Live data from Hacker News

Bambu Lab is abusing the open source social contract

jeffgeerling.com

171–180 of 452 posts

Re: Bambu Lab is abusing the open source social contract

#171

I'm an open-source advocate (some would say zealot?) but I ended up buying a Bambu P1S a few months back because my research indicated that there were ways use it normally without creating a Bambu account, or using their slicer, or having to send all of your prints through their servers. I don't have my notes in front of me, but I managed to do all of that with hardly any trouble at all. IIRC, you only had to change…

You're obviously not an open source advocate or zealot if you gave up your principles so easily.

Re: Bambu Lab is abusing the open source social contract

#172
Bambu has proven time and again that they don't understand security. Unless, of course, it's theater and by design because real security would be inconvenient to state actors. Regardless, they gaslight and bludgeon those who wish to use the hardware they purchased in peace offline and away from prying eyes.

Having said all that, the hardware is very good. Software, not so much.

Re: Bambu Lab is abusing the open source social contract

#173

I'm an open-source advocate (some would say zealot?) but I ended up buying a Bambu P1S a few months back because my research indicated that there were ways use it normally without creating a Bambu account, or using their slicer, or having to send all of your prints through their servers. I don't have my notes in front of me, but I managed to do all of that with hardly any trouble at all. IIRC, you only had to change…

"you only had to change one setting on the printer itself, and optionally block the printer from Internet access via the firewall to prevent automatic firmware updates and telemetry" - "only" is doing a lot of work here. Yes, this is easy for us, but that part alone is beyond most users.

I have a P1S myself, and I find Bambu to be a strange company. They're one that has benefited tremendously from OSS while sometimes violating both the ethos and licenses.

They specifically engineer it such that your prints need to go through an intermediary even when it could send it right to your device on a simple network. That'd be like a laserjet routing through the cloud instead of going to your device. With nothing much in the way of encrypting your designs and protecting your data, it feels like this was done on purpose. Given the shameless track record of many (most?) Chinese companies on IP, my assumption is that they're mainly doing this to steal designs. The juxtaposition of their poor track record on OSS, what seems like a shady approach to privacy and IP protection, and the aggressive legal posturing - all sum up to what I think is a very untrustworthy organization.

Luckily my designs are in the "look at this trash" territory, so I don't have anything to worry about, but I certainly wouldn't use this for important work.

Re: Bambu Lab is abusing the open source social contract

#174

Earlier quoted context omitted.

Yes you can use the code however you want but equally they are free to bar anyone they wish from accessing their servers. These are completely orthogonal issues in a legal sense.

They're essentially saying "yes, the code is open source, but you're not allowed to modify it or we'll ban you and threaten you with legal action", which is completely antithetical to the whole idea behind open source (especially the GPL which literally says in the license text itself that it was created to protect your right to run modified software). "Violation of the open source social contract" is a good way to d…

You can run modified software per the GPL but that does not include the right to connect to Bambu's servers with your modified software. That is entirely reasonable (especially since this is not some social/messaging application). If I release a client as open source, that doesn't mean it's OK for modified clients to connect to my server. I expect you to use it offline or set up your own server to connect to.

I don't know if that is what is happening here because the article is talking about a fork that is bypassing Bambu's servers entirely (which is permitted under the AGPL) and Bambu is not happy.

Edit: On re-reading, it seems to me the fork is still calling Bambu's servers. It's just bypassing some things.

Re: Bambu Lab is abusing the open source social contract

#175

Good article, but I'd like to ask about two small technical details (I've used Bambu before, but I'm not very familiar with the 3D printing ecosystem). 1. OrcaSlicer: so it's a fork of Bambu's official client, Bambu Studio - but it apparently still goes through Bambu's servers for printing? How exactly does that work? Does it also "impersonate" the User-Agent, and Bambu was okay with that? 2. OrcaSlicer-bambulab: if…

> OrcaSlicer-bambulab: if the goal of this fork-of-a-fork is to bypass Bambu's cloud servers, why would it still need to "impersonate" the UA and communicate with Bambu's servers (as Bambu claimed)? Wouldn't the whole point be to avoid doing that in the first place?

I finally got to the bottom of this; there is a cloud-based RPC method called `bambu_network_start_local_print` where Bambu's Cloud would authorize a print using (ostensibly) only locally transferred data. The goal of this project was basically to pretend to be the Bambu plugin in order to authorize this method, which is otherwise locked behind Bambu's auth system.

The alternative is to run the printer in LAN mode (which OrcaSlicer has always supported) where the client connects natively over MQTT, but after Bambu added their cloud authentication, this requires putting the printer in Developer mode and severing the Cloud features.

Re: Bambu Lab is abusing the open source social contract

#176
post #11

> Some people are okay with using OrcaSlicer and printing through Bambu's cloud. It's convenient if you're on the road and want to start a print on your printer at home Do such people really exist? Are there actually people who are comfortable blindly starting a robot in their home, with a part that heats to 150 C, and then hope that everything will work out and when they get home the part will be waiting for them, i…

That isn’t a significantly different risk from how you are required to use a FDM printer, regardless of circumstance. Prints regularly take ten+ hours to complete. No one is vigilantly guarding their printer during this time. Fire spreads so quickly in a house that a smoke alarm is often just a signal to get out, you don’t necessarily have the time to grab a fire extinguisher and put it out. And how big is the risk,…

The main board of my 3D printer short-circuited and caught fire once. I don't know what would have happened if I wasn't around, but I'm not leaving my printer running on its own without supervision.

Re: Bambu Lab is abusing the open source social contract

#177

This sentence in Bambu Lab's blog post is wild: > We have documented incidents of service outages caused precisely by spikes in unauthorized traffic - overwhelming the servers, causing service disruptions affecting everyone. The cost was instability felt by all users. So it's a problem that their printers are popular, and they can't be bothered to scale their infra, so let's gate everything based on USER AGENT STRING…

So am I understanding correctly that all of this "unauthorized traffic" was their customers...using their product?

So it would seem.

Re: Bambu Lab is abusing the open source social contract

#178

I'm an open-source advocate (some would say zealot?) but I ended up buying a Bambu P1S a few months back because my research indicated that there were ways use it normally without creating a Bambu account, or using their slicer, or having to send all of your prints through their servers. I don't have my notes in front of me, but I managed to do all of that with hardly any trouble at all. IIRC, you only had to change…

My understanding is that you got your printer when the firmware was not blocking you from doing all of that. Right now if you want to remote print (and don't want to do it via sending models to Bambu Cloud), you can get away if you enable LAN only and developer mode. However, what if the newer firmware forces you to create an online account and connect to Bambu cloud to do the setup? What if Bambu decides to limit the features you can use if you print using a SD card? It has been quite a worrying trend, and now the company is trying to legally threaten an open-source developer building on top of Bambu's AGPL code trying to make remote print without going through Bambu servers possible. Other ppl more knowledgeable on the issue, please correct me if I'm misunderstanding the situation.

Re: Bambu Lab is abusing the open source social contract

#179
post #81
post #71

I am an outsider on the details of the Bambu software requiring users to go through their servers in China and the closing of their software. Still I suspect it is about spying in wartime, Bambu printers are at the core of the Ukrainian war effort, the main reason even Ukraine is winning since januari 2026. First China prevented Ukraine from using any of the drones that they sold in millions to Russia while exercisin…

Bambu had its requirement to go through their servers since before the Ukraine war, though it has gotten progressively harder to work around.

There is no requirement to send prints through their servers. My P1S has never been logged into their cloud service in the year I've owned it.

Re: Bambu Lab is abusing the open source social contract

#180

I'm an open-source advocate (some would say zealot?) but I ended up buying a Bambu P1S a few months back because my research indicated that there were ways use it normally without creating a Bambu account, or using their slicer, or having to send all of your prints through their servers. I don't have my notes in front of me, but I managed to do all of that with hardly any trouble at all. IIRC, you only had to change…

> IIRC, you only had to change one setting on the printer itself, and optionally block the printer from Internet access via the firewall to prevent automatic firmware updates and telemetry

Why do you have to do that on a product you own that is running in your home?

Post reply on HN