Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bambu Lab - Setting the Record Straight About Our Security Update

blog.bambulab.com

Post reply on HN
Print view View original

71–80 of 122 posts

Re: Bambu Lab - Setting the Record Straight About Our Security Update

#71

Post by sho_hn »

parasubvert wrote: post #41

People seem to be missing that FTP and MQTT are generally insecure protocols. I think FTP is probably the bigger issue than MQTT. This kind of stuff is common in home IOT networks but would never pass security audit on a corporate network. Bambu is growing up, serving more corporations beyond the hobby community, and probably has been asked to beef their security up to make it easier to deploy their printers securely…

The way things are going, I doubt that 3D printers with always-on requirements and without hardware kill switches for phone-home connectivity are going to be very interesting to any corporations interested in keeping business secrets or staying compliant with data privacy regulations.

It's much more likely that Bambu is doing these moves to control their hobbyist userbase more tightly and make things easier for them, as they've seen other consumer electronics companies get away with similar moves.

It's a risky game however - this is going to land them on ban lists for West-based gov or edu installations even faster than DJI.

Re: Bambu Lab - Setting the Record Straight About Our Security Update

#72

Post by parasubvert »

igor47 wrote: post #52

Seems like the maker community, esp. YouTube influencers, uniformly recommend bambu. Curious-- do folks here have other recommendations? Equivalent quality, speed, maybe even price, but more committed to free software?

Generally speaking, no. Prusa comes close - they're dedicated to community and OSS, and are quality parts... but are almost 2x the price and tend to be missing comparable features.

The other competition doesn't quite have the UX and quality of Bambu Lab. That's changing slowly, but it's reality today IMO.

The challenge is that the 3d Printing community is maturing from a hobbyist/tinker phase into a consumer phase with Bambu Lab leading the way. Bambu Lab has mostly threaded the needle by balancing proprietary UX with practical ability to tinker, swap parts, etc.

But as with most hobby communities, if someone doesn't understand a motivation of a change, they immediately ascribe it to a conspiracy.

Bambu Lab wanting to improve printer security is an obvious thing to anyone who has dealt with corporate network security in the past... today it is effectively an insecure toy that would only be deployed on black holed lab networks. They're trying to make it more modern via Mutual TLS authenticated file transfer rather than a cobbled together mix of FTP and MQTT.

Re: Bambu Lab - Setting the Record Straight About Our Security Update

#73

Post by geerlingguy »

easygenes wrote: post #51
iLoveOncall wrote: post #23

Earlier quoted context omitted.

> I think the OrcaSlicer maintainers should tell Bambu Lab to pound sand with this change. Hum, the alternative is OrcaSlicer stops working with Bambu printers...

OrcaSlicer is a fork of Bambu's slicer. It defeats the whole impetus of the project to not support Bambu Lab printers.

Orca is used for a number of other printers too — and don't forget Bambu Slicer is a fork of Prusa Slicer is a fork of Slic3r... it's open source forks all the way down that rabbit hole!

Re: Bambu Lab - Setting the Record Straight About Our Security Update

#74

Post by barbazoo »

mmorriso wrote: post #53
louwrentius wrote: post #6

Meanwhile Jeff Geerling already put a video out on his second channel that he won’t recommend a bambu lab printer anymore although he was happy with his printer. And this update didn’t convince him to change his mind. “Developer mode” isn’t a solution. You buy hardware and it should work 100% without cloud connectivity. Otherwise it’s not your hardware.

I use LAN mode for my P1S currently in a shed with a local AP and no internet access and it works fine.

https://www.youtube.com/watch?v=91kfolYkRNM

Says even then you have to use their app and cloud service to set up the printer.

Re: Bambu Lab - Setting the Record Straight About Our Security Update

#75

Post by ipv6ipv4 »

parasubvert wrote: post #65
ipv6ipv4 wrote: post #61

Earlier quoted context omitted.

OrcaSlicer is sponsored by Qidi and BigTree Tech. If anything, Bambu Lab is taking them for a ride, like it is taking the rest of the open source community for a ride. It's clear you like your Bambu Lab printer/s. But I think you are letting it cloud your judgement. Bambu Lab is being predatory here.

Bambu Lab isn't being predatory. They're making a sensible change to their security. But, because people don't understand security technology tradeoffs, everything becomes a conspiracy.

If this were about security, it wouldn't matter what piece of software was implementing the well documented security protocol. BambuSlicer, or OrcaSlicer, it would be all the same because the underlying protocol would be the security guarantee. This is rudimentary security tradecraft.

Bambu Lab is introducing something else. Most charitably, it could be described as security through obscurity, which is never secure. More realistically, Bambu Lab is introducing vendor lock-in under the pretext of security. Vendor lock-in is what this change actually achieves.

Re: Bambu Lab - Setting the Record Straight About Our Security Update

#76

Post by sho_hn »

igor47 wrote: post #52

Seems like the maker community, esp. YouTube influencers, uniformly recommend bambu. Curious-- do folks here have other recommendations? Equivalent quality, speed, maybe even price, but more committed to free software?

If you want a more trustworthy review, check out Maker Muse' recent review on current-crop bedslingers. Interestingly, unlike the standard influencer talking points, they came to the conclusion that the Prusa is easiest to set up and operate (while not being negative on Bambu).

I tend to trust Maker Muse because he's over the years repeatedly shown screenshots of emails by compannies trying to bribe, pressure or threaten him, which gave me some faith that he's generally refused these advances.

Re: Bambu Lab - Setting the Record Straight About Our Security Update

#77

Post by parasubvert »

sho_hn wrote: post #71
parasubvert wrote: post #41

People seem to be missing that FTP and MQTT are generally insecure protocols. I think FTP is probably the bigger issue than MQTT. This kind of stuff is common in home IOT networks but would never pass security audit on a corporate network. Bambu is growing up, serving more corporations beyond the hobby community, and probably has been asked to beef their security up to make it easier to deploy their printers securely…

The way things are going, I doubt that 3D printers with always-on requirements and without hardware kill switches for phone-home connectivity are going to be very interesting to any corporations interested in keeping business secrets or staying compliant with data privacy regulations. It's much more likely that Bambu is doing these moves to control their hobbyist userbase more tightly and make things easier for them,…

Moving to mTLS authentication is going to get Bambu on a ban list? That's incredibly hyperbolic.

Though, if you're right, between the Huwaei ban, DJI ban and the TikTok ban, it's becoming clearer the U.S. no longer really believes in a free market if it doesn't own the market. There may be legitimate reasons to enact a ban, but it sure looks convenient that they're banning all the tech that is that is clearly superior to U.S-owned alternatives.

Re: Bambu Lab - Setting the Record Straight About Our Security Update

#78

Post by parasubvert »

Maskawanian wrote: post #70
parasubvert wrote: post #68

Earlier quoted context omitted.

That... doesn't make things particularly secure. First of all MQTT doesn't require authentication. Secondly FTP is involved which is generally deprecated on most sensible servers and networks. Finally, sending passwords in the clear over an encrypted wire to an end device has been an obsolete technique for over 20 years. People still do it, but they shouldn't. It's the reason we have Kerberos, OAuth2/OIDC, and x509 c…

Nah, you made an absolute statement that MQTT was insecure, that was demonstrated to be incorrect. If HTTP can be made secure by relying on a secure transport, then MQTT can as well. Additionally, MQTT does allow for authentication. I've personally set up brokers many times that will not allow anonymous connections. Misconfiguration of services, does not constitute an error in the protocol itself.

OK, please continue deploying MQTT ports on the public internet. I'm sure it's super common and completely safe.

Re: Bambu Lab - Setting the Record Straight About Our Security Update

#79

Post by sho_hn »

parasubvert wrote: post #78
Maskawanian wrote: post #70

Earlier quoted context omitted.

Nah, you made an absolute statement that MQTT was insecure, that was demonstrated to be incorrect. If HTTP can be made secure by relying on a secure transport, then MQTT can as well. Additionally, MQTT does allow for authentication. I've personally set up brokers many times that will not allow anonymous connections. Misconfiguration of services, does not constitute an error in the protocol itself.

OK, please continue deploying MQTT ports on the public internet. I'm sure it's super common and completely safe.

Neither Bambu nor the parent poster did this. I'm not sure what you're talking about.

Re: Bambu Lab - Setting the Record Straight About Our Security Update

#80

Post by parasubvert »

ipv6ipv4 wrote: post #75
parasubvert wrote: post #65

Earlier quoted context omitted.

Bambu Lab isn't being predatory. They're making a sensible change to their security. But, because people don't understand security technology tradeoffs, everything becomes a conspiracy.

If this were about security, it wouldn't matter what piece of software was implementing the well documented security protocol. BambuSlicer, or OrcaSlicer, it would be all the same because the underlying protocol would be the security guarantee. This is rudimentary security tradecraft. Bambu Lab is introducing something else. Most charitably, it could be described as security through obscurity, which is never secure.…

Controlling the software lifecycle of a client library or executable, to be able to update its x509 certs as part of an upgrade cycle, is ... not security through obscurity. It's pretty standard practice, especially if your customer base knows very little about maintianing certs/keys.

It's about a vendor trying to control an experience for its users balancing its UX and maintenance costs.

There's no real vendor lock-in here beyond the usual conspiracy "Bambu Lab is better therefore they're evil unless they give it all away for free to their competition", that's a pile of nonsense. Orca Slicer and 3rd party slicers will continue to work with the new approach if they can work out the details of the PR that uses Bambu Connect.

Post reply on HN