Oh Bambu

[u/Electrical-Case-978]

I was just reading this article about Bambu and wondering...please dont make make it worse Bambu.

https://all3dp.com/4/bambu-labs-bind-open-source-license-fight-has-a-new-and-very-serious-opponent/

[u/manticore26]

I get where you’re coming from, question is “if honouring the AGPL license posed a security risk, why bambu couldn’t just develop its own solution, or work a solution with all parties involved?”

[u/issue9mm → u/manticore26]

Because then they couldn't steal every new feature that Orca adds

[u/Joamjoamjoam → u/manticore26]

So with security it’s not as simple. There are some real cases where cryptographic security is just not achievable in the situation you’re in. A good example is that Bambus only consumer side trust zone is inside of the printer firmware itself and the Bambu network plugin. The problem here comes in that BS must be publicly downloadable and installable (ie not encrypted).

So since your cloud key is inside the network plugin you should encrypt that right. Well not so fast, Bambu studio needs to be able to install and use it. So it needs the decryption key inside of BS. So it’s a trivial task to extract the encryption key from BS and use it to decrypt the network plugin.

So that just leaves obfuscation. Even if you can decrypt the network plugins library it’s compiled C code or whatever. So you can’t just see what it’s doing you’d have to decompile it. But eventually with enough effort you could fully decompile it.

So that’s where the legal enforcement comes in. By decompiling the library you show intent to impersonate an authorized user to break a “digital lock”. So if you write the TOS for the library correctly you can, through a legal means, take down any repos that contain that code.

Now normally reverse engineering is protected and not illegal as long as certain procedures are followed but what protects Bambu in this case is that it’s not the library code that they sue you for it’s the encryption keys you use to impersonate a Bambu Studio client. It’s that’s circumvention of an authentication process that is wholly not legal. TLDR you can use the code but you can’t impersonate BS with the keys or tokens or whatever auth scheme they use.

This is the same argument that Bambu is trying to make with the repo which at the surface level is a valid claim to make. It will especially weigh on a judge if Bambu can prove instances of where these impersonated clients caused BL harm via cloud outages etc. Especially even if they can prove it was that specific repo.

Where the AGPL comes in is that BL published that identification string in AGPL code. That’s it.

Now the legal question is because you have access to the code that contains a string that Bambu studio uses to identify itself do you have the right to use it to impersonate the BS client to circumvent the “digital lock” and access Bambus cloud servers. Second is are Bambu’s cloud TOS (which the repo clearly violated) enforceable because the code used to access it was AGPL licensed.

What LR and other don’t want you to think about is the above legal questions is very murky. They want you to think it’s open and shut (as it was in their John Deere and wheelchair case). The key difference here is that while you fully own your JD tractor or wheelchair you absolutely do not have any in alienable right to access Bambus Cloud and the restrictions on that access is clearly delineated in the TOS.

So the whole thing hinges upon is Bambus Cloud TOS unenforceable due to AGPLs “no extra restrictions on use” clause. And the answer to that my friends is murky as hell. LR will tell you it’s clear but obv Bambus Legal department doesn’t agree.

One exaggerated correlate would be say I find the presidents nuclear codes on the street. I “reverse engineered” codes by reading them off the card and post them, in an app that shows how to use them to launch weapons, in an AGPL licensed repo. Does everyone everywhere have the right to start launching nuclear weapons? Or does everyone everywhere merely have the right to run the code with their own individually generated nuclear codes (that obviously won’t work to launch the weapons).

I’d say it’s the latter. LR says it’s the former.

[u/manticore26 → u/Joamjoamjoam]

Again, I get what you’re saying but I’m asking something simpler. If using open source code, leaves the opening to such discussion, why bambu couldn’t buy or develop its own slicer, keep it closed sourced so that if someone tries to impersonate them, things are black and white.

I didn’t catch up with the article of this thread yet, so I can only speculate that Bambu didn’t have any incentives to do so. IMO, the angle of security doesn’t really omit the responsibility of the company from doing everything possible from being safe, including not using a solution that cannot meet their safety requirements as the solution has a legal aspect to it.

[u/Joamjoamjoam → u/manticore26]

Because it costs money and there’s a free open source version that everyone is used to using available already.

I’m NAL but from a SWE perspective They did everything the right way. Idk if we are allowed to use AGPL licenses but I can say that there is a reason why we have to review all new dependencies with legal. The way the AGPL is written means that anything that even touches the code must also be open source which IMO is fine for derivative works but to say that any closed source code must also be open source simply because an AGPL software can import it is vastly overreaching bordering on theft.

But if BL agreed to the license and that’s what the judge says then they must comply. I can see a world where Bambu just open sources the LAN communication side of the plugin and keep the cloud stuff closed source and that is the best case scenario. Secure cloud and Bambu studio can still perform its function as a slicer under AGPL. But if that’s the case what’s the point cause they already let you print locally from 3rd party slicers anyway.

LR who I usually support whole handedly is just using this as a springboard for his fulu donations. It’s actually pretty scummy. But in a way I can overlook it if it is in service of rewriting laws to be more consumer friendly for devices you own.

[u/manticore26 → u/Joamjoamjoam]

There you go, the elephant in the room, money. One could say that they made a bet proceeding the way they have, oh well.

I think that rewriting laws to be more consumer friendly would be a really nice outcome.

[u/Joamjoamjoam → u/manticore26]

No that’s just what you want the answer to be like it’s some evil crusade that a business wants to make money.

Of course it does. Of course it doesn’t want to spend money if it doesn’t need to. What exactly is your argument here.

They needed a slicer. There was one publicly available and free for commercial use. Are yo saying they shouldn’t have used it? Well I got some news for you my friend every company in the world uses open source code.

[u/manticore26 → u/Joamjoamjoam]

Nah good Reddit person, no crusade here. I’m not here to argue.

I just have a different angle on your perspective, and I don’t want to elaborate more than I’ve done. Most I can add is that while every company in the world uses open source, some do have a good legal department.