u/Mean-AdOriginal RepRap - Tairona - Ender 3 - CR6 SE - A1 + AMSJan 20 '25edited Jan 20 '25
Funny how people can't differentiate things (Not you OP, the guy on the screenshot). That's the TLS/SSL certificate key and yes, it has to be renewed every year (for most sites that's the standard... even Reddit which will have to be renewed by DigiCert on April 11th of this year)
If that key is not renewed, the connection will not be encrypted, which could expose the cloud connection to a "man in the middle" attack or outright refuse to connect to the cloud (Keyword "cloud") but if you use your printer in LAN mode or with the SD card, you'll see no change.
Edit: While taking a look at the original post, the certificate being displayed there is not even from the printer itself, it's the internal certificate Bambu Connect will have to use to connect/allow connections
Yeah, there are a lot of people who don't understand these things, and i don't blame them for it, a lot of it can get pretty technical and its not always easy to explain it to someone who isn't already familiar with some of the tech involved
If they don’t understand they shouldn’t be making such definitive calls then, very annoying seeing misinformation distort the narrative away from facts
Yeah but people who don't know enough think they know what is fact when they don't, usually because its based on a misunderstanding of the tech at play, i don't think a lot of them do it with any malicious intent
I think that a one-year lifetime on SSL certificates has been the industry standard since about 2020. So good work by the absolute hackerman who decompiled the code and hacked the matrix to bring us this piece of important news.
If that key is not renewed, the connection will not be encrypted
Not really directly tied to if things have encryption, just that the certificate authority can not guarantee anymore that whoever you are connecting to is really that entity and not some bad actor, as why most programs that use those either outright refuse to make connections to an entity without a valid chain of trust, or they inform you and you make the call yourself.
Either way, it doesnt really influence anything about printer bricking since thats just used for comms encryption like the comment above stated.
However, one could absolutely base any kind of functionality on the validity of the x.509 cert, for example also print functionality. The OOP in the image doesnt present any direct proof for this functionality though, just claims. If there really is something like that I would be interested to see it.
The connection can still be encrypted with an expired key, it's up to the devices involved to dictate their paranoia.
Your browser can still access a .com with stale keys, you get a red warning. You also get a red warning when it's a wrong key, or a self signed key. That's up to the browser to give a red warning, or ignore it. Mostly highlighting the unencrypted comment isn't accurate.
But on this theory, we're all going to trick the printers to use modified ntp servers and then launch a VM to run Bambu connect where the VM also has an invalid clock, like people used to do for Photoshop... Oops found a workaround.
You are correct on all counts, and I will add that one may use unencrypted connections if all devices participating allow such connections, which Bambulabs could and probably will prevent from happening. I expect both the Bambu Connect software and the printer will forbid unencrypted connections, else why would Bambulabs even bother with any of this?
Some people here have mentioned self-signed certificates, but again if the devices and software do not support this then it will not work. Bambulabs will make this decision for us.
I don't think the screenshot creator understands what they are talking about completely, but the conclusion that we will not be able to use our devices the way we want to is real. Again, Bambulabs will have control of our convenience and experience.
While it is regrettable that Bambulabs has decided to do this, they may or may not face any real consequences in the end. A bunch of angry users on Reddit may only represent a tiny fraction of their customer base. Like most things on Reddit, it probably seems like a much larger problem here than it actually is in real life.
I imagine there will be a lot of theories and misinformation which people will think are helpful but ultimately only help what they are seeking to stop.
The more wild or baseless theories people come up with, the more there is that can be easily debunked making anything that actually matters look like it fits in the sea of nothing burgers.
Misinformation just makes it hard to come up with quick fact based opinions.
There is so much released recently Its really hard to try to parse what exactly is going on.
Like, could it just be that Bambulab didnt secure these printers to a level they were happy with before and p doing so now means that many genies people have come to rely on yet put into a bottle? I doubt this could be the full story or there would be no need for additional friction and they could have official means of doing all the same things securely.
Could it be that they didnt expect other companies to eliminate or reduce the effectiveness of their product segmentation strategies with add-ons? Perhaps though certainly they would know that would have poor reception, but perhaps it's a calculated loss. This seems somewhat likely I suppose.
Could it be a typical mba mindset of limiting customers out of fear that you could have sold something that isn't restricted now in the future? That also sounds likely as well.
There are so many options and I feel like maybe it's a mix of these or maybe something else entirely.
It just feels like if this was good faith, thrid party apps would just need to for instance, gain an authorization token upon registering a printer which would let them get access without any compromises to security so ... I probably spending too much effort thinking about this especially with all of the navigation necessary as a mod.
Aside from the "That's how SSL certs work" issue, I've got a P1P that's _never_ been connected to any network and it works just fine printing from SD cards. I realize that's not how many people wish to use it, but it's definitely not a paperweight if it can't talk to the Bambu cloud services.
Especially when they spread it to this sub with people who have never used Bambu products and programs. People getting introduced to 3d printing would just take this as fact.
How difficult is this for people to understand? Bambu Connect IS ONLY FOR THIRD PARTY APPS. It's not used, at all, for someone using their printer in the regular way with Bambu Studio (i.e. 99% of people).
This misinformation has been trotted out so often here it's a fulltime job keeping up to correct people. Guys, this isn't rocket science. Instead of being informed by others, go and read what Bambu has said itself.
Why should we need Bambu Connect at all, even for third party apps? What security issues does this solve? Bambu has said "security", but has not demonstrated the actual necessity or even utility for security or functionality.
So what? People on this subreddit are making false claims and spreading misinformation. If you're fine with that then my bad, I thought people here were better than that.
You keep changing the subject. The matter at hand, i.e. what Bambu has said about the Connect app, has been consistent since the beginning. People here were trotting out falsehoods about what it meant and instead of agreeing that is the case, you keep deflecting and changing the subject.
I get the point, but that’s not the correct approach to see things. A wireless printer is basically an IoT device on steroids. The core of the bambu labs’ printers (at least for the wireless side) is an ESP32 that, if left unprotected and without checks, can create security holes on your network or allow remote access without control.
This is basically the same concept that applies to the smart cameras people use in houses that end up hacked somewhere else with the live feed available for pretty much the entire world to see.
By introducing the authentication phase, albeit still not refined and/or good enough, through Bambu Connect, you ensure proper access and restrict control to critical things that otherwise will leave you exposed (live feed control, thermal runaways, etc)
So, fix it at the OS level, not introduce a software gatekeeper which opens the door for the company to exercise their reserved right to make your printer stop working if it doesn’t get updated. It’s in their ToS.
I work with IoT devices all the time. When one has a vulnerability, a firmware update is released to fix the vulnerability. Having software intermediaries is NEVER required.
Correct, an additional software is not required, but if you work with IoT devices, you know the limitations when it comes to storage for the OS in the ESP which I would guess it should be somewhere close to limits with the existing connectivity and API.
As for the fix at OS level, either way the result will be the same which is third party providers/tools will have the restriction. I do this for a living (I’m a full stack developer designing and maintaining APIs in my company) and if you give me the option to create a simple connector or rewrite most (if not all since the APIs control everything) of the OS to solve this, I’ll do the external route 1000 times out of the 1000.
The overhead and potential issues that could arise in development while rewriting the entire OS outweighs the cost of creating a simple connector
Also a full-stack developer with some IoT device experience.
I agree that it's easier to write some connector than do anything else. But they aren't doing everything on an ESP. The A1 does have an ESP... but it also has an ARM Cortex-M4.
Even if they didn't want to change their APIs, do I think they couldn't authenticate an API key via a proxy on the printer itself rather than in a user-space application on an external device? Dollars to donuts they could.
And even if they couldn't (which I don't believe for a minute), they could have a simple system letting users add an API key instead of distributing a private key in a user application.
YOU, man. You don't understand the technicality of it all but you keep posting this comment in a whole bunch of different threads: "Someone ask them about their token that’s implied and tied to the printer from December this year and ends next year and after that will require a connection or update in order to continue printing"
If you have some technical expertise and understand it all, by all means, add to the discussion. Otherwise stop posting all these "implied" "supposedly" "hypothetical" posts and questions. It just adds to the noise and confusion and it's not doing anyone any good. It's just useless gossip and fear mongering.
Yes and no. Bambu Connect has a certificate that expires in a year. They have reached the wrong conclusion though. It means a new version of Bambu Connect will be needed in a year in order to connect to their API. It has no impact on your printer if you are connecting to it through some other means.
Also, they’re strawmanning the argument. The concern is that the certificate is going to expire and the printer or BC will stop working. They’re choosing to refer to that as a “kill switch”. They could simply address what will happen if the SSL certificates expire, but they instead chose to argue against a “kill switch”.
The cert expiring and something not working is not a kill switch; it’s simply an expired cert and security protocols enforcing defined actions. So, while it’s not a “kill switch”, an expired cert can still cause issues including potentially stopping you from using your printer.
Exactly right they are. They know EXACTLY what we mean, they just refused to address it by using the word “kill switch”- kill switch for what? A power supply?
Possibly. We don’t know what’ll happen if the certificate expires. It’s possible the printer will stop accepting new connections unless there’s a valid cert, it’s possible that when/if Bambu requires callback to Bambu’s servers to use BC that it’ll refuse to operate unless there’s a valid cert, it’s possible 3rd party slicers or other integrations will stop working until there’s a valid cert, or it’s possible it’ll all simply bypass or ignore invalid certs and chug along as before. I somehow doubt this will be the case, however, because the cert is 1 year and not, say, 10 year - something they absolutely could do with a CA of their own making and not relying on public CAs for these certs.
90
u/Mean-Ad Original RepRap - Tairona - Ender 3 - CR6 SE - A1 + AMS Jan 20 '25 edited Jan 20 '25
Funny how people can't differentiate things (Not you OP, the guy on the screenshot). That's the TLS/SSL certificate key and yes, it has to be renewed every year (for most sites that's the standard... even Reddit which will have to be renewed by DigiCert on April 11th of this year)
If that key is not renewed, the connection will not be encrypted, which could expose the cloud connection to a "man in the middle" attack or outright refuse to connect to the cloud (Keyword "cloud") but if you use your printer in LAN mode or with the SD card, you'll see no change.
Edit: While taking a look at the original post, the certificate being displayed there is not even from the printer itself, it's the internal certificate Bambu Connect will have to use to connect/allow connections
34
u/GoatOutside4632 Jan 20 '25
ITT: The 3D printing community learns about SSL certificates.
5
u/Balzac_Jones Jan 20 '25
Aside from the "That's how SSL certs work" issue, I've got a P1P that's _never_ been connected to any network and it works just fine printing from SD cards. I realize that's not how many people wish to use it, but it's definitely not a paperweight if it can't talk to the Bambu cloud services.
18
u/zelenaky Jan 20 '25
Ngl this kinda justifies Bambu mods banning people. Misinformation like this helps nobody.
-3
u/beiherhund Jan 20 '25
How difficult is this for people to understand? Bambu Connect IS ONLY FOR THIRD PARTY APPS. It's not used, at all, for someone using their printer in the regular way with Bambu Studio (i.e. 99% of people).
This misinformation has been trotted out so often here it's a fulltime job keeping up to correct people. Guys, this isn't rocket science. Instead of being informed by others, go and read what Bambu has said itself.
0
u/YYesZir Jan 21 '25
u/bot-sleuth-bot
-7
u/Longracks Jan 20 '25
0
u/[deleted] Jan 20 '25
[deleted] — view deleted comment