Reverse Engineering Bambu Connect • Hacker News Board

Re: Reverse Engineering Bambu Connect

#21

Post by c0nsumer » Mon, Jan 20, 2025, 4:12 AM UTC

bdcravens wrote: post #9

BWStearns wrote: post #3

Earlier quoted context omitted.

What did they do?

They used a plugin to communicate print jobs (and other integrations), so that third party software could be used pretty seamlessly. Now they're moving to a new authentication model, and will be requiring users to send files to a separate print app. (Bambu Connect) It adds friction to the process, especially for those who were looking to run print jobs at scale, using "print farm" software or building their own solut…

I do wonder how much friction it'll really add, since the slicers can send the data to Connect via a protocol handler.

It also means that Connect could act as a farm / queueing system as well, more like a print driver vs. individual printer support within the app.

Re: Reverse Engineering Bambu Connect

#22

Post by ghostpepper » Mon, Jan 20, 2025, 4:14 AM UTC

c0nsumer wrote: post #19

lvturner wrote: post #18

Earlier quoted context omitted.

From their blog post: https://blog.bambulab.com/firmware-update-introducing-new-au... "Critical Operations That Require Authorization The following printer operations will require authorization controls: Binding and unbinding the printer. Initiating remote video access. Performing firmware upgrades. Initiating a print job (via LAN or cloud mode). Controlling motion system, temperature, fans, AMS settings, calibration…

Yep -- I read that, but that doesn't spell out auth back to BBL's servers, just auth. And keep in mind that OrcaSlicer already used Bambu Network Plugin to communicate with their printers. (It prompted you to download this on install of OrcaSlicer if you picked one of their printers.) The move to Connect means that OrcaSlicer needs to send the print data to Connect via a protocol handler instead of to the plugin. Con…

what else would it be auth'ing against if not Bambu servers?

Re: Reverse Engineering Bambu Connect

#23

Post by c0nsumer » Mon, Jan 20, 2025, 4:20 AM UTC

ghostpepper wrote: post #22

c0nsumer wrote: post #19

Earlier quoted context omitted.

Yep -- I read that, but that doesn't spell out auth back to BBL's servers, just auth. And keep in mind that OrcaSlicer already used Bambu Network Plugin to communicate with their printers. (It prompted you to download this on install of OrcaSlicer if you picked one of their printers.) The move to Connect means that OrcaSlicer needs to send the print data to Connect via a protocol handler instead of to the plugin. Con…

what else would it be auth'ing against if not Bambu servers?

Perhaps some... other or better way of authenticating to the printer? Previously there was just a single, essentially fixed, numeric string that gave complete access to the printer, and communication was via TLS with a self-signed cert.

I don't want to hypothesize about what it could be doing, I want to see what it's actually doing (or see some actual info from folks about what they've seen) so I can decide if I'm comfortable with that or not.

Re: Reverse Engineering Bambu Connect

#24

Post by NelsonMinar » Mon, Jan 20, 2025, 4:26 AM UTC

I am angry at the bait-and-switch Bambu is pulling. I bought one of their printers in the Black Friday sale on the understanding it was reasonably hackable and open. Now they're trying to lock it down so I can't print on my own printer without using their approved software and DRM chain. It's outrageous.

More info on the hacking (the first in what may be a long stupid fight): https://hackaday.com/2025/01/19/bambu-connects-authenticatio...

Re: Reverse Engineering Bambu Connect

#25

Post by s0rce » Mon, Jan 20, 2025, 4:31 AM UTC

throwaway48476 wrote: post #10

If 3D printing isn't kept open source there's going to be laws about what you can and can't print that will kill innovation.

The bambu printers haven't been open source.

Re: Reverse Engineering Bambu Connect

#26

Post by bhhaskin » Mon, Jan 20, 2025, 4:32 AM UTC

I think people are making a big nothing burger out of this.

Bambu is patching a security issue. Personally I don't want any device or application to send any old G-code to my printer. Like say command the printer to basically destroy itself.

Could this lead to completely locking it down in the future? Yes. But they could do that anyways.

I think this is a way to stop getting their pants sued off.

If they really wanted to lock it down they could just make it so everything has to go through their servers and require files to be signed before being read from SD cards.

But instead we really have a half ass attempt.

Re: Reverse Engineering Bambu Connect

#27

Post by userbinator » Mon, Jan 20, 2025, 4:37 AM UTC

I'm not surprised that 3D printers are turning out to be as hostile as 2D ones. As usual these days, "security" is the excuse.

Re: Reverse Engineering Bambu Connect

#28

Post by MindSpunk » Mon, Jan 20, 2025, 4:45 AM UTC

sho_hn wrote: post #11

adenta wrote: post #4

Earlier quoted context omitted.

The A1 mini was my first printer and it just works. Is there another brand that is idiot proof?

If you buy a Prusa in non-kit form, it's not any harder to unbox or operate, and more reliable, while generally achieving somewhat better results. Without phoning home and while maintaining the software Bambu forked theirs from. A recent review coming to a similar conclusion was Maker Muse' review of bedslingers. It's a channel I respect a lot, because he has over the years relentlessly disclosed emails of companies…

And they cost 3x as much. Which is a pretty tough sell IMO.

Re: Reverse Engineering Bambu Connect

#29

Post by gjsman-1000 » Mon, Jan 20, 2025, 4:47 AM UTC

NelsonMinar wrote: post #24

I am angry at the bait-and-switch Bambu is pulling. I bought one of their printers in the Black Friday sale on the understanding it was reasonably hackable and open. Now they're trying to lock it down so I can't print on my own printer without using their approved software and DRM chain. It's outrageous. More info on the hacking (the first in what may be a long stupid fight): https://hackaday.com/2025/01/19/bambu-con…

> standing it was reasonably hackable and open

Not sure where you got this idea from. Despite the hacking, print from SD Card remains an option, and the device does not need an internet connection for initial setup. Version 01.08.02.00 is the first firmware version that supports offline updating, even if it is also the latest version.

Re: Reverse Engineering Bambu Connect

#30

Post by goda90 » Mon, Jan 20, 2025, 4:48 AM UTC

userbinator wrote: post #27

I'm not surprised that 3D printers are turning out to be as hostile as 2D ones. As usual these days, "security" is the excuse.

There's so much open source software, firmware, and hardware out there for FDM 3D printers, I doubt they'll ever get as bad as regular printers. It's much more a tinkerers world than 2D printing ever would be.