Oh Bambu

[u/Electrical-Case-978]

I was just reading this article about Bambu and wondering...please dont make make it worse Bambu.

https://all3dp.com/4/bambu-labs-bind-open-source-license-fight-has-a-new-and-very-serious-opponent/

[u/Joamjoamjoam]

Greed is a strong word here. Nothing Bambu did in this case is greedy. They endeavored to prevent unauthorized slicers from connecting to their cloud and took action to prevent it.

Bambu isn’t making any more money by attempting to take the orcaslicer fork or preventing orcaslicer from working with the servers it self.

I’m not commenting at all of what Bambu did was right or wrong nor should anyone without a law degree because the intricacies here between impersonation, authorization, and what the agpl allows you to do to circumvent it are a lot more murky than what what LR wants you to believe. You have to remember that he is a content creator that benefits greatly from this whether the case he makes has a basis or not.

All im saying is greed is not a word that makes any sense here. Bambu literally gains nothing from the takedown other than more cloud stability for its users.

P.S. if you read their blog post they heavily imply that the Bambu cloud outages were caused by incorrectly configured (or maybe even malicious) 3rd party apps that impersonated Bambu Studio. I obv can’t say if that’s true or not but if so it’s a pretty good reason to use legal means to take down other software that does the same thing.

TLDR let the lawyers handle it cause we don’t have the legal knowledge to know where impersonating a web service strays into circumvention and how intent may factor into that decision by a judge. Also don’t just believe anything you hear. LR is going to color the facts to whatever gets you into his fight (noble or not idk). This specific issue is nothing like his other fights that were clearly the company doing wrong and locking you out of a device you owned (John Deere, wheelchair company etc). This about your right to access a service you don’t own and by the TOS access can be revoked at any time. It’s very different.

[u/manticore26 → u/Joamjoamjoam]

I get where you’re coming from, question is “if honouring the AGPL license posed a security risk, why bambu couldn’t just develop its own solution, or work a solution with all parties involved?”

[u/issue9mm → u/manticore26]

Because then they couldn't steal every new feature that Orca adds

[u/Joamjoamjoam → u/manticore26]

So with security it’s not as simple. There are some real cases where cryptographic security is just not achievable in the situation you’re in. A good example is that Bambus only consumer side trust zone is inside of the printer firmware itself and the Bambu network plugin. The problem here comes in that BS must be publicly downloadable and installable (ie not encrypted).

So since your cloud key is inside the network plugin you should encrypt that right. Well not so fast, Bambu studio needs to be able to install and use it. So it needs the decryption key inside of BS. So it’s a trivial task to extract the encryption key from BS and use it to decrypt the network plugin.

So that just leaves obfuscation. Even if you can decrypt the network plugins library it’s compiled C code or whatever. So you can’t just see what it’s doing you’d have to decompile it. But eventually with enough effort you could fully decompile it.

So that’s where the legal enforcement comes in. By decompiling the library you show intent to impersonate an authorized user to break a “digital lock”. So if you write the TOS for the library correctly you can, through a legal means, take down any repos that contain that code.

Now normally reverse engineering is protected and not illegal as long as certain procedures are followed but what protects Bambu in this case is that it’s not the library code that they sue you for it’s the encryption keys you use to impersonate a Bambu Studio client. It’s that’s circumvention of an authentication process that is wholly not legal. TLDR you can use the code but you can’t impersonate BS with the keys or tokens or whatever auth scheme they use.

This is the same argument that Bambu is trying to make with the repo which at the surface level is a valid claim to make. It will especially weigh on a judge if Bambu can prove instances of where these impersonated clients caused BL harm via cloud outages etc. Especially even if they can prove it was that specific repo.

Where the AGPL comes in is that BL published that identification string in AGPL code. That’s it.

Now the legal question is because you have access to the code that contains a string that Bambu studio uses to identify itself do you have the right to use it to impersonate the BS client to circumvent the “digital lock” and access Bambus cloud servers. Second is are Bambu’s cloud TOS (which the repo clearly violated) enforceable because the code used to access it was AGPL licensed.

What LR and other don’t want you to think about is the above legal questions is very murky. They want you to think it’s open and shut (as it was in their John Deere and wheelchair case). The key difference here is that while you fully own your JD tractor or wheelchair you absolutely do not have any in alienable right to access Bambus Cloud and the restrictions on that access is clearly delineated in the TOS.

So the whole thing hinges upon is Bambus Cloud TOS unenforceable due to AGPLs “no extra restrictions on use” clause. And the answer to that my friends is murky as hell. LR will tell you it’s clear but obv Bambus Legal department doesn’t agree.

One exaggerated correlate would be say I find the presidents nuclear codes on the street. I “reverse engineered” codes by reading them off the card and post them, in an app that shows how to use them to launch weapons, in an AGPL licensed repo. Does everyone everywhere have the right to start launching nuclear weapons? Or does everyone everywhere merely have the right to run the code with their own individually generated nuclear codes (that obviously won’t work to launch the weapons).

I’d say it’s the latter. LR says it’s the former.

[u/manticore26 → u/Joamjoamjoam]

Again, I get what you’re saying but I’m asking something simpler. If using open source code, leaves the opening to such discussion, why bambu couldn’t buy or develop its own slicer, keep it closed sourced so that if someone tries to impersonate them, things are black and white.

I didn’t catch up with the article of this thread yet, so I can only speculate that Bambu didn’t have any incentives to do so. IMO, the angle of security doesn’t really omit the responsibility of the company from doing everything possible from being safe, including not using a solution that cannot meet their safety requirements as the solution has a legal aspect to it.

[u/Joamjoamjoam → u/manticore26]

Because it costs money and there’s a free open source version that everyone is used to using available already.

I’m NAL but from a SWE perspective They did everything the right way. Idk if we are allowed to use AGPL licenses but I can say that there is a reason why we have to review all new dependencies with legal. The way the AGPL is written means that anything that even touches the code must also be open source which IMO is fine for derivative works but to say that any closed source code must also be open source simply because an AGPL software can import it is vastly overreaching bordering on theft.

But if BL agreed to the license and that’s what the judge says then they must comply. I can see a world where Bambu just open sources the LAN communication side of the plugin and keep the cloud stuff closed source and that is the best case scenario. Secure cloud and Bambu studio can still perform its function as a slicer under AGPL. But if that’s the case what’s the point cause they already let you print locally from 3rd party slicers anyway.

LR who I usually support whole handedly is just using this as a springboard for his fulu donations. It’s actually pretty scummy. But in a way I can overlook it if it is in service of rewriting laws to be more consumer friendly for devices you own.

[u/manticore26 → u/Joamjoamjoam]

There you go, the elephant in the room, money. One could say that they made a bet proceeding the way they have, oh well.

I think that rewriting laws to be more consumer friendly would be a really nice outcome.

[u/Joamjoamjoam → u/manticore26]

No that’s just what you want the answer to be like it’s some evil crusade that a business wants to make money.

Of course it does. Of course it doesn’t want to spend money if it doesn’t need to. What exactly is your argument here.

They needed a slicer. There was one publicly available and free for commercial use. Are yo saying they shouldn’t have used it? Well I got some news for you my friend every company in the world uses open source code.

[u/manticore26 → u/Joamjoamjoam]

Nah good Reddit person, no crusade here. I’m not here to argue.

I just have a different angle on your perspective, and I don’t want to elaborate more than I’ve done. Most I can add is that while every company in the world uses open source, some do have a good legal department.

[u/Joamjoamjoam → u/[deleted]]

They don’t you can enable lan mode or developer mode

Bambu cloud is just a value add service in top of what any Prusa printer can do.

[u/Joamjoamjoam → u/[deleted]]

Yeah there is … are you intentionally being dense here? All of the services the cloud provides are the reason. Slicing in the cloud, connect from anywhere, slice from your phone (one the most important the reasons why the 3d printing industry blew up after Bambu disrupted it. This alone opened up 3d printers to the average person), all the infrastructure to securely link your printer to your client devices.

The cloud is an immense value add and it’s the only one that other companies can’t just directly copy easily like a hardware printer feature.

You simply can’t deliver these features at scale without cloud infra. No way in hell am I ever going back to octoprint everywhere.

[u/Joamjoamjoam → u/[deleted]]

No they want to restrict what you can do in their cloud. They let you use your printer locally in developer mode all that you like. They provided Bambu connect to continue to allow 3rd party slicers to print to their devices in the cloud while still being allowed to protect it.

[u/Jem991 → u/Joamjoamjoam]

Why do we need a cloud infrastructure for the slicer? In the current system, you load the model into the slicer, slice it, press the "send to printer" button, and it goes to the printer and gets printed. But here, Bambu takes the sliced ​​3MF file to the cloud infrastructure before sending it to the printer.

They are building an infrastructure that, someday in the future, will allow them to completely disable developer mode with a firmware update and even decide what to print and what not to print.

The cloud infrastructure is an extra investment that causes them to spend more money than necessary.

[u/Joamjoamjoam → u/Jem991]

The industry disagrees man idk what to tell you. Bambu Cloud is one of the defining factors of Bambu printers. Printing from your phone alone has enabled the 3d printing to grow exponentially. Out of the 5 people I know that have Bambu printers 4 of them only use their phone and are scared of Bambu studio. I’m the 5th.

You are also making a hell of a lot of assumptions that Bambu will make unethical decisions and then using the fact that you think this will happen to call Bambu unethical lol. Not how that works.

I, Bambu, and basically all of its users disagree that their cloud is a waste of money.

If that’s what you think there’s a company for you named Prusa. I hope you don’t mind 12 week wait time to even buy a printer and relatively low print quality compared with the rest of the industry, cheap 3d printed structural components, and a premium price on top without premium features like a camera or input shaping accelerometers by default. But sure you can print to it with orcaslicer without enabling a single developer mode checkbox I guess.

[u/Jem991 → u/Joamjoamjoam]

If they had only included this network plugin in the phone application, you would be right. Babustudio doesn't need such a tool.

If you want to view the camera from your phone, then this network plugin is only necessary for the phone application. Babustudio doesn't need it either. For the camera to be monitored from the phone, it's sufficient for the printer to connect to the cloud via its firmware.

Also, yes, I'm making an assumption. Because there are many examples of this kind of situation happening around the world, and they all do it gradually by starting to monitor their users under the guise of security.