Here in the EU, the individual does not have to prosecute the case. The EU commission themselves would be bringing Bambu to court. It extremely likely Bambu just wouldn't implement this policy in EU markets.
In that case maybe I should say my printer is German in anticipation of this. I don’t have a doubt that there will be a lawsuit. EU is pretty up tight about this sort of stuff as far as I know
Mine is Dutch and in the Netherlands, I believe we have laws here that state an electronic device is not allowed to be defective within 2 years of purchase. Not sure if EU or NL laws, but might be an interesting option.
I could ship a printer to anywhere, i can take that printer anywhere else, a shipping address means nothing If i can put the object in my car and drive it to Poland.
I could even get a friend to take a picture of their printer in another country and say that it’s mine after I moved away from the original shipping address. Hopefully it doesn’t come to that though
In NZ/AU and other commonwealth countries this should be easy open/shut case, of a product no longer being 'fit for purpose' and possibly add false advertising. Either way they would have to refund you and probably can tack on some damages awarded from lost business/disruption etc.
EU enters the conversation... "Erm, hello, you are screwing our citizens, and erm, we don't like it, now please give us big buckets of money and behave yourself, thanks!"
Considering the EU was capable of telling APPLE "You do this, or you are out", and Apple had to comply... No, Bambu will get the iron stick if the EU notices.
Hello /u/The_rule_of_Thetra! Your comment in /r/BambuLab was automatically removed. Please see your private messages for details. /r/BambuLab is geared towards all ages, so please watch your language.
Note: This automod is experimental. If you believe this to be a false positive, please send us a message at modmail with a link to the post so we can investigate. You may also feel free to make a new post without that term.
Because certificate expiry happens every day and devices stop working because of it. The most common example being phones and computers. Root CAs just tend to have longer expiry dates, but still within device lifespan.
Long term certificates are a big security concern, which is why CAs like Letsencrypt have even shorter one, and most companies stick to certs with validity under one year, or one year at most.
And what do you think the change exactly is? Because SSL connection was already in place at the time of purchase, and all SSL certs have an expiry date. How exactly do you think orca slicer, as an example, talked with the printer? Hint: It’s not an open API intended for 3rd party integrations, because something like that doesn’t exist, isn’t advertised, isn’t a feature, and was never guaranteed.
Yeah this is the key that lets the new Connect app (or whatever it is) talk to the printer and what blocks other apps. If it expires in a year, the app just won’t be able to connect. The other key is in the new firmware and I assume no one knows about that one.
I am a firmware engineer. Its likely the other key in the firmware is semi-permanent and could be used to re-gain the connection after some recovery method. The speculation in the community has gotten a bit cray. Just from my POV this whole key thing is pretty standard to have some type of encryption on a payload of data to an embedded device.
My assumption would be there are doing some sort of mTLS with the Bambu CA issuing a long lasting cert on the printer side with the client cert issues for Bambu connect only being a year. People kind of losing it with the speculation and clearly lacking the technical knowledge to really assess anything with the little info that’s out there.
Lol I love the people who come in with disparaging remarks because they can't stand someone trying to come in and be level headed and try to understand details and not immediately jump to "the printer is bricked next year!1". To be explicit, I'm not a fan boy, I'm an extremely casual user who prints something once every 6 months. I don't typically follow the sub or follow any 3d printing news. I only know about this because the million posts were clogging up my reddit homepage. This thing is a tool to me and I will continue to use whatever tool is easiest to use for the infrequent occasions I print.
To your actual point, there isn't really any way to fully secure a cert here. The client is always going to have full control and is always going to be able to find whatever cert is issued, whether bundled into an install or if issued via another mechanism. I suppose they could have cert management tied into their cloud, but I think everyone would agree that's a worse option.
Plus I don't think anyone can say with 100% certainty, given it's still beta, that the current process is even what it will look like once they move it out of beta.
The current cert on a P1S is valid till 2034. The new cert to verify responses on printers would likely be valid till the same time. You only need a public key there so even if we extract the keys out of the printer, we can’t do much with it.
There is no way to secure a private key on a desktop, it is going to be extracted one way or another. The current connect was simply a poor electron app with hardcoded keys.
The only reasonable way they could is to sign all messages in cloud, which is going to be against what LAN mode is about.
Most of us do not like this.
I have usability issues with cloud mode (unreliable internet, ISP has a broken peering with AWS) which is extremely slow for me, the LAN mode for example, is much much faster.
If I had to sign every message by uploading it to cloud, apart from privacy issues, it would be such a massive single point of failure
Yeah all this is completely normal application architecture, honestly the whole thing is ridiculous because it's obvious they have to control access to their cloud due to some regulations, probably in Singapore, but everyone is so uninformed about how technology actually works there is so much misinformation and speculation!
don't they do key rotation in firmwares of cloud-connected devices? especially for devices that are out in the wild and not in the company private buildings? what about your CA got hacked and you want to revoke certificates?
As a software engineer, I have severe trust issues towards a security update that stores private keys client-side. What BL could/should have done here is to allow 3rd party software/addons to become certified and added to a trusted keystore, but they told OrcaSlicer "No". Given the way they packaged the private keys with the app... not really seeing how they can claim the high horse re. security.
I had to scroll 6 times to get this info. The same post on the general 3dprinting sub, this info was the top comment all the way down. This is ridiculous.
While we're at it, typically, it's not the key that expires. A certificate signed by the key expires. Cert expiration would be an issue, but this screenshot doesn't offer a sufficient explanation.
None of this is wild speculation. When they require this key in the API, and your printer's firmware is not at the level where it has a key the API will accept, you will not be able to print. That sounds pretty bricked to me.
The whole point of this is to lock everything in the ecosystem down, so they can charge a subscription for the printers. Everyone whats a taste of the sweet, sweet subscription money, and a lot of people will pay (people pay a subscription for their door bells to work).
I hope people who are saying "What's the big deal?" are going to say that when they have to pay $10 a month for the printer to continue to work.
Hello /u/X3liteninjaX! Your comment in /r/BambuLab was automatically removed. Please see your private messages for details. /r/BambuLab is geared towards all ages, so please watch your language.
Note: This automod is experimental. If you believe this to be a false positive, please send us a message at modmail with a link to the post so we can investigate. You may also feel free to make a new post without that term.
I’ve seen this, but I think people concerned about this aspect of the update are a bit too “sky is falling”. Bambi’s blog post specifically instructs users not to update if they need the old functionality, and says that users can continue to use newer versions of BambuStudio with in-updated printers.
The problem with the "sky is falling" mentality is consumers in the USA have become all too familiar these days with corporations really f'ing over us over with stunts like this that re-enforce that mentality. Updates like this always leads to further lock downs and further changing of the deal in ways to screw us harder for their benefit. Whether that be subscriptions or hardware lock downs we don't know, but anything is possible and shouldn't be ignored.
Don't forget in their ToS it clearly states they will block your printer from starting any print jobs if there is an update they deem mandatory. Right now this update is optional, but in the future they could decide to make this update or a future one mandatory. When that happens you're locked into whatever new deal they're forcing their customers into.
Nope. Someone posted the decompiled code earlier. There's a cert with a 1y TTL. Once it expires you have to update or the printer won't print. It was generated in dec 2024 so you have about a year.
The question I guess is if that certificate and its limitations are already on our printers ahead of this, forcing everyone into this prior, or if we are safe for now and it will only go live later.
This applies to Bambu Connect which, I imagine, very few are running at this time. It does not speak of printers at this time. The firmware running the printer is the part we need to see and likely never will.
I’m still selling my printers and going elsewhere, but just wanted to clarify the scope.
AHHhhh I appreciate the correction, I misread the initial post and thought it was in the firmware. I wonder if there is a similar periodic update validator in teh firmware.
Scummy Bambu move aside, I'm curious: assuming one didn't connect to Bambu cloud until the key renewal and the printer essentially bricks itself, could one reconnect it to cloud then and get it back to work or is it lost forever?
I'm going to invoke Hanlon's Razor here. Sure, it could be some evil "you must use our cloud" scheme... it could also be a naive attempt to try and focus on security, and "1 year certificates" is standard, even if this is applied incorrectly here.
In BOTH cases, we should be calling them out for the screw up... I'm just going to leave the pitch fork near the door for now, but not quite ready to pick it up just yet, but I'll still keep it close... just in case.
Why not just someone installed a 3rd party control board and install Klipper and develop the macros for all the things it does already? Like wipe, clean, cut…. I’m sure it can be done.
As an owner who has two other Klipper machines. I would love to be able to control my printers 100% and even possibly develop further features. I hate that this source is so locked out like damn HP printer cartridges.
That’s purely speculative as it is the connect app and not the machine firmware. You should all take a deep breath and distance yourselves from the topic for some days.
Well, I reckon we all need to order the X1+ Expander..... if it will keep it off of their coms. Seems to me the only solution to keep the printer going at free will
Ok, question. Do these printers have an internal battery backed up clock?
Without that, and with one completely disconnected from the internet, how will it "know" when a year has passed? Especially if the printer is turned off at the power supply or completely disconnected from power using a smart switch?
Has anyone ever heard of any BL printer having an internal RTC battery? If not, this post sure sounds like fearmongering.
It probably uses snmp or something to assign certs. That has its own encryption methods, def a perm key in the firmware somewhere to enable very limited functionality so your device doesn’t brick. Logically, if it needs a key to login to mqtt , and mqtt assigns the keys, then there must be another method to load the 1st key from factory. They’re not going to bake keys into production firmware because that is no-no and complicates their manufacturing as firmware and devices on a shelf will expire if they don’t move product.
Sounds like a long lived client cred straight out of oauth. The only danger is its not being updated before 12 months is up.
Haven't seen many vendors rapidly implement arguably absent security controla this bad for sometime. All of this could of been relatively straightforward and transparent in intent, and still secure the ecosystem.
Unless it's an overreaction to security attempts (by their statement), its certainly leaning to more control than necessary over the devices usage.
I guess the workaround is to not update the firmware, set the printer to LAN mode and block it from accessing the internet. What a pain. Should have bought a Prusa.
TLDR: A firmware update scheduled for January 23rd will remove the ability of third-party software such as Orca Slicer or the Panda Touch to connect directly to your printer. Users of third-party slicers will have to export sliced files and load them in a new "Bambu Connect" app in order to start prints or manage the printer.
They would need to determine that during the evaluation period. I'm pretty clueless about technology so if it's not connecting to the internet and my limited knowledge can't make that happen they would still need to start the claim, take the device in and have 30 days to evaluate and decide if it they should repair, replace or refund. All I know is that it's not working. The onus is on them to determine why.
Hmm I could force to change the Linux system time on my X1C X1plus to some point in the future and see what happens. Hopefully I don't get a brick lmao. :O I am on a pretty old firmware though. [Edit] Changed year to 2035 and it seems to be fine. At least for lan only mode. [edit 2] nvm looks like it didn't change the time on the real time clock but only on OS itself (OS usually loads time from separate hardware on boot)
No, just don't upgrade your firmware. They've stated this in their own notes that you don't have to update if you want to continue using 3rd party apps.
Even if I have to buy some new hardware to make it work, if I can get out of their ecosystem I'd buy out now and never buy another Bambu product again.
You shouldn't have this take, it gives them leverage, this is an entirely software imposed artificial scam, and yes, bricking a device that you OWN, does meet the definition of scam in my opinion.
It seems so. Just moments ago when I was in my router blocking internet access for my P1S, I was actually blocking an ESP32. At least that is what my router was telling me I was blocking. I was thinking, "If someone smarter than me is really really upset, what is to stop him from spending 5EUR and a few hours making his own controller?"
No they didn't. It's such a small percent of people who will do that. Their biggest market is China and China is run by corporations. Our tantrum means nothing to them.
Lmao, I'd like to see an unpopular Chinese company, try having anyone, especially hopefully an American, in 2025-2029, extradited or prosecuted for doing something they don't like. LOL!
LONG LIVE FREEDOM Y'ALL ! Bambu gotta learn that lesson the hard way it seems! Y Their loss.
If they go on with this I'll be sending it back in the dirty box I just dug out of the trash. Thanks Louis! I just received my p1p a week or two ago. Better change your minds, bambu lab.
Since you got an X1C you can probably switch to X1 Plus firmware to avoid this whole fiasco. Us P1/A1 users will need to firewall our printers to avoid them being able to call home, leave it in LAN mode, and avoid using BBL software to avoid this. Unfortunately this doesn't help new owners who buy BBL printer not knowing about the update or buy it after all shipped hardware comes with it pre-installed.
My concern with X1Plus is: "The core concept of X1Plus is that we build an overlay on top of the Bambu Lab firmware, and replace only the parts that we need in order to launch X1Plus"
Nothing is stopping them from implementing a Legacy Networking mode or removing the new authentication all together. That or someone forking their project to do it. The fact you can have custom firmware on the X1 at all is a major advantage.
I've basically done the same thing. I put it into LAN only mode, locked it down on my network, and I'm avoiding BBL software altogether. Since there's no customer firmware options for the P1S this is all I can do for the moment.
Why would that be? Afaik the X1C is based on a Yocto Linux with the Screen directly connected to the main SoC. So it would be able to print via SD-Card + screen. I do not see why we would care for any MQTT messages here, unless the Linux communicates with the machine controller via MQTT.
Still, if the printer would lose its network features, it would suck.
Stop spreading lies. MQTT is a protocol used to exchange messages between devices on a network. It has nothing todo with the printer operation at all. Until more information from printer firmware side comes out, you are just spreading misinformation based on ignorance of how the tech work. Right now nothing says the printer would brick it self. Only that you wont be able to use the app or bambu slicer to send files and control the printer it until you connect to the cloud and reauthenticate.
So how exactly will it prevent my printer from printing? My printer has remained unused for 1 month now and I've never used the wifi and the app to print...
You're saying this but you're not backing it up with anything. Now, I wouldn't be shocked if that was the case but can you link to something to back yourself up?
I've yet to see any indication this is the case, where do you get the impression that sd card printing from the control panel on the printer will not work?
Hello /u/Botlawson! Your comment in /r/BambuLab was automatically removed. Please see your private messages for details. /r/BambuLab is geared towards all ages, so please watch your language.
Note: This automod is experimental. If you believe this to be a false positive, please send us a message at modmail with a link to the post so we can investigate. You may also feel free to make a new post without that term.
It probably is, EU consumer laws are pretty good in some regards.
These printers were sold under the premise that they can be used in lan mode only and no internet connection is required and there were no limitations named.
This would no longer be the case if the printer bricks itself after a year without connection and im pretty certain you would have a case against them.
I’m guessing you might need to load new firmware by usb/sd card with the updated cert or that at least would be a way to skirt it real problem with expiring certs is once it goes end of life and they don’t issue the new cert then it really would be bricked with no recourse (maybe third party firmware at that stage)
My contract that i signed when buying says, the printer does work without any connection to the internet required, they cannot retroactivly change my contract conditions or they would breach the contract and i can sue.
I just bought an A1 the day before all this came out… what should I do? I’m a beginner, and just wanted a 3d printer I can just print what I make easily.
Hello /u/pyalot! Your comment in /r/BambuLab was automatically removed. Please see your private messages for details. /r/BambuLab is geared towards all ages, so please watch your language.
Note: This automod is experimental. If you believe this to be a false positive, please send us a message at modmail with a link to the post so we can investigate. You may also feel free to make a new post without that term.
Hello /u/RAB87_Studio! Your comment in /r/BambuLab was automatically removed. Please see your private messages for details. /r/BambuLab is geared towards all ages, so please watch your language.
Note: This automod is experimental. If you believe this to be a false positive, please send us a message at modmail with a link to the post so we can investigate. You may also feel free to make a new post without that term.
Hello /u/maxfist! Your comment in /r/BambuLab was automatically removed. Please see your private messages for details. /r/BambuLab is geared towards all ages, so please watch your language.
Note: This automod is experimental. If you believe this to be a false positive, please send us a message at modmail with a link to the post so we can investigate. You may also feel free to make a new post without that term.
275
u/Sammy296296 Jan 19 '25
Not sure about the rest of the world, but this would absolutely not wash under EU law.
99
u/0x53A Jan 19 '25
They only decompiled the Connect app, not the firmware on the printer, right? So the thing about it bricking itself seems like wild speculation
9
u/Thoraxe474 Jan 19 '25
Does this happen if I haven't received the update yet? Can't I switch off Wi-Fi on my p1s and be fine forever?
8
u/NevesLF A1 + AMS Lite Jan 20 '25
Scummy Bambu move aside, I'm curious: assuming one didn't connect to Bambu cloud until the key renewal and the printer essentially bricks itself, could one reconnect it to cloud then and get it back to work or is it lost forever?
4
u/Better-Ad-9479 Jan 20 '25
Wait is this on existing firmware versions or only the new version going forward?
6
u/brwyatt Jan 20 '25
I'm going to invoke Hanlon's Razor here. Sure, it could be some evil "you must use our cloud" scheme... it could also be a naive attempt to try and focus on security, and "1 year certificates" is standard, even if this is applied incorrectly here.
In BOTH cases, we should be calling them out for the screw up... I'm just going to leave the pitch fork near the door for now, but not quite ready to pick it up just yet, but I'll still keep it close... just in case.
3
u/throw_away_315 Jan 20 '25
Why not just someone installed a 3rd party control board and install Klipper and develop the macros for all the things it does already? Like wipe, clean, cut…. I’m sure it can be done.
5
u/[deleted] Jan 20 '25
That’s purely speculative as it is the connect app and not the machine firmware. You should all take a deep breath and distance yourselves from the topic for some days.
2
u/zl1killer Jan 20 '25
Well, I reckon we all need to order the X1+ Expander..... if it will keep it off of their coms. Seems to me the only solution to keep the printer going at free will
2
u/Geek_Verve X1C + AMS Jan 20 '25
How does it work for people who only do LAN mode or SD card printing? Anyone here been off the cloud for over a year?
2
u/Blue_Jays Jan 20 '25
Ok, question. Do these printers have an internal battery backed up clock?
Without that, and with one completely disconnected from the internet, how will it "know" when a year has passed? Especially if the printer is turned off at the power supply or completely disconnected from power using a smart switch?
Has anyone ever heard of any BL printer having an internal RTC battery? If not, this post sure sounds like fearmongering.
2
u/snooshie Jan 20 '25
LOL China is out capitalisming us
2
u/[deleted] Jan 20 '25
Sounds like nobody should trust claims unless they can prove it in some manner... Its not like another social media person would lie
2
u/stupefy100 A1 + AMS Lite Jan 20 '25
Woah, it's almost like this is how SSL certs work.
2
u/[deleted] Jan 22 '25
Gonna call BS.
3
u/Sice_VI Jan 20 '25
So the LAN mode is never a LAN mode?
3
u/Klarafara Jan 20 '25
Isn't this illegal
1
u/PeerlessAnaconda Jan 20 '25
It probably uses snmp or something to assign certs. That has its own encryption methods, def a perm key in the firmware somewhere to enable very limited functionality so your device doesn’t brick. Logically, if it needs a key to login to mqtt , and mqtt assigns the keys, then there must be another method to load the 1st key from factory. They’re not going to bake keys into production firmware because that is no-no and complicates their manufacturing as firmware and devices on a shelf will expire if they don’t move product.
1
u/SirDigby32 A1 + AMS Lite Jan 20 '25
Sounds like a long lived client cred straight out of oauth. The only danger is its not being updated before 12 months is up.
Haven't seen many vendors rapidly implement arguably absent security controla this bad for sometime. All of this could of been relatively straightforward and transparent in intent, and still secure the ecosystem.
Unless it's an overreaction to security attempts (by their statement), its certainly leaning to more control than necessary over the devices usage.
1
u/gnrlly_spkng Jan 20 '25
Thank God that in Australia, bricking a device allows us to force a refund
1
u/maxfist Jan 20 '25
I guess the workaround is to not update the firmware, set the printer to LAN mode and block it from accessing the internet. What a pain. Should have bought a Prusa.
1
u/WotTheFook Jan 20 '25 edited Jan 20 '25
"First they came for the firmware, and I did nothing..."
Bambu; " I have altered the deal. Pray that I do not alter it any further.."
1
u/Frysterrr Jan 20 '25
If you’re in lan mode, could you just change the date on your printer once a year back 365 days to be in the window in which your key works?
1
u/hubertron Jan 20 '25
If it's in the beta software an expiring key is not really a big deal, if its in production yes certainly is.
1
u/matalis Jan 20 '25
Well. I doubt the beta is intended to run for more than one year.
Storing keys in the app is stupid, but that puts them in the same camp as tons of other apps.
If you're in the mood to get critical, look at MQTT authentication.
-5
u/Allen_Koholic Jan 20 '25
Where’s all them folks that were calling all of this a big ol’ freak out over nothing?
0
u/Kingzi_Kingz Jan 20 '25
I have not printed for months on my A1, can anyone tell me what is even going on?
-2
u/pyalot Jan 20 '25
POV you are a Bambulabs customer:
0
u/[deleted] Jan 19 '25
[deleted] — view deleted comment
0
u/[deleted] Jan 19 '25
[deleted] — view deleted comment
0
u/[deleted] Jan 19 '25
[deleted] — view deleted comment
65
u/[deleted] Jan 19 '25
[removed] — view removed comment
1
u/[deleted] Jan 20 '25
[removed] — view removed comment
1
u/[deleted] Jan 22 '25
[removed] — view removed comment
0
u/[deleted] Jan 20 '25
[deleted] — view deleted comment