Skip to content

Firmware Update Introducing New Authorization Control System #36

Open
Open
Firmware Update Introducing New Authorization Control System#36
Labels
documentationImprovements or additions to documentationquestionFurther information is requested

Description

@koffienl
koffienl
opened on Jan 16, 2025

https://blog.bambulab.com/firmware-update-introducing-new-authorization-control-system-2/

Launching first for X Series printers, with P and A Series updates planned for future release

As part of our ongoing commitment to enhance the overall security of our products, we are introducing an authorization and authentication protection mechanism for the connection and control of Bambu Lab 3D printers. This step is a significant security enhancement to ensure only authorized access and operations are permitted.

Critical Operations That Require Authorization
The following printer operations will require authorization controls:

Binding and unbinding the printer.
Initiating remote video access.
Performing firmware upgrades.
Initiating a print job (via LAN or cloud mode).
Controlling motion system, temperature, fans, AMS settings, calibrations, etc.

Activity

  1. mytechguyri commented on Jan 16, 2025

    @mytechguyri
    mytechguyri
    on Jan 16, 2025

    This is NOT good... Don't update to this new firmware.... I expect its to break Panda Touch, as well as OpenSpool.... and they add another layer to OrcaSlicer, so you can no longer seemlessly send your prints, you have to save the gcode, then use Bambu Connect software to send the gcode to the printer.... Make your dissatisfaction with this known to Bambu (I'm also thinking of lodging a complaint with the FTC about this anti-competitive tactic that Bambu is introducing under the false premise of "security")

  2. spuder commented on Jan 16, 2025

    @spuder
    spuder
    on Jan 16, 2025
    Owner

    I've already been in contact with Bambu's development group, I'm waiting to hear back.

    While this is an unfortunate setback, it's not the end of the road for OpenSpool. There are still multiple paths forward. Some involve software changes, others involve hardware changes.

    When Bambu made changes to disable the LAN mode, they took the feedback to heart and backpedaled so that LAN mode is still an option. I'm optimistic they will do the same here.

    The list of current options

    1. Document users should not update firmware (P1/A1 are not enforcing yet)
    2. Leverage Bambu Connect as mqtt proxy. This might be a good option anyway since there is a device limit. By leveraging the Bambu Connect as a REST to MQTT proxy, 3rd party devices might still be supported
    3. Work with bambu to get TLS signing certificate pipeline for firmware. This might prevent end users from compiling their own unsigned esphome configs, but there likely will be a path forward here.
    4. Resdesign the hardware to plug directly into the AMS interface CANBUS. While tricky, it is doable and would be really hard for them to block.

    In the mean time I'm leveraging all the channels I have to talk with Bambu about how this will hurt 3rd party products like OpenSpool, X-Touch, Panda Touch, BLLED, HomeAssistant

  3. spuder
    added
    documentationImprovements or additions to documentation
    questionFurther information is requested
    on Jan 16, 2025

  4. mytechguyri commented on Jan 16, 2025

    @mytechguyri
    mytechguyri
    on Jan 16, 2025

    Image

    Well, to help them "backpedal" I filed my complaint with the FTC about their anti-competitive tactic disquised as "security" (its already secure through use of the access token system, which is only available on the printer itself.).. they know this is not about security, its about shutting down third party devices.

    FTC Report Number
    182500022

    The problem with Bambu Connect as MQTT proxy is, you will then have to have your PC open and BambuConnect running in order for the device to work... not ideal.... I like the AMS interface idea better (CANBUS? I thought it was RS485?) added benefit is that you could power the device from there as well... matter of fact, I was just building this to power the openconnect from the AMS port https://makerworld.com/en/models/696106?from=search#profileId-625094... would be really cool to build this right into the current case, so you could just "dock" the openspool right onto the side of the printer.

    I think hurting 3rd party products like X-Touch, Panda Touch, etc is EXACTLY their intent here... They don't WANT Panda Touch because it takes away one of the main selling points of the X1C vs the P1S... They don't WANT things like OpenSpool, because that takes away the incentive to buy Bambu brand filament.... its purely anti-competitive.

  5. xperiments commented on Jan 17, 2025

    @xperiments
    xperiments
    on Jan 17, 2025

    @spuder Please contact me at xperiments@gmail.com

  6. darkorb commented on Jan 18, 2025

    @darkorb
    darkorb
    on Jan 18, 2025

    this anti-competitive tactic that Bambu is introducing under the false premise of "security"

    100% this is a false thing from them, there is zero need to do this on LAN. I couldn't care less if they tightend up the cloud side of things (which they probably should do, if what they say about the number of unappreoved requests is true) but targeting local network use is just using insane nonsense arguments like "well your network is also insecure because trojans" sigh. Like, if my network had a trojan and someone wanted to target the printer, they'd just abuse the machine that connect is on (not to mention, they'd rather that they just snaffle your banking/online account creds instead tbh).

    You can also open support cases under Complaints and Suggestions -> Complaints -> Product issues and see if they listen. Doubt it though.

  7. Schrolli91 commented on Jan 20, 2025

    @Schrolli91
    Schrolli91
    on Jan 20, 2025

    There are some clarifications from Bambu Lab now
    https://blog.bambulab.com/updates-and-third-party-integration-with-bambu-connect/

  8. spuder commented on Jan 20, 2025

    @spuder
    spuder
    on Jan 20, 2025 via email
    Owner

  9. luckyzor commented on Jan 22, 2025

    @luckyzor
    luckyzor
    on Jan 22, 2025

    Sorry by asking this here, but I cant find any information.
    What is the last firmware supported by openspool for a X1C?
    Is it the 1.0.8?

    I want to know so I can downgrade and lock internet access do the printer.
    Thank you

  10. spuder commented on Jan 22, 2025

    @spuder
    spuder
    on Jan 22, 2025
    Owner

    The latest firmware that came out last week 1.08 breaks the MQTTAPI for X1 users.

    X1 users will either need to downgrade to 1.07 or wait for the new developer mode that will be coming later this year from bambu labs

  11. akagalford commented on Jan 22, 2025

    @akagalford
    akagalford
    on Jan 22, 2025 via email

  12. luckyzor commented on Jan 22, 2025

    @luckyzor
    luckyzor
    on Jan 22, 2025

    The latest firmware that came out last week 1.08 breaks the MQTTAPI for X1 users.

    X1 users will either need to downgrade to 1.07 or wait for the new developer mode that will be coming later this year from bambu labs

    I'm using orca slicer and Home assistant with 1.08.02 and thats why I asked this question, because I saw in the "buy kit" page the last firmware supported was 1.07...

    Edit: add bblab wiki link for firmware versions
    https://wiki.bambulab.com/en/x1/manual/X1-X1C-AMS-firmware-release-history

  13. luckyzor commented on Jan 23, 2025

    @luckyzor
    luckyzor
    on Jan 23, 2025

    The latest firmware that came out last week 1.08 breaks the MQTTAPI for X1 users.

    X1 users will either need to downgrade to 1.07 or wait for the new developer mode that will be coming later this year from bambu labs

    Can you confirm this? I really want to use this project.

  14. koffienl commented on Jan 23, 2025

    @koffienl
    koffienl
    on Jan 23, 2025
    Author

    The latest firmware that came out last week 1.08 breaks the MQTTAPI for X1 users.
    X1 users will either need to downgrade to 1.07 or wait for the new developer mode that will be coming later this year from bambu labs

    Can you confirm this? I really want to use this project.

    As far as I know is the firmware still in Beta.
    The beta firmware with the security 'feature' is 01.08.03.00
    The latest stable/public firmware version is 01.08.02.00 and does not have this issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    documentationImprovements or additions to documentationquestionFurther information is requested

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions