Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bambu Lab - Setting the Record Straight About Our Security Update

blog.bambulab.com

Post reply on HN
Print view View original

21–30 of 122 posts

Re: Bambu Lab - Setting the Record Straight About Our Security Update

#21

Post by the_mitsuhiko »

progbits wrote: post #7
the_mitsuhiko wrote: post #4

Earlier quoted context omitted.

> This addresses nothing. This does in-fact address quite a bit, because they have change their stance with this update. Previously even LAN only mode required to go via their bambu connect system, now you can switch it to developer mode and talk freely via MQTT to the printer.

But when you buy the printer you still need to give it internet access / connect via their app, right?

I'm not sure why you would need to give it internet access. I think even the firmware updates work via SD card.

Re: Bambu Lab - Setting the Record Straight About Our Security Update

#22

Post by the_mitsuhiko »

vvanders wrote: post #15
the_mitsuhiko wrote: post #4

Earlier quoted context omitted.

> This addresses nothing. This does in-fact address quite a bit, because they have change their stance with this update. Previously even LAN only mode required to go via their bambu connect system, now you can switch it to developer mode and talk freely via MQTT to the printer.

You could already talk freely to the MQTT on the printer and it was already secured with a unique password. This feels like making it a second class feature that could disappear at a future point.

That is obviously correct, but this is a meaningful improvement over what their initial plan was.

Re: Bambu Lab - Setting the Record Straight About Our Security Update

#23

Post by iLoveOncall »

ipv6ipv4 wrote: post #19
geerlingguy wrote: post #12

Earlier quoted context omitted.

Judging by the PR thread in OrcaSlicer's GitHub repo, not all users are happy with the proposed fix, requiring users to install Bambu Connect on their computers (which currently doesn't run on Linux, IIRC?) to be able to use the new OrcaSlicer to Bambu workflow... https://github.com/SoftFever/OrcaSlicer/pull/8103

Tellingly, this pull request is coming from a Bambu Lab employee. I think the OrcaSlicer maintainers should tell Bambu Lab to pound sand with this change.

> I think the OrcaSlicer maintainers should tell Bambu Lab to pound sand with this change.

Hum, the alternative is OrcaSlicer stops working with Bambu printers...

Re: Bambu Lab - Setting the Record Straight About Our Security Update

#24

Post by sitkack »

rpearl wrote: post #14
wildzzz wrote: post #11

Earlier quoted context omitted.

These companies always pick the most ridiculous tinfoil hat bullshit list of complaints to debunk when trying to explain why they want to close off their API. The real reason almost always comes down to money. The mention of Panda Touch is very telling. While I'm sure Bambu doesn't want to maintain documentation for a non-public (is that the right term)? API, they definitely don't want other companies making money of…

who cares if Panda Touch/BigTreeTech was making money off the ecosystem? it did nothing more than sell more bambu printers. It's not net-zero--money for BigTreeTech is not coming out of Bambu's pockets; I seriously doubt it was net-negative for Bambu.

Having 2nd and 3rd party support only make an ecosystem more robust.

This whole kerfuffle only sours me to them. I like the printer but the desktop software quality is low and features in LAN mode are not available for what one can only think of as a shity move to Hoover up data for the enshitification

Re: Bambu Lab - Setting the Record Straight About Our Security Update

#26

Post by nullc »

the_mitsuhiko wrote: post #21
progbits wrote: post #7

Earlier quoted context omitted.

But when you buy the printer you still need to give it internet access / connect via their app, right?

I'm not sure why you would need to give it internet access. I think even the firmware updates work via SD card.

They just introduced firmware updates via SD card in the most recent released version, prior to that you had to put the printer online and associate it with an account to get firmware updates.

But yes today there is no need to use their cloud services unless you want to control the printer with their phone app. And the printer works totally fine completely isolated from the internet.

The now aborted proposed update would have required using a binary shim from bambu with an embedded 1 year lifetime SSL cert to speak the the printer at all, even when in lan mode.

Re: Bambu Lab - Setting the Record Straight About Our Security Update

#27

Post by ipv6ipv4 »

iLoveOncall wrote: post #23
ipv6ipv4 wrote: post #19

Earlier quoted context omitted.

Tellingly, this pull request is coming from a Bambu Lab employee. I think the OrcaSlicer maintainers should tell Bambu Lab to pound sand with this change.

> I think the OrcaSlicer maintainers should tell Bambu Lab to pound sand with this change. Hum, the alternative is OrcaSlicer stops working with Bambu printers...

You mean Bambu Lab broke compatibility with OrcaSlicer and every other slicer out there.

I don't know if the OrcaSlicer maintainers feel this way. But if they feel that Bambu Lab is stabbing them in the back, they don't have to jump when Bambu Lab tells them to (that's pretty much the raison d'être of open source).

Re: Bambu Lab - Setting the Record Straight About Our Security Update

#28

Post by sitkack »

louwrentius wrote: post #6

Meanwhile Jeff Geerling already put a video out on his second channel that he won’t recommend a bambu lab printer anymore although he was happy with his printer. And this update didn’t convince him to change his mind. “Developer mode” isn’t a solution. You buy hardware and it should work 100% without cloud connectivity. Otherwise it’s not your hardware.

Absolutely!

Local first, everything that should likely run locally should be enabled.

You can’t use the desktop software to see the contents of the SD card, you have to enable cloud access.

I own two Bambu printers, great hardware, and ok software. No longer recommending them.

Re: Bambu Lab - Setting the Record Straight About Our Security Update

#29

Post by Jzush »

rpearl wrote: post #14
wildzzz wrote: post #11

Earlier quoted context omitted.

These companies always pick the most ridiculous tinfoil hat bullshit list of complaints to debunk when trying to explain why they want to close off their API. The real reason almost always comes down to money. The mention of Panda Touch is very telling. While I'm sure Bambu doesn't want to maintain documentation for a non-public (is that the right term)? API, they definitely don't want other companies making money of…

who cares if Panda Touch/BigTreeTech was making money off the ecosystem? it did nothing more than sell more bambu printers. It's not net-zero--money for BigTreeTech is not coming out of Bambu's pockets; I seriously doubt it was net-negative for Bambu.

Because the writing on the wall is that this was always meant to be a subscription based, continual revenue stream for Bamboo Labs. They are just edging that direction.

Whether or not it’s simply greed or that they didn’t make as much selling the printers as they had thought. The next step to closing an API and killing 3rd party interactions is almost always so they can introduce some form of continuous monetization scheme.

That was always something that rubbed me the wrong way with Bamboo Labs. They threw an absolutely obscene amount of money at influencers. Essentially buying a ringing endorsement from nearly the whole hobbyist community and made their brand a household name.

The time was right to pull the switch.

Re: Bambu Lab - Setting the Record Straight About Our Security Update

#30

Post by parasubvert »

blutack wrote: post #16

Does anyone know or can see an actual concrete security concern with the current implementation of LAN mode? https://github.com/Doridian/OpenBambuAPI/blob/main/mqtt.md Right now, the printer's local MQTT server can only be accessed from the local IP using an 8 digit password obtained through through the physical display. I can't personally see any fundamental issue with this design assuming the implementation is corr…

To me this whole thing feels like they're trying to pass audit to sell Bambu printers to corporations that require secure communications. Mutual TLS with client certs is nearly universal, which is what they're trying to do with Bambu Connect. On the other hand, MQTT isn't a very secure protocol, plus the printer also uses FTP which is mostly banned on corporate networks these days.
Post reply on HN