Bambu Lab pushes a “control system” for 3D printers, and boy, did it not go well

Security measure? Boxing out third-party tools? Or something more complex?

See full article...

 

[jack lecou]

For the specific example Aurich gave--using non-Bambu filament--is there a good way for them to even force the issue?

As I understand it, the current filament recognition system picks up an RFID on the spool. Does removing the RFID from a Bambu spool and taping it to another not look like a relatively simple work-around? I get the impression that fooling this check would be, if anything, easier than fooling Keurig coffee pots.

Well, hypothetically, in a cloud-connected printer where the tags were indeed mandatory (which as Aurich points out, current BL models don't really have the hardware for), a bypass wouldn't necessarily be that simple. One obvious point is that the printer would know how much filament is on a spool to start with and (roughly) how much it feeds through as it prints. An evil printer could simply do a little math to dead-reckon how many meters are left on the spool (a fuel gauge for your spool would be a "feature", naturally), and then block the ID after it deems it empty.

That aside, I think the main issue you'd run into is that most filaments these days are pretty complex blends of different polymers, plasticizers, solvents, dyes, etc. A spool of "PLA" isn't just pure, virgin polylactic acid, especially not if it's PLA "+" or "Pro" or "High Speed". Every manufacturer has their own formula, and the differences can and do impact print behavior quite a bit. That's why each filament brand/color typically needs to be calibrated. That's the big selling point of using BL's own filaments: you don't have to worry about that stuff. A good factory-tuned filament profile just gets loaded in from the tag.

But...If they took the step of locking those factory profiles down completely, not letting you tweak them or make your own, then you'd be stuck with whatever settings are attached to the RFID tag you borrow. The chance that those are the settings you really need is just about zero. You might be able to get away with it anyway, particularly if you don't care about quality -- bad settings probably won't fail completely if they're for roughly the same type of filament -- but the results won't be nearly as reliable or as pretty.

(If a company were really evil, they could maybe even deliberately tune their formulas to be a little extra "weird" compared to other brands, or vary them from batch to batch, to make clones or coincidental matches less likely.)

Just to make it more clear since I didn't fully explain it before: zero Bambu printers have RFID readers built into them to even read the spool chips. X1C, P1S, A1, A1 Mini, none of them have it. They haven't a clue what you load up, it's not Keurig.

Bambu has an add-on for their printers, the Automatic Material System aka AMS, which takes multiple rolls and does auto switching. That has the RFID built in. But those are optional and plenty of printers don't have them.

So this idea that they could lock their printers to only their filament is simply not possible. It's literally FUD.

I don't know why we can't just criticize them for what's happening instead of made up scenarios that aren't based in reality.

Yeah, as a concrete prediction, I think people are getting ahead of themselves with that: there are multiple paths to enshittification, and we don't really know which way Bambu is trying to go here yet. My own guess would be some kind of cloud service subscription thing rather than an HP/Keurig/Juicero-style supply lockdown. But who knows. Looking 12 moves ahead just isn't really possible yet.

Still, I think the instinct to look far ahead and prepare for the worst possibilities is a good one here. While we may not know exactly what the board looks like 12 moves ahead, we do all know how the game is played by now. There's a vanishingly small chance that this was their last move, after all. While the next move may take months (gotta wait for the furor to die down), it is almost certainly coming. And then it'll just be three squares forward, one square back until they take the whole board. Mustering early collective outrage and taking drastic preemptive action right now is critical. For consumers, the only winning move in this particular game is not to play.

 

[jack lecou]

Almost purchased an A1 today as my first 3D printer; decided to wait until tomorrow and now...any recommended alternatives?

Not too many people mentioning it, but you could check out Qidi.

I had some terrible experiences with couple different printers years ago, but got back into it with a deeply discounted Q1 Pro last summer and haven't looked back. I'm sure they're not quite as plug and play as BL printers, but I've gone through 15kg or 20kg of plastic now without having to do that much more than push the start button. Bonus that it runs pretty much stock Klipper firmware, barely even skinned. And their support is reportedly excellent.

Only real downside I see is no (stock) AMS. There's one in the works, but only for the new top of the line model. I may attempt to bolt on an ERCF or something to the Q1 someday, but it'd be a bit of a project.

 

[jack lecou]

I've been following this whole thing, off of Ars, here in our forum, talking to people in Discord, reading comments on Hackaday, watching videos, and what I've noticed is the people who are the most mad are the ones who don't own Bambu hardware (and tend to tell you they would never buy it). And the people who are the most sanguine and "let's see what happens" are the ones who do own it, and will actually be affected by changes.

That's why it feels like FUD.

Maybe. On the other hand, if that is representative of the attitude from their customers, it might be exactly why they feel like they can get away with it.

As you say, Bambu is very savvy, and has done a really good recognizing the huge market out there for a hobby level printer that "just works", one that enables hobbies, rather than being the hobby. It's probably a good assumption that they'll be just as savvy about extracting exactly as much rent from that market as it will bear.

If that's the case, I don't think it's crazy to take this move as a sign that they think that level is a bit higher than they're getting now, and are taking steps accordingly.

I also don't think it'd be crazy for the people most squarely in that market to eventually shrug, and cough up the extra $20/mo subscription or whatever this ends up as, because that's still the best deal they've got.

But that's the problem. Enshittification (usually) works.

 

[jack lecou]

Nah. They fucked up and people are letting them know.

But this constant refrain of enshittification like it's a mantra, the bullshit about LOCKED DOWN FILAMENT IS NEXT etc? That's all coming from the FOSS crowd. And I'm sorry, I want to support the idea of open source, but when you're so constantly extra about it all I honestly don't want anything to do with it. Chill out.

The "refrain" coming from the same crowd might bore you, but that alone doesn't make it wrong. Why is it you think the reaction is actually wrong?

Like, if not a prelude to enshittification, what was this incoherent "security" update actually for? And they've "fucked up", but are they actually fully reversing course, or mostly just backing down only rhetorically, "apologizing for the confusion" etc., while pushing forward with the scheme, perhaps in a slightly modified form?

The latter is what enshittification would predict -- two steps forward, one step back until everyone gets used to the step forward and you ratchet forward again -- but the hypothesis is falsifiable. I just don't think we've seen anything not consistent with it yet.

What are you basing this on though?

Like ... what is it you know that makes you say that?

What? That for profit companies face pressure to extract as much as possible for shareholders?

It's not like BL is somehow immune to that pressure. And they are positioned in a good place -- or at least what they could plausibly estimate to be a good place -- to extract more of the value that they have obviously been providing to their users and the community.

Again, where is this $20 a month idea coming from? For what? What are you talking about exactly?

I didn't say $20/mo. I said "$20/mo or whatever this ends up being". I definitely don't know what this is. But I don't think you know what it is either. All we know right now is that it doesn't make sense, it doesn't look good, and from past experience with "security updates" that don't make sense, it's very reasonable -- prudent, even -- to use some pattern recognition here and infer that it's probably not going anywhere good this time either. At least until we get some really solid evidence to the contrary.

 

[jack lecou]

Because there is no evidence for the assertions, that are coming from "the same crowd" that has been saying stuff like this about Bambu for years now. The burden of proof is on them, not some "all things trend towards shit" cynicism.

But there is evidence. The evidence is what kicked off this whole kerfuffle. As Jeff Geerling put it, they changed the deal. When someone does that, you don't just look at the new deal in isolation, you re-evaluate your entire trust relationship. They're in Darth Vader territory now. If they changed the deal once, what's stopping them from changing it again? And the logical question to ask after that is, what will they change it to?

It's not necessarily all things trend towards shit, but some things certainly do, and when you see a new little smear of shit somewhere you didn't notice it before...

Now, I can't speak to whatever it is people have been saying about Bambu for years now. I'm sure some people were always upset that it's not more open source*, but from the general community I feel like it's been overwhelmingly positive. That's clearly changed -- this is not just coming from open source fanatics, it's coming from inside the house.

---

* Of course, if some people were warning, "Hey, this Bambu ecosystem is nice, but it's all proprietary -- watch out or they might lock it down even more," those people look more prescient than crazy to me.

My frustration comes from seeing all these comments saying "oh I was about to buy one, guess I'll skip". I think the idea that a $349 A1 is going to turn into a paperweight is straight up FUD, and that if someone was going to get one, or has one (see above) they should just enjoy it. They don't have to spend $999 for a Prusa instead, unless they want to.

I don't think anyone thinks they're going to turn into a paperweight. That's hyperbole. But people are rightfully concerned that they might turn into a less useful printer than they were before. Because that's exactly what this update did. I think they're also right to fear further changes like that in the future, including ones that might make the printers more expensive to own or use in the ways they want to. That's what this broken trust implies.

It's also very reasonable for people in the market for a printer to be taking that broken trust into account. I hope everyone does. That pressure is exactly the thing that tells Bambu they did fuck up.

 

[jack lecou]

I don't know what your printer setup is. So let me just ask you two simple questions:

1) Can you browse for models on your phone, and send them directly to your printer from it, with a click?

2) When you are not at home can you pull up a live feed of your printer to check on a print?

I don't use no. 1 myself, but as I just pointed out above, my nephew does. I do use no. 2, and it's really nice.

If your setup allows for that, great, I'm curious about it. If it doesn't, well, those are benefits you may or may not find valuable but other people do.

I don't think anyone's criticizing that part. Cloud-based slicing and remote operation clearly have value for some users.

The issue is that diagram has nothing to do with those things. It's a diagram purportedly showing how a third party slicer can connect to the printer -- including in LAN-only operation. Except instead of, you know, just connecting to the printer on the LAN, there are those weird blocks in the middle.

But, as you know, moving gcode from a slicer to a printer over the LAN is a solved problem. There would be zero security issues (at least in principle) just running an Octoprint-style API directly on the printer, using SSL encryption for the link, and simple password or PSK type authentication.

Even slicer => cloud => printer doesn't need to be complicated, except you'd probably want to sprinkle in some Oauth to establish the slicer=>cloud credentials.

So what the heck is going on with that diagram? (Can you even tell what authorizes and connects to what if you're just trying to print locally? I'm not sure I can. At least three things claim to be authorization control, and everything is connected to everything else.)