ahem, security reasons."
muesli
I mean, Creality has its own weird history of open source & copyright infringements (among other problems)... but yes, at this point they at least act a lot more open-minded than Bambu and some of their other competitors.
Adriana Knouf
@fribbledom very glad I went with Creality rather than Bamboo for my last purchase. The Bamboo hype from influencers on YouTube almost got me, especially as Bamboo doesn't go out of its way to promote how proprietary it is...you have to dig a bit to realize that.
Tᴀᴋᴀɴᴀsʜɪ Hᴏʀᴏ
@Karelgil@mastodon.social @fribbledom@mastodon.social shameless plug for https://gitea.angry.im/PeterCxy/bambu.sh
well, it doesn't give you the same Bambu Cloud experience, but it has been the only way i use my Bambu P1S for a long while. I have not let this thing on the internet and I am not going to, ever.
muesli
Just make sure to now never upgrade to future firmware releases ;-)
Karel Gillissen
@fribbledom
Probably, but who needs the cloud anyway. We’ll see what will come. I can imagine that they will create an extra security layer around their cloud. But I don’t think they can lock out the users on LAN-mode.
muesli
At least in the long run this certainly works out.
Beady Belle Fanchannel
@fribbledom @eletious Maybe that’s why the printers are so cheap? The business model is selling filament?
Andreas Schneider
@fribbledom Welcome to the world of paper printing 😉
Andreas Bulling
@fribbledom
#prusa for the win!
Anton Piatek
@fribbledom the main reason I'm on my 2nd prusa printer is because of their commitment to open source
Howard Chu @ Symas
@fribbledom nobody learned this lesson already from Lexmark?
Bowreality
@fribbledom Thanks for the warning. I was thinking about getting one
muesli
Vorons aside, I'll take Prusa's interpretation of "open" any day over most of their competitors.
While the design isn't entirely open any longer, they still support open interfaces, have an open-source slicer and firmware.
If more companies worked like that, the world would already be a much better place 😆
John
@fribbledom @Marcus prusa arent exactly open anymore either.
muesli
Huh? Where did you read about opening the nextruder breaching the warranty?
I have a couple of them here and I wouldn't exactly describe it as proprietary.
Koz Ross
@zeitkunst @fribbledom Prusa haven't been all that open-source in truth or spirit for quite some time. Their 'open hardware' claims around the Mini are 100% a lie, and the MK4 is so proprietary that _opening up its extruder_ without a support staffer telling you to is a warranty breach.
Adriana Knouf
@fribbledom for sure. Wish I could afford Prusa, but that's not possible right now....
muesli
With this firmware update the printer will reject any unsigned g-codes, even when you print in LAN mode.
micha
@fribbledom @claudius what is the point?ni didn't get it. You just can go LAN only..
It am i missing sth?
muesli
Exactly.
micha
@fribbledom @claudius WTF?
RejZoR
@fribbledom I love my old and basic Ender 3 V2 because of how open and customizable it is. Works fully offline, I flashed it with custom firmware that gives it cool features and has been reliable machine to print incredible parts that I sliced with Cura. Honestly, I'd avoid buying anything that locks me down and thus I now know to avoid Bamboo when looking for new 3D printer...
🌱💜 Ellen 🇺🇦
@fribbledom
What's, in your opinion, the alternative?
muesli
Probably a company with a track record of supporting open standards & interfaces.
Check out Prusa, RatRig, Voron.
If you're looking for a specific model, I'm happy to help.
muesli
Maybe it would also help if half of the machine's features didn't depend on being online at all times 🙄
Chewie
"Why is this change needed?
Additionally, over the past year, we've detected an increase in the number of requests made to our cloud services through unofficial channels."
So, in other words:
"Because our cloud security is shit"
muesli
I apologize if I misunderstood that, but their blog post sadly isn't overly specific in that regard.
In some ways that would be even worse, because that would mean now you're supposed to not only run proprietary code on your printer, but also your on your desktop.
Alas, enough alternatives still out there.
Benjamin Monjoie :verified:
@fribbledom I'm not happy with this either but I think you got something wrong. You are required to use a Bambu software but where does it say it needs to call their cloud to sign the gcode? My understanding is that the tool (Studio or Connect) will sign the gcode, not the cloud.
Alien software, human hardware
@fribbledom told you so.
(Well, not you specifically, but everyone who would listen, not to buy a bambu)
muesli
... it ain't no lie, Bambu bye-bye-bye!
GoatsLive
@fribbledom Crap like that is why I still don't own a 3D printer! I really want one too!
Alexandre Oliva (moving to @lxo@snac.lx.oliva.nom.br)
muesli
That's indeed a good alternative, even though I'd probably wait for the Prusa Core One which is about to be released at the end of this month.
Alex
@fribbledom I never had a 3D printer. What’s the better alternative? A Prusa Mk4?
muesli
Too early to make that move. Once we're closer to a monopoly, they'll pull that rug under our feet.
Steffo
@fribbledom tbh i'm surprised they haven't DRMd filaments already, given that they're already attaching RFID tags to them
muesli
You will still be able to generate g-code with other slicers, but they won't be able to directly communicate with your printer. You will have to use their new proprietary app to send it to the machine. Even locally.
ttk✔️ (DO1TTK)
@fribbledom it _literally_ says that you won't need any auth whatsoever when you want to print locally.
It also _literally_ says that printing from other slicers would still be possible
muesli
...and less than 24 hours later, the BambuConnect app has been de-obfuscated, including Bambu's private key to sign HTTP requests.
https://hastebin.skyra.pw/pufugimoye.js
So much for their laughable security claims.
muesli
Can't wait for the next firmware upgrade 🤣
muesli
@kitsune_yasu I didn't claim otherwise. But let's not pretend this has anything to do with security.
Kitsune Yasu
@fribbledom@mastodon.social that's not true, you still can use other Slicers as described in the linked article, you just need an additional piece of software to sign your requests, to make sure that the printer cannot be used from unauthorized users
muesli
It's not misleading at all. It's exactly what's happening: you can not use another slicer to send your job to the printer.
They're doing all this in the name of security and then offer a solution that literally ships their private key to everyone's desktop. It's been leaked by now. This entire situation is so ridiculously amateurish, I don't even know what to say.
Kitsune Yasu
@fribbledom@mastodon.social Want to use another slicer to send your job to the printer? Sorry, no.I'd argue that this part is quite misleading.let's not pretend this has anything to do with securityWell, if you want to make sure, that only authorized people can use the printer, than you need to add an authentication layer into the current protocol.
This system also prevents people, that can access your WLAN, to manipulate your printer as long as they don't have authorization to use it.
muesli
There would have been a multitude of ways to actually improve their security:
an Oauth API, API tokens, token/PIN exchange on the printer's display and/or a QR-code, an actual LAN-only mode, manual certificate exchange, ... I'll stop here.
All of these solutions would be absolutely feasible, actually secure, and would not lock you out from using a third-party slicer. Their solution isn't about security at all, it's only about controlling their ecosystem.
muesli
Kitsune Yasu
@fribbledom@mastodon.social offer a solution that literally ships their private key to everyone's desktop. It's been leaked by now. Where is the source for that claim? I've neither heard nor I can find anything related to a leaked private key.
And if you talk about possibilities, you don't need to ship the private key, you can use certificates for that.
muesli
Well, yes, but also: if they really wanted security, they would have developed a secure solution, not handed out the key on a golden plate.
Kitsune Yasu
@fribbledom@mastodon.social well, that's unfortunate if this is really genuine
But I still appreciate the effort Bambu made ti develop this software to allow other slicers to still communicate with the printer.
If they really wanted to cut off the access, they didn't need to write this connector.
muesli
Yes, but that's a solution that slicers can simply adopt and implement. Like they do for dozens of other protocols and auth mechanisms.
Kitsune Yasu
@fribbledom@mastodon.social This would still require you to have an additional piece of software that allows the authentication on top of the default protocol.
I agree that there should be an open solution for others in the long run.
muesli
Which breaks the new auth layer they're trying to introduce.
Context is everything: what you quoted is a response to people suggesting they may have used the same private key for other parts of the system, which would be ridiculous.
Kitsune Yasu
@fribbledom@mastodon.social
Just to make sure nobody overreacts to this:It seems like many ppl are misinterpreting the implications
These keys can only be used to replicate what bambu connect is doing (talking to official API servers in a very limited manner) without relying on closed source binaries.
The overall device security isn't "broken" because of this and it won't allow third party slicers to use e.g. camera live view eitherhttps://www.reddit.com/r/BambuLab/comments/1i4k9m2/comment/m7zxwlb/
muesli
When the entire architecture and design of their security mechanism is flawed an update won't help them.
The only thing they can reasonably do is to move the signing process to their cloud service.
Which, again, would be hilariously stupid.
Kitsune Yasu
@fribbledom@mastodon.social Yes, but read the article.
THIS IS A BETA
The app is only there, so maintainers of slicers don't need to implement an Auth-System, as long as it is in an experimental phase.
muesli
I'll give you some time to read up on the news. I'm sure you'll eventually reach the same conclusions.
They also already made it very clear that they're not interested in working with OrcaSlicer or others to find a solution.
muesli
... and then they'll release a new BambuConnect version with a new key? Which then is immediately leaked again?
I'm not sure what you're trying to suggest, this solution simply doesn't work.
Kitsune Yasu
@fribbledom@mastodon.social I didn't claim otherwise :neofox_wink:
And you can revoke access for exposed keys in your API, so nothing is broken.
Jay 🇺🇦
@fribbledom How lobg will you be able to print the popular tianmen square massacre monument file on their printers?
muesli
Please, try to catch up on the news first, so we can have a more informed discussion.
https://github.com/SoftFever/OrcaSlicer/issues/8063#issuecomment-2599741800
Kitsune Yasu
@fribbledom@mastodon.social Bambu Lab will release technical documentation, new software, and offer support to assist partners in adapting their systems and developing software solutions compatible with the new X Series firmware and authorization controls.https://blog.bambulab.com/firmware-update-introducing-new-authorization-control-system-2/
Yep, sounds that they are not interested in working with maintainers of other slicers /s
muesli
I'm getting the feeling you're really not quite understanding the situation.
You're supposed to run this software on your desktop. There's no technical way to release this and also keep the key private.
Kitsune Yasu
@fribbledom@mastodon.social They patch the issue and don't need to leak it anymore.
muesli
"Some randoms in forums". This is the author & maintainer of OrcaSlicer 🙈
Kitsune Yasu
@fribbledom@mastodon.social try to catch up on the news first, so we can have a more informed discussionI'd like to have qualified sources and not some randoms in forums talking/speculating about things.
As far as I can see, BambuLab has already published ways for 3rd-Party Tools to still be able to work with their 3D-Printers.
And yes, I agree that it is not very comfortable if you need an additional tool to be able to send things to your printer.
But at the same time, you argue, that BambuLab is not interested in helping 3rd-Parties, which is wrong.
If they would like to restrict 3rd-Parties, they would not have developed the Connector, cause it is already integrated into their Network-Plugin for the Bambu Studio Slicer.
Additionally, there are some FAQs (which they updated 2 days ago) with the following statements:Our team is actively working on submitting the integration code for Bambu Connect. Once submitted, it will be up to Orca to decide when and if to incorporate it into the slicer, enhancing the user experience. We anticipate the code will be available on GitHub within the next few days, ready for integration into the Orca codebase.It’s important to note that this update is not intended to restrict third-party software use. In fact, we’ve actively collaborated with third-party print farm management software providers in the past and continue to support such partnerships. To further improve the user experience, we are introducing a new software solution that will address these limitations and enhance overall print farm management capabilities.In these cases, we cannot guarantee long-term support for unofficial accessories unless they have been approved by us in advance. Once we became aware of the Panda accessories, we communicated these updates to their creators.
That said, we welcome official collaborations with companies interested in developing accessories for Bambu Lab printers, as we have successfully partnered with other companies in the past, including E3D and Slice Engineering.https://blog.bambulab.com/firmware-update-introducing-new-authorization-control-system-2/
muesli
Is the copium really hitting that hard?
Kitsune Yasu
@fribbledom@mastodon.social
Additionally, BambuLab is very open to 3rd-Party Contributions: https://blog.bambulab.com/custom-firmware-plan-and-our-principles-on-ecosystem/
While most companies just say that they will not support hardware with Custom Firmware, BambuLab ensures that they will make a best-effort attempt to support printers with custom firmware that have had genuine hardware failures as a result of manufacturing defects
muesli
I apologize if my comment was too offensive, but I'm indeed not sure I have anything meaningful to add.
You claimed their change improves security, I refuted that by pointing out that it's insecure by design.
You asked for sources, I provided sources.
I suggested a bunch of methods to really increase their security, and you basically agreed with me.
Quoting completely unrelated Bambu marketing material isn't gonna help further this discussion.
Kitsune Yasu
@fribbledom@mastodon.social
Argumentum ad hominem? Really?
Do you really have nothing meaningful to add to our discussion? Do you really need to attack the other side, instead of providing real evidence?
muesli
I would wait for the Kobra S1. The previous Kobras are workable but a bit meh from today's perspective. Too much has changed in the past two years.
Marcus Noble
@fribbledom Any thoughts on the Anycubic Kobra 3? Price seems too cheap for it to actually be any good.
GNU social JP is a social network, courtesy of GNU social JP管理人. It runs on GNU social, version 2.0.2-dev, available under the GNU Affero General Public License.
All GNU social JP content and data are available under the Creative Commons Attribution 3.0 license.