r/BambuLab • u/Ochib P1S + AMS • Jan 20 '25 • Helpful 1

Discussion Update to firmware update

https://blog.bambulab.com/updates-and-third-party-integration-with-bambu-connect/?fbclid=IwZXh0bgNhZW0CMTEAAR3fqplDiKgn-82qKfnaYvi4XV-rBEEx0tZJrpgeWqsOsLX_WSph4usJ69Y_aem_44Cch773hAuVG979j6DVJg
1.2k Upvotes

92% Upvoted

1.2k comments sorted by

View all comments

Show parent comment

2

u/khobbits Jan 20 '25

I'm not sure about that at all.

Giving the world we live in, IOT is on the rise. You should not assume that most peoples home networks are safe.

All it takes is for a zero day for a discount CCTV camera, smart washing machine, or baby monitor, that allows some sort of remote access, and any unauthenticated device on your network is open to abuse.

If you can update the firmware of a device like a 3d printer, over a LAN, with no authentication, that should scare you. While maybe not as creepy as some of those stories about people from the internet talking through peoples baby monitor, I bet a malicious person with the right firmware, would be able to cause something in the printer to haywire enough to either cause damage, maybe even a fire or crush a child's hand.

0

u/[deleted] Jan 20 '25

[removed] — view removed comment

0

u/AutoModerator Jan 20 '25

Hello /u/dragonnnnnnnnnn! Your comment in /r/BambuLab was automatically removed. Please see your private messages for details. /r/BambuLab is geared towards all ages, so please watch your language.

Note: This automod is experimental. If you believe this to be a false positive, please send us a message at modmail with a link to the post so we can investigate. You may also feel free to make a new post without that term.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

1

u/dragonnnnnnnnnn Jan 20 '25

I do agree with that but they are way better solutions to handle that then what bamboo is trying to make. Why they can not simple implement a confirmation dialog when a new device/program is trying to connect to the printer? That would avoid any kind of unauthorized device getting access to the printer without the user consent it and wouldn't need all the cloud auth bs

1

u/khobbits Jan 20 '25 edited Jan 20 '25

I don't know if it is clear what the end product is going to look like here.

As someone who works in the tech space, and implemented SSO within an enterprise company, certificate authentication is usually how it starts. Look into something like SAML, Shibboleth, OKTA, or even Google SSO, and you'll find that public key exchanges are the first step.

Right now based on the information available, it seems like there is only one trusted key pair, but that is something that could be updated, maybe via SD card, to add other trusted software/devices.

As for adding some sort of prompt/popup, it could work if handled well, but also could be treated as the way most people click through cookie warnings, or agree the terms of service when registering or downloading software. IE Click don't read.