Ridiculous lack of security and privacy

No problem, I understood data anyway… :slight_smile:

I’m in the luxurious situation to have 100Mbit flat internet connection, so I don’t care anyway.

However I just watched my DSL data counter while printing, there was no difference in data throughput wether the video is on or off. I saw a “constant” throughput of 1,5MB / minute. For everything in my house like two macbooks, several Google Home devices, Philips Hue lights, a smartphone…
Just watching Youtube (only 1080p!) pushed this to 19MB / minute.
I’m with you that sending a local video stream to China and back is absolutely unnecessary, but considering the tiny amount of data I don’t consider this as bad as many other people see it.

1 Like

It’s not the amount of data that is the problem for most potential users, it’s that it’s any data at all. If you’re a business or institution that has strict infosec policies, the amount of data that can be sent to and received from unvetted foreign servers is zero.

Yeah, none of this is a problem for 99% of individual consumers. You send more personal data to China every time you open the tiktok app on your phone than the X1 does in a month, and regular people are just OK with that. But not every potential user is just some regular person churning out the Dwayne “the rock” Johnson meme of the week print in their basement.

I doubt BL wants their printer to be considered a consumer-grade toy that is inappropriate for any kind of serious professional use, but as long as it cannot be properly secured, that is exactly what it is.

5 Likes

It’s not the amount of data that is the problem for most potential users, it’s that it’s any data at all.

I agree that this is the primary concern involved here, but to be fair to 3dball, I did bring up the idea that streaming a print uses up some amount of my finite data per month allotted by the ISP gods.

2 Likes

Honestly, if I’m running a business which has strict security rules, I’ll go the good old way which served me well with my Prusa the last few years: I grab a SD Card and transfer data this way. No network needed.
And the camera? Come on. Do you need this?
Working without network still preserves all the goodies of this machine, speed, quality and versatility. I guess people running this kind of business are used to lots of inconveniences anyway… :slight_smile:

3 Likes

There are no firmware updates without internet connection and being logged into a Bambu account. Transferring print jobs by SDcard is a huge pain in the butt and I paid for a camera which I would like to be able to use.

Companies with serious security still have and use networks they just have no or very limited connection to the internet.

4 Likes

Just checked with LittleSnitch and see this happening there. Could it be that the servers are in US ?
image

When I request a check for firmware update, it shows a connection to US

there is no connection at all to Far East

1 Like

A company anywhere in the world has full access to data on servers it owns or rents anywhere in the world. Your personal information and IP not going directly to China is irrelevant. Not that Bambu being Chinese is the problem I would have the same issue where ever they are based. Being Chinese just makes it worse.

3 Likes

Squishworx does do printing for Aerospace accounts that require us to air gap the Bambu printers completely. They are not even allowed to be on the same electrical circuits as the other printers.

2 Likes

I will have to verify, but the last I saw was they switched to AWS for production and retired AlibabaCloud which they used with the pre-release versions of the slicer and mobile app. Of course, this may vary depending on your region of the world.

Even if data is only being sent to a local datacenter a few miles away, this is still a dealbreaker for any company with strict infosec policies. Not to mention completely unnecessary from a technical standpoint. Just because it may not be “as bad as it used to be” now, or “as it could be”, that doesn’t mean it’s “good”.

Personally, I have no issues with my prints and video feed going through 3rd party servers. This problem doesn’t affect me. But that doesn’t mean I cannot recognize it as a problem that needs resolving. Even if I didn’t care about others’ ability (or inability) to use all the features of the printer without internet connectivity, I would still be concerned for my ability to fully utilize the printer in the future.

If BL should ever go out of business or decide that features that utilize their servers will require a paid subscription, I would be just as out of luck as those other people without internet access are now. This is something that should concern every customer, regardless of their current needs or situation.

6 Likes

Is the “problem” maybe more that Bambu Lab as a manufacturer did not inform about the cloud connection enough? I guess it is not obvious for the customer that some of the printers features need internet connection, right?

This is now being discussed on Twitter and Bambu Lab need to respond, ignoring it will only make things worse.

2 Likes

FWIW, I was well aware of the cloud routing of the jobs before I purchased. I honestly can’t remember if I new the camera was required to go through the cloud or not. Like @MortalWombat said above, this isn’t a problem for me so didn’t make me not buy the printer (obviously), but I agree with his assessment that it not being a problem me doesn’t mean I can’t recognize that it’s a problem for others, nor that it might not be a problem for me in the future.

1 Like

Hi everyone,

We heard all the network security concerns, and we published a dedicated blog post to share our feedback about them.

7 Likes

Not being an expert in this area of IT at all, I appreciate two things:

  1. People like Roy, who obviously has far more experience than I, who take the time to bring this information to light for the whole community.

  2. Bambu Labs for answering the response, taking immediate action where possible, AND plaining admitting when and where they screwed up. It’s refreshing to hear honest admissions of error and efforts taking to correct the problems rather than cooperate double speak to hide/deflect blame.

5 Likes

Ive been digging around this forum as well as Reddit on this security topic. Admittedly, all of this IT talk is way over my head. Could someone please explain to me (like im a 5 year old) what specific risks these security shortcomings could allow? As a home user of this printer what is the worst that could happen?

  • Can someone use my networked printer as a wormhole into personal or bank account info?
  • I imagine they could see my part files or even access the camera. Honestly, that really doesn’t bother me all that much. But, if they bypass safety features and somehow are able to set my house on fire… i would be pretty upset.

Thanks for translating!

5 year old P? Ok, here goes " go play with your other todays, this subject has been covered and handled by big daddy " I e as far as I am concerned, Bl has handled it and closed the open spots. And like you said, normal people dont have an issue.

How did they manage to block access to my models on their could by the Chinese government (and the governments of whichever countries their cloud is hosted in for that matter)?

Nothing I complained about when starting this thread has changed.

2 Likes

Another completely unrelated but very important concern is that any product that depends upon a vendor’s cloud is also dependent upon that company being in business. If Bambu’s team all find something more interesting to work on, this product could become a $1400 brick.

Most likely what they’re doing with video is to track what port the video stream is on, so that any [authorized] client who wants to stream the video can get it directly from your router.

I just got my printer last night, so I haven’t tried using it from outside my home yet.

While I don’t work on any military-level private objects, I still want what I print to be known to me, and me alone. I would greatly prefer a way to have my printer not require an outside network address for anything. I’m coming from a Prusa MK3S, where I could update firmware and print my items without any need for the internet. I think Bambu really ought to consider providing similar functionality. It saves them [cloud spend] money, and lets privacy-minded users get what they want.

3 Likes