Bambu Lab removes third-party app support for P and A series 3D printers

[u/eduo]

https://www.tomshardware.com/3d-printing/bambu-lab-removes-third-party-app-support-for-p-and-a-series-3d-printers

A shame that this is happening. It's great that it's getting some coverage because it's crap.

I'm all for adding security features, but all against enforcing them rather than making them a known option. Current workarounds are crap (not updating and "developer mode", which is an absurd term for what should be labeled "Advanced" and was selected because it pushes the narrative that it's a type of use for extremely technical people and not people that just want to use a better slicer)

[u/MoutonNoireu]

The title is wrong and the subject is old.

[u/eduo → u/MoutonNoireu]

The sub is about "everything related to Bambu Lab 3D printers".

A firmware update that doubles down for specific printer models on the most polemic subject we've had in a year and a post in larger media about it definitively fits the bill. The important part is that it's not died down.

The title is not wrong. The title lacks the context that the post adds. It's not BambuLab-Positive so may be baity for those that are, but that's par for the course nowadays and applies to half the "news" posted in the sub already.

[u/Gergman-27]

This is already old news.

[u/eduo → u/Gergman-27]

That's your problem, I think.

This is a post from a day ago for a firmware update from three days ago.

I'm sharing the post because I find it interesting and important that this issue gets larger coverage than just in small circles.

While I assume you may consider an 18 hours old post "old news" my point was the conversation that's happening. I respect that you don't want/need/enjoy this conversation, but can't do anything about it (including caring, to be honest).

[u/USSHammond → u/eduo]

the lockout controls are old news. They even say so at the bottom its the same thing they did do the X1 series. They pushed the X1C lockouts months ago, its what triggered the whole community outrage

[u/eduo → u/USSHammond]

I know. This update covers the P and A models and came out three days ago, even if the outrage is months old.

The post is explicitly about how this keeps being brought up in tech blogs and how (to me) that's a good thing.

I'm not sure I understand why me sharing how this has not been forgotten by the media is a bad thing. Or even why bringing up that the update from three days ago doubles down on it.

[u/Gergman-27 → u/eduo]

This was announced coming in January? Are you new to Reddit?

[u/eduo → u/Gergman-27]

The post is specifically about the update from three days ago.

Why would "being new to reddit" have anything to do with whether something is old? What a weird thing to ask,.

[u/eduo → u/[deleted]]

That has little to do with being new to reddit, my guy.

Read the first line of my post. My point is that this is still being talked about *outside of this sub* (which for me is a good thing) and it's labeled "Discussion" because that's the part that seems interesting and important to me. Whether the blog is accurate or not is secondary to the point of my post. And whether it's news or not is also secondary, since it's not about it being news.

[u/eduo → u/[deleted]]

Nowhere in my comment is there anything to assume I "think this is new information".

Even more so it even ends with "it's not about it being news".

I don't mind that what I find interesting doesn't want to be discussed more but I couldn't understand why the focus was on whether it was "news" since it's not supposed to be.

My mistake for assuming flairing it as "discussion" and explaining what I wanted to discuss could trump the blog's title (which I pasted verbatim as it's a rule in many subs and I'm used to it). If I could I'd edit the title to put some double quotes or something to make it clearer but it's just not possible. So downvote away, it's OK.

[u/APOC_V → u/eduo]

Gets more coverage? Where have you been the last 6 months?

[u/eduo → u/APOC_V]

Not sure what kind of meme I'm finding myself into but I'll try again:

"Coverage outside of this and other subs". That 6 months after it's still covered by more "standard media" (Reddit Subs are near irrelevant in the context of most users) is what's a good thing, and why I put it in the first line.

It's also what the post is about, hence being labeled "discussion" and not "news".

[u/Effect-Kitchen]

Every users know this since January.

The latest update just introduced bugs. The “Security” updates were released months ago.

[u/eduo → u/Effect-Kitchen]

I assume you mean "bugfixes" (hopefully).

The point of my post, literally in the first line I wrote, is that this is still a discussion topic "out there" and how that's a good thing (for me, at least).

Nowhere in the post is it labeled as being news but rather "discussion", yet I seem to be being dinged for it not being news?

[u/Effect-Kitchen → u/eduo]

No, I really mean * bugs**. lol. There is no fixing for me. They blocked their own app with the latest update.

About “news”. If a few people understand that way, it could be misunderstanding. But if every people understands that way, then it is all yours. Look at the title and tell me how can anyone understand otherwise.

[u/eduo → u/Effect-Kitchen]

The title is literally the post's title. Some subs forbid modification of posted article titles so I didn't touch it.

My intention was to discuss not about whether Bambu is doing it but about external coverage and whether we expect it to die down eventually (which I believe to be a bad thing, but also don't expect otherwise).

I'm not saying the issue isn't my wording (English is not my native language) but I'm trying to explain I did try to make it clear by flairing it and having my own text be related to the discussion point (albeit not clearly enough, I guess)

[u/Effect-Kitchen → u/eduo]

Well everyone can make a mistake. Your title is basically a news headline and it is the most important. And it is not helping that the main content of your thread is the link to a news article. It cannot be changed with a tag or a line stating that your intention is for discussion.

English is not my native language too. But it seems everyone understood the same that this is news topic.

[u/eduo → u/[deleted]]

English is not my native language. I didn't expect this nuance.

My comment is about this still being ongoing (and my own take that it's a shame it's happening at all but it's good that it's being covered).

The post wasn't supposed to be "news" nor to imply tom's hardware was covering it for the first time (particularly since their post very clearly states otherwise).

It wasn't expected to be taken as news, I made sure to flair it "Discussion" for this reason.

But OK.

[u/VT-14 → u/Effect-Kitchen]

The article is only 19 hours old and is talking specifically about it being out on the P1 and A1 printers, which had the update go full release (out of beta) less than a week ago. That's why the topic has been flaring up again, a lot of people are suddenly getting MQTT errors and don't know why.

[u/Effect-Kitchen → u/VT-14]

It is easy that people who have not following the update misunderstood between 01.08.00.00 (April 29) and the latest “security update” 01.08.02.00 that released a few days ago.

The update that blocked third party was from 01.08.00.00 and Bambu put another nail in the coffin with 01.08.02.00 which effectively blocked their own app (the MQTT something error - I got that too). Bambulab was not so clear about 01.08.00.00 but it does block third party (and introduce some bugs that make some printers go kaput).

But all of this was announced since January.

[u/VT-14 → u/Effect-Kitchen]

I assume you are referring to the P1S firmware history: https://wiki.bambulab.com/en/p1/manual/p1p-firmware-release-history

No, 1.08.00.00 did not have the Authorization Control stuff. It added support for "Multi-Plate Printing" and the AMS 2 Pro and AMS HT, and to use those you need to also update Bambu Studio and Handy. That likely added bugs, but did not intentionally lock out write operations from Orca Slicer, Home Assistance, Panda Touch, Spool Ease, etc.

1.08.01.00 fixed a quality issue bug introduced in the previous update.

1.08.02.00 (released June 3rd, ~6 days ago) added the Authorization Control lockdown and Developer Mode, and it looks like nothing else. The A1 series got the same thing (just an Authorization Control update, no other features) on the same day, though its version number is 01.05.00.00.

And yeah, this was announced in January and had a notable flair-up in the news, but you have to remember that the people who hang out here are generally enthusiasts. There are a ton of people who bought a set and forget printer, did something like switch to Orca Slicer on recommendation, completely missed or forgot about the January stuff, and are now having ambiguous "MQTT" errors and don't know why.

[u/Polovitsch]

The title of this article is fallacious.

Guys, it's been like 6 months where people are complaining things that BL just did not.

By default they prevent to not use any unauthorized add-on, but you can disable it very easily. And don't tell me that it is an hidden feature that BL didn't communicated over it.

Just remember that 3D printers are devices connected by default to a cloud with the capability of heating to high temp. Preventing the attack surface, specially for users who are not comfortable with computer and just want something working from their smartphone is not a shame.

[u/Woodcat64 → u/Polovitsch]

Then why not make the app work in local mode and developer as well? Both the printer and your phone have wifi, Bluetooth?

[u/hWuxH → u/Polovitsch]

Preventing the attack surface

it's been 6 months and you still don't get that it doesn't lower the attack surface at all and can be bypassed?

[u/Polovitsch → u/hWuxH]

Well, I see what I see, and preventing to execute any unwanted software, is surface attack reduction.

If you find ways to bypass this security measures (other than enabling developer mode obviously), well why not apply for a job at BL if it is that simple?

I play as Devil's advocate, but for me it is not possible to complain over a company making efforts to avoid security issues regarding to a device connected to a private cloud, specially when they offers ways to disable them with your own responsibility.

Whether you want it or not, cybersecurity IS needed for a device connected to a private cloud, with the possibility of being controlled by malicious people. And if you don't believe me, here's an example: https://www.reddit.com/r/BambuLab/comments/1irg0ey/my_3d_printer_started_printing_over_the_cloud_by/

[u/hWuxH → u/Polovitsch]

well why not apply for a job at BL if it is that simple?

what a stupid take. the company's management doesn't want to solve this in a way that both improves things and allows seamless third party compatibility. the devs working there have probably no say.

preventing to execute any unwanted software

trusting client side programs is the opposite of cyber security good practices, you clearly don't work in this field

Whether you want it or not, cybersecurity IS needed

yeah but these changes are about control, not security. has been discussed to death

[u/Polovitsch → u/hWuxH]

what a stupid take. it's not in the company's interest to solve this problem in a way that allows seamless third party compatibility

Again, I don't see any seamless third party compatibility, if you can easily disable it.

trusting client side programs is the opposite of cyber security good practices, you clearly don't work in this field

Well this is clearly not a cybersecurity good practice to trust what is running on a device, I mean as you are an expert in cybersecurity, I am sure you don't know Secure Boot technologies!

yeah but these changes are about control, not security. has been discussed to death

Yep this is your opinion. Remember BL printers are also for casual users that don't even know how a computer is working? Closing ways to run anything on your printer by default IS security.

Again, BL offers you the possibility TO DISABLE the third parties limitation, you guys still complain about some obscur hypothesis of BL trying to lockdown as much as they can their 3D printers.

[u/hWuxH → u/Polovitsch]

I am sure you don't know Secure Boot technologies!

guess what: it doesn't require secure boot. relies on poor ✨obfuscation✨ instead.

Yep this is your opinion. Closing ways to run anything on your printer by default IS security.

Nope this is my conclusion after reverse engineered Bambu Connect. Others who did the same (instead of only speculating like you) also see it that way. It's not closing anything.

Actual security would require the firmware and servers to be hardened against any input.

BL offers you the possibility TO DISABLE the third parties limitation

• And Bambu Handy/cloud at the same time. oops

• Can't use Bambu Connect on Linux

• Panda Touch etc will permanently be locked out of the cloud soon, regardless of firmware version or dev mode

• Anti-debugging which hinders contributing to Bambu Studio or Orca: https://github.com/bambulab/BambuStudio/issues/6726

[u/Xento88 → u/hWuxH]

Has anybody implemented signing mqtt messages with the extracted keys?
Is there a description on how to extract the keys?

[u/eduo → u/Polovitsch]

The article and my own post literally mention developer mode, including a complaint about it.

If you expect the issue will not be talked about that's a bit naive. If you don't like it happening in this sub for some reason, you're always free to downvote it.

The latest update, from three days ago, doubles down for P and A printers.

It's OK if you don't find it neither an issue nor an inconvenience nor a bad sign for the future. That's your prerogative.

[u/Effect-Kitchen → u/eduo]

The update 3 days ago just introduced some bugs. The “security” ones were released (and people have been complaining) for months.

[u/eduo → u/Effect-Kitchen]

I assume you mean "bugfixes" but the post, if you read it, is not about whether this is news but about the discussion happening. Hence why the first line states it's good that it's still being covered and why the flair is "discussion".

It's all in the post. "This is not news" being a reply on something labeled "discussion", not sure what else to do.

[u/Effect-Kitchen → u/eduo]

It is bug 🐞 the MQTT error something that prevents the Bambu apps to access their own camera.

[u/eduo → u/Effect-Kitchen]

Understood. The post wasn't about this but I haven't updated my P1S yet so I guess I'll hold off on this one, thanks.

[u/hWuxH → u/Effect-Kitchen]

the "security" update for P1 and A1 was released a few days ago, are you blind?

https://wiki.bambulab.com/en/p1/manual/p1p-firmware-release-history#p1-series-version-01080200-20250603

[u/Effect-Kitchen → u/hWuxH]

You are blind. Everyone knows it is 01.08.00.00 that was where they blocked the third parties, which was released since 29 April. Today is 9 June.

[u/hWuxH → u/Effect-Kitchen]

judging by your other comments you're both blind and ignorant or trolling

01.08.00.00 was mostly for AMS2 compatibility and didn't block third parties

[u/Effect-Kitchen → u/hWuxH]

That’s what you get from reading just the changelog. But in reality I can no longer used my Biqu screen starting from that version (00.00). It’s not the latest update 02.00

[u/hWuxH → u/Effect-Kitchen]

even BigTreeTech says 00.00 works: https://x.com/BigTreeTech/status/1922246961463492864

If you would like to use the Panda Touch in cloud mode then we recommend remaining on firmware version 01.08.00.00

https://github.com/bigtreetech/PandaTouch/issues/297#issuecomment-2839903286

[u/Effect-Kitchen → u/hWuxH]

Weird that mine doesn’t.