News for hackers. Stuff that matters.
Re:Bambu Lab - Setting the Record Straight About Our Securit... by the_mitsuhiko on Monday January 20, 2025 @05:11PM (#42773691)
> This addresses nothing.

This does in-fact address quite a bit, because they have change their stance with this update. Previously even LAN only mode required to go via their bambu connect system, now you can switch it to developer mode and talk freely via MQTT to the printer.

Re:Bambu Lab - Setting the Record Straight About Our Securit... by vvanders on Monday January 20, 2025 @05:26PM (#42773830)
You could already talk freely to the MQTT on the printer and it was already secured with a unique password. This feels like making it a second class feature that could disappear at a future point.
Re:Bambu Lab - Setting the Record Straight About Our Securit... by the_mitsuhiko on Monday January 20, 2025 @05:37PM (#42773932)
That is obviously correct, but this is a meaningful improvement over what their initial plan was.
Re:Bambu Lab - Setting the Record Straight About Our Securit... by vvanders on Monday January 20, 2025 @05:49PM (#42774053)
I don't really see what having a "developer mode" offers here beyond the existing solution. The current mqtt is already locked down with a unique password and AFAIK the endpoint was read-only anyway.

Don't get me wrong I'm glad they're responding to feedback but the feedback shouldn't have been required in the first place.

I'm all for better security on products(esp ones that heat up to 300C!) but interoperability with open standards makes it a better product overall and given the direction we've seen in the IoT space I think they've done quite a bit of damage(even if not intentionally) by not taking more care in this area.

Re:Bambu Lab - Setting the Record Straight About Our Securit... by parasubvert on Monday January 20, 2025 @05:50PM (#42774069)
Developer mode is just "how it works today" mode. It's insecure, and uses private APIs, and thus shouldn't be used, but people will anyway, so they're listening to their customers.
Re:Bambu Lab - Setting the Record Straight About Our Securit... by hn8726 on Monday January 20, 2025 @06:01PM (#42774172)
> Developer mode is just "how it works today" mode.

For LAN mode yes, but for how the printer works — not exactly. Right now you can print from a 3rd party slicer (Orca Slicer) and at the same time use Bambu Handy mobile app to for example monitor the print. LAN mode disables the cloud connection (always has). Which means that with the revised changes you have to choose either a 3rd party slicer _or_ active cloud connection

Re:Bambu Lab - Setting the Record Straight About Our Securit... by parasubvert on Monday January 20, 2025 @06:08PM (#42774239)
Hmm, seems pretty clear that OrcaSlicer will eventually adapt to use Bambu Connect regardless, which will preserve active cloud connections.
Re:Bambu Lab - Setting the Record Straight About Our Securit... by hn8726 on Tuesday January 28, 2025 @03:58PM (#42857904)
Adapting to Bambu Connect means passing the print files to another app, and it's unclear if that app will work without a cloud account. Plus Orca does lose functionality like controlling the printer directly from the slicer, and one of the critiques of the new system is needing a separate app in the first place.

If you mean that OrcaSlicer will reimplement Bambu Connect protocols inside — I doubt that will happen, since Bambu Connect is not open source, so this would involve reverse engineering the protocols and potentially including Bambu Connect certificates.

Re:Bambu Lab - Setting the Record Straight About Our Securit... by rowanG077 on Monday January 20, 2025 @05:45PM (#42774009)
That doesn't seem obvious to me. It's not unthinkable their plan is:

- Want to introduce x, but we are worried what our userbase thinks.

- Introduce something way more ridiculous y that subsumes x.

- Rollback y but not x because of backlash.

Now they look like a company that listens to their users and they got what they wanted.

Re:Bambu Lab - Setting the Record Straight About Our Securit... by satvikpendem on Monday January 20, 2025 @05:51PM (#42774075)
Ah the classic door in the face technique

https://en.wikipedia.org/wiki/Door-in-the-face_technique

Re:Bambu Lab - Setting the Record Straight About Our Securit... by madeofpalk on Monday January 20, 2025 @05:52PM (#42774094)
They’ve suffered real brand damage. Any of the changes (original, or these) seem like they would win over unconvinced potential customers, yet they’ve actively turned some away.
Re:Bambu Lab - Setting the Record Straight About Our Securit... by TechIsCool on Monday January 20, 2025 @05:15PM (#42773729)
Didn't we hear this tune from Sony in the Playstation 3 days with Developer mode and then it slowly faded away after a couple years of application/product releases...
Re:Bambu Lab - Setting the Record Straight About Our Securit... by sho_hn on Monday January 20, 2025 @05:43PM (#42773998)
Why should I switch to "developer mode" to talk to a computer I own on my own network?
Re:Bambu Lab - Setting the Record Straight About Our Securit... by parasubvert on Monday January 20, 2025 @06:04PM (#42774194)
You don't need to. You can use their Bambu Connect client in LAN mode.

Or you can turn off security and use "developer mode", aka. "how things work today" mode, if you want to do things the old / insecure way.

Re:Bambu Lab - Setting the Record Straight About Our Securit... by sho_hn on Monday January 20, 2025 @06:10PM (#42774259)
Insecure for who? What's the threat vector?
Re:Bambu Lab - Setting the Record Straight About Our Securit... by hWuxH on Friday January 24, 2025 @05:01PM (#42817341)
I wouldn't call it more or less secure. You're just on your own and should expect this (internal) API to have breaking changes at any time.
Re:Bambu Lab - Setting the Record Straight About Our Securit... by progbits on Monday January 20, 2025 @05:13PM (#42773714)
But when you buy the printer you still need to give it internet access / connect via their app, right?
Re:Bambu Lab - Setting the Record Straight About Our Securit... by BeefWellington on Monday January 20, 2025 @07:09PM (#42774713)
You do not need to give it internet access for LAN mode to function, but you lose a LOT of features that the cloud app and mobile app give you. For example, you can no longer do anything with the camera in LAN mode, even from the official Bambu Studio app. So no timelapses or ability to check in on it from even just elsewhere in my house.

There's also other limitations of it in features I don't really use, for example IIRC the RFID stuff they do with their print spools stops working.

Re:Bambu Lab - Setting the Record Straight About Our Securit... by the_mitsuhiko on Monday January 20, 2025 @05:37PM (#42773927)
I'm not sure why you would need to give it internet access. I think even the firmware updates work via SD card.
Re:Bambu Lab - Setting the Record Straight About Our Securit... by nullc on Monday January 20, 2025 @05:40PM (#42773960)
They just introduced firmware updates via SD card in the most recent released version, prior to that you had to put the printer online and associate it with an account to get firmware updates.

But yes today there is no need to use their cloud services unless you want to control the printer with their phone app. And the printer works totally fine completely isolated from the internet.

The now aborted proposed update would have required using a binary shim from bambu with an embedded 1 year lifetime SSL cert to speak the the printer at all, even when in lan mode.

Re:Bambu Lab - Setting the Record Straight About Our Securit... by LouisvilleGeek on Monday January 20, 2025 @05:50PM (#42774066)
Bambu Companion (unfortunately iPhone only) does more than Handy and works on LAN. Using it today in fact! https://www.youtube.com/watch?v=LZpDQN9zgUI