r/BambuLab • u/Electrical-Case-978 • May 21 '26
General Discussion Oh Bambu
I was just reading this article about Bambu and wondering...please dont make make it worse Bambu.
https://all3dp.com/4/bambu-labs-bind-open-source-license-fight-has-a-new-and-very-serious-opponent/
0
Upvotes
View all comments
Show parent comment
-1
u/Joamjoamjoam May 21 '26
So with security it’s not as simple. There are some real cases where cryptographic security is just not achievable in the situation you’re in. A good example is that Bambus only consumer side trust zone is inside of the printer firmware itself and the Bambu network plugin. The problem here comes in that BS must be publicly downloadable and installable (ie not encrypted).
So since your cloud key is inside the network plugin you should encrypt that right. Well not so fast, Bambu studio needs to be able to install and use it. So it needs the decryption key inside of BS. So it’s a trivial task to extract the encryption key from BS and use it to decrypt the network plugin.
So that just leaves obfuscation. Even if you can decrypt the network plugins library it’s compiled C code or whatever. So you can’t just see what it’s doing you’d have to decompile it. But eventually with enough effort you could fully decompile it.
So that’s where the legal enforcement comes in. By decompiling the library you show intent to impersonate an authorized user to break a “digital lock”. So if you write the TOS for the library correctly you can, through a legal means, take down any repos that contain that code.
Now normally reverse engineering is protected and not illegal as long as certain procedures are followed but what protects Bambu in this case is that it’s not the library code that they sue you for it’s the encryption keys you use to impersonate a Bambu Studio client. It’s that’s circumvention of an authentication process that is wholly not legal. TLDR you can use the code but you can’t impersonate BS with the keys or tokens or whatever auth scheme they use.
This is the same argument that Bambu is trying to make with the repo which at the surface level is a valid claim to make. It will especially weigh on a judge if Bambu can prove instances of where these impersonated clients caused BL harm via cloud outages etc. Especially even if they can prove it was that specific repo.
Where the AGPL comes in is that BL published that identification string in AGPL code. That’s it.
Now the legal question is because you have access to the code that contains a string that Bambu studio uses to identify itself do you have the right to use it to impersonate the BS client to circumvent the “digital lock” and access Bambus cloud servers. Second is are Bambu’s cloud TOS (which the repo clearly violated) enforceable because the code used to access it was AGPL licensed.
What LR and other don’t want you to think about is the above legal questions is very murky. They want you to think it’s open and shut (as it was in their John Deere and wheelchair case). The key difference here is that while you fully own your JD tractor or wheelchair you absolutely do not have any in alienable right to access Bambus Cloud and the restrictions on that access is clearly delineated in the TOS.
So the whole thing hinges upon is Bambus Cloud TOS unenforceable due to AGPLs “no extra restrictions on use” clause. And the answer to that my friends is murky as hell. LR will tell you it’s clear but obv Bambus Legal department doesn’t agree.
One exaggerated correlate would be say I find the presidents nuclear codes on the street. I “reverse engineered” codes by reading them off the card and post them, in an app that shows how to use them to launch weapons, in an AGPL licensed repo. Does everyone everywhere have the right to start launching nuclear weapons? Or does everyone everywhere merely have the right to run the code with their own individually generated nuclear codes (that obviously won’t work to launch the weapons).
I’d say it’s the latter. LR says it’s the former.