News for hackers. Stuff that matters.
Re:Bambu Lab - Setting the Record Straight About Our Securit... by iLoveOncall on Monday January 20, 2025 @05:18PM (#42773754)
The main concern that was raised was that you couldn't send print jobs from other slicers anymore, and this article explains why this isn't the case in the section titled "How Bambu Connect Works", taking OrcaSlicer as an example.

How does it not address the concerns of people?

Re:Bambu Lab - Setting the Record Straight About Our Securit... by geerlingguy on Monday January 20, 2025 @05:20PM (#42773769)
Judging by the PR thread in OrcaSlicer's GitHub repo, not all users are happy with the proposed fix, requiring users to install Bambu Connect on their computers (which currently doesn't run on Linux, IIRC?) to be able to use the new OrcaSlicer to Bambu workflow... https://github.com/SoftFever/OrcaSlicer/pull/8103
Re:Bambu Lab - Setting the Record Straight About Our Securit... by ipv6ipv4 on Monday January 20, 2025 @05:35PM (#42773920)
Tellingly, this pull request is coming from a Bambu Lab employee. I think the OrcaSlicer maintainers should tell Bambu Lab to pound sand with this change.
Re:Bambu Lab - Setting the Record Straight About Our Securit... by iLoveOncall on Monday January 20, 2025 @05:38PM (#42773943)
> I think the OrcaSlicer maintainers should tell Bambu Lab to pound sand with this change.

Hum, the alternative is OrcaSlicer stops working with Bambu printers...

Re:Bambu Lab - Setting the Record Straight About Our Securit... by easygenes on Monday January 20, 2025 @05:54PM (#42774115)
OrcaSlicer is a fork of Bambu's slicer. It defeats the whole impetus of the project to not support Bambu Lab printers.
Re:Bambu Lab - Setting the Record Straight About Our Securit... by geerlingguy on Monday January 20, 2025 @06:21PM (#42774354)
Orca is used for a number of other printers too — and don't forget Bambu Slicer is a fork of Prusa Slicer is a fork of Slic3r... it's open source forks all the way down that rabbit hole!
Re:Bambu Lab - Setting the Record Straight About Our Securit... by ipv6ipv4 on Monday January 20, 2025 @05:41PM (#42773975)
You mean Bambu Lab broke compatibility with OrcaSlicer and every other slicer out there.

I don't know if the OrcaSlicer maintainers feel this way. But if they feel that Bambu Lab is stabbing them in the back, they don't have to jump when Bambu Lab tells them to (that's pretty much the raison d'être of open source).

Re:Bambu Lab - Setting the Record Straight About Our Securit... by the_mitsuhiko on Monday January 20, 2025 @06:33PM (#42774469)
I'm guessing most of OrcaSlicer's users are using bambu printers and if they upgrade to the firmware that requires bambu connect it's quite likely that the OrcaSlicer maintainers will have some interest in keeping the slicer working.

The alternative is that users have to manually use bambu connect and that seems inferior to what the PR enables.

Re:Bambu Lab - Setting the Record Straight About Our Securit... by ipv6ipv4 on Monday January 20, 2025 @07:27PM (#42774842)
> I'm guessing most of OrcaSlicer's users are using bambu printers and if they upgrade to the firmware that requires bambu connect it's quite likely that the OrcaSlicer maintainers will have some interest in keeping the slicer working.

Yes. That's where the maintainers need to decide if they are Bambu Lab's lackeys or if they have a say in their beloved project. Part of that is thinking about at what point the project becomes pointless as a meaningful BambuSlicer alternative.

> The alternative is that users have to manually use bambu connect and that seems inferior to what the PR enables.

Everything is going to be inferior to using BambuSlicer. That is Bambu's real intent.

The OrcaSlicer maintainers probably have the most leverage (what little there may be) on Bambu Lab. I think that is why Bambu Lab is keen to offer the PR on GitHub. The maintainers should exercise whatever leverage they have while they still can.

Re:Bambu Lab - Setting the Record Straight About Our Securit... by the_mitsuhiko on Tuesday January 21, 2025 @02:17AM (#42777381)
> Yes. That's where the maintainers need to decide if they are Bambu Lab's lackeys or if they have a say in their beloved project.

I understand your anger, but I don't think that properly describes the situation. As a maintainer of an open source project your users are who you are about. If your users want support for bambu connect, then you are likely to implement it. Whatever Bambu does is whatever Bambu does, you need to accept it.

> Part of that is thinking about at what point the project becomes pointless as a meaningful BambuSlicer alternative.

Why would OrcaSlicer become pointless if it supports Bambu Connect? It also supports the Bambu network plugin.

> Everything is going to be inferior to using BambuSlicer. That is Bambu's real intent.

What would Bambu's motivation be to do that? I don't think they would have built Bambu Connect if the goal is not to support third party slicers to directly send things to the printer. Note that most 3d printers on the market didn't or still don't have integration into slicers.

Re:Bambu Lab - Setting the Record Straight About Our Securit... by ipv6ipv4 on Tuesday January 21, 2025 @02:09PM (#42784062)
I generally agree with your view on OrcaSlicer. I think we have a difference on what is better for the users and the project itself. I think it is better for the users if the maintainers take a stand against Bambu's dictat.

> Whatever Bambu does is whatever Bambu does, you need to accept it.

And maybe it is time to take your ball and go home.

> What would Bambu's motivation be to do that?

What is Bambu's motivation for being cloud first when it is not technically necessary? Why can't OrcaSlicer be a first class citizen like BambuSlicer? Instead it has to go through Bambu Connect which is inherently clunky and less featureful. It's simple. Control, and vendor lock-in. Possibly, Bambu sees this as a way to curtail print farm automation software from other vendors.

Re:Bambu Lab - Setting the Record Straight About Our Securit... by iLoveOncall on Monday January 20, 2025 @05:57PM (#42774135)
> But if they feel that Bambu Lab is stabbing them in the back, they don't have to jump when Bambu Lab tells them to (that's pretty much the raison d'être of open source).

The raison d'être of Orca Slicer is to slice files for 3D printers. They don't manufacture printers. They have no raison d'être if they don't support one of the major players in the 3D printing space.

Re:Bambu Lab - Setting the Record Straight About Our Securit... by ipv6ipv4 on Monday January 20, 2025 @06:08PM (#42774238)
OrcaSlicer is sponsored by Qidi and BigTree Tech. If anything, Bambu Lab is taking them for a ride, like it is taking the rest of the open source community for a ride.

It's clear you like your Bambu Lab printer/s. But I think you are letting it cloud your judgement. Bambu Lab is being predatory here.

Re:Bambu Lab - Setting the Record Straight About Our Securit... by parasubvert on Monday January 20, 2025 @06:11PM (#42774264)
Bambu Lab isn't being predatory. They're making a sensible change to their security.

But, because people don't understand security technology tradeoffs, everything becomes a conspiracy.

Re:Bambu Lab - Setting the Record Straight About Our Securit... by ipv6ipv4 on Monday January 20, 2025 @06:24PM (#42774381)
If this were about security, it wouldn't matter what piece of software was implementing the well documented security protocol. BambuSlicer, or OrcaSlicer, it would be all the same because the underlying protocol would be the security guarantee. This is rudimentary security tradecraft.

Bambu Lab is introducing something else. Most charitably, it could be described as security through obscurity, which is never secure. More realistically, Bambu Lab is introducing vendor lock-in under the pretext of security. Vendor lock-in is what this change actually achieves.

Re:Bambu Lab - Setting the Record Straight About Our Securit... by parasubvert on Monday January 20, 2025 @06:33PM (#42774468)
Controlling the software lifecycle of a client library or executable, to be able to update its x509 certs as part of an upgrade cycle, is ... not security through obscurity. It's pretty standard practice, especially if your customer base knows very little about maintianing certs/keys.

It's about a vendor trying to control an experience for its users balancing its UX and maintenance costs.

There's no real vendor lock-in here beyond the usual conspiracy "Bambu Lab is better therefore they're evil unless they give it all away for free to their competition", that's a pile of nonsense. Orca Slicer and 3rd party slicers will continue to work with the new approach if they can work out the details of the PR that uses Bambu Connect.

Re:Bambu Lab - Setting the Record Straight About Our Securit... by ipv6ipv4 on Monday January 20, 2025 @07:20PM (#42774792)
Somehow you can securely access your bank account with any browser of your choosing, and not a bank provided browser, but 3D printers need obscure proprietary security protocols to be secure. That doesn't make sense.
Re:Bambu Lab - Setting the Record Straight About Our Securit... by parasubvert on Tuesday January 21, 2025 @01:11PM (#42783379)
That's because the bank isn't generally using mutual TLS client authentication to verify your account details through your browser. You login with a password and other authentication factors .

Interestingly some banks do use x509 client authentication for corporate accounts or high net worth accounts but they expect you to know how to import the key to your browser. And almost all banking mobile apps use this to call their server APIs to ensure only the Bank's mobile apps (or partners) can call their APIs.

In Bambu Labs' case, they've had many DDOS attacks and other issues with their security and so they're forcing a constraint on the approved software clients that can access their printers and/or cloud service via client authentication. BambuConnect being the catch all proxy software for most.

Re:Bambu Lab - Setting the Record Straight About Our Securit... by ipv6ipv4 on Tuesday January 21, 2025 @02:03PM (#42783990)
None of this makes sense.

Bambu is forcing its customers to use its cloud offerings when many users want to use the machine on their LAN without the cloud guff. Many for security reasons. Bambu essentially tells its customers to pound sand, they are forced to use cloud. Now Bambu is claiming it has a cloud DDOS problem and therefore it is going to lock down what users can do further. I'm sorry, that's just silly. Let me connect to the printer locally, and your cloud DDOS problems go away.

The DDOS problem itself doesn't sound particularly compelling as a justification for this action, either. If every user action is authenticated, you know which users are abusing the system - throttle them or kick them out. Adding a TLS certificate for mutual authentication is going to reduce the DDOS overhead by a negligible amount.

> forcing a constraint on the approved software clients

Which will do nothing against a determined DDOSer since they will always be able to extract the certificates from Bambu Connect, or BambuSlicer.

Finally, if the issue is airtight security for the on-prem printer and preventing a hacker external or internal to the LAN from exploiting them. Maybe Bambu can take a page from the Matter smart home specs. if they are out of ideas. These are solved problems. Cloud not necessary. Software lockdown not necessary.

Re:Bambu Lab - Setting the Record Straight About Our Securit... by hWuxH on Friday January 24, 2025 @04:09PM (#42816964)
ppl always get caught up on the x509. They're actually a good thing and are absolutely necessary to prevent mitm since they use self-signed certs. BambuStudio also works that way.

The issue is introducing further measures which don't provide any security benefit to the user (can be spoofed): only allowing critical commands from BambuConnect.

Re:Bambu Lab - Setting the Record Straight About Our Securit... by sho_hn on Monday January 20, 2025 @05:49PM (#42774054)
> Hum, the alternative is OrcaSlicer stops working with Bambu printers...

Which is fine, no? Plenty of other good printers available.

Re:Bambu Lab - Setting the Record Straight About Our Securit... by parasubvert on Monday January 20, 2025 @05:53PM (#42774097)
Um no? First, Bambu is the best, by far. Secondly, Orca Slicer is a fork of Bambu Studio and the vast majority of its users are Bambu customers that want extra features.
Re:Bambu Lab - Setting the Record Straight About Our Securit... by sho_hn on Monday January 20, 2025 @06:16PM (#42774308)
> Bambu is the best, by far.

Nah, this is influencer-generated bro science sentiment. They do nothing special, and hardly never come out on top in any serious independent print quality tests.

Their primary competitive advantage right now the AMS bundle being very competitively priced.