Very interesting : Bambu lab cease n desist case

[Simmed]

A Polish developer published an OrcaSlicer fork that restored what Bambu Lab's January 2025 firmware update broke. Days later, Bambu's lawyers came calling — and the cease-and-desist they sent exposed something the company probably didn't want examined too closely.

In this video I walk through the Bambu Lab / OrcaSlicer dispute as it stands in May 2026, and what it actually means under U.S. and EU law. We cover Bambu's "Authorization Control" firmware, the leaked RSA private key that surfaced within 48 hours, why DMCA Section 1201(f) and the Sixth Circuit's Lexmark decision are bad news for Bambu's strongest legal theory, and the AGPL counterpunch hiding inside Bambu Studio's own source code. Then we zoom out to John Deere, HP, the EU Right to Repair Directive, and the question worth sitting with: do you actually own the smart devices you've already paid for, or are you permanently leasing the right to turn them on?

00:00 - Introduction
01:00 - Bambu v. Orcaslicer - Again
04:58 - Authorization Controls
08:47 - Community Response
10:50 - Who has standing
13:43 - Similar to John Deere
15:19 - Europe Contradicts Itself
18:17 - Lawful Masses is community supported

[exe]

Didn't watch the video, but I think know what it is about.

Very bad move, I have h2c, and I was waiting for months for orcaslicer to support it because stock slicer is not good-enough for me.

The recent news is a low blow. I'm also willing to support the lawsuit because the printer itself cost me 3k euro, and I don't mind to spend a little extra to increase my chances to get a better slicer.

[Psi]

If there's not good ownership controls in place then whenever engineers build 'awesome' all the terrible high-level managers, CEOs, marketing people and sales people all get drawn to it like moths to a flame to try and control it and turn it into a cash cow at any cost, including its own destruction.

[thm_w]

You can read the bambu response:

https://forum.bambulab.com/t/setting-the-record-straight-on-cloud-access-and-community/252164

Also to be very clear: this is not about OrcaSlicer itself or any other legitimate forks.

The concern is specifically around a separate fork that attempts to impersonate an official Bambu Studio client in order to access our cloud services.

Issues on both sides, but good to keep pressure on bambu.

[abeyer]

You can read the bambu response:

https://forum.bambulab.com/t/setting-the-record-straight-on-cloud-access-and-community/252164

Also to be very clear: this is not about OrcaSlicer itself or any other legitimate forks.

The concern is specifically around a separate fork that attempts to impersonate an official Bambu Studio client in order to access our cloud services.

Issues on both sides, but good to keep pressure on bambu.

But isn't the whole reason people are accessing the Bambu services that Bambu is trying to make it hard/impossible to use their printers without doing so? Sounds a bit disingenuous.

[thm_w]

But isn't the whole reason people are accessing the Bambu services that Bambu is trying to make it hard/impossible to use their printers without doing so? Sounds a bit disingenuous.

These are the alternate options I am aware of to use the printer:
- Slice in Orca/etc and then use bambu connect to transfer to printer - still relies on their cloud
- Slice in Orca and use a USB key to take the file to the printer - no reliance on bambu, but you won't get camera feed, notifications, etc
- Turn on LAN mode, change setting to "developer", now third party tools have full access to the printer on the local network - no reliance on bambu

https://forum.bambuddy.cool/topic/18/how-to-enable-developer-mode-on-your-bambu-lab-printer

[exe]

My problem with lan-only mode is that I lose cloud access. I want separate control for lan and cloud access. This is ridiculous, considering how unstable their network plugin was (crashing, logging out, failing to submit job after I suspend my laptop), and that their infra at times was inaccessible. I want to access my printer however I like. I still have to type in connection info whenever I use the printer. Slicer simply doesn't remember credentials, or fails to connect 

Also their network plugin is closed source. It's currently not possible to submit jobs without it, and it has many own issues, like this: https://github.com/bambulab/BambuStudio/issues/6726

But even LAN-only mode, afaik, is the result of community pushing for it. It was originally cloud-only. So, we need to keep pushing, otherwise all we get a printer that is controlled from China, with all the data send to their data centers. They could simply ban an accounting, essentially bricking the device.

[thm_w]

My problem with lan-only mode is that I lose cloud access. I want separate control for lan and cloud access. This is ridiculous, considering how unstable their network plugin was (crashing, logging out, failing to submit job after I suspend my laptop), and that their infra at times was inaccessible. I want to access my printer however I like. I still have to type in connection info whenever I use the printer. Slicer simply doesn't remember credentials, or fails to connect 

Also their network plugin is closed source. It's currently not possible to submit jobs without it, and it has many own issues, like this: https://github.com/bambulab/BambuStudio/issues/6726

I don't think that plugin is used by bambuddy, though you'd have to setup your own server for cloud functionality.

But even LAN-only mode, afaik, is the result of community pushing for it. It was originally cloud-only. So, we need to keep pushing, otherwise all we get a printer that is controlled from China, with all the data send to their data centers. They could simply ban an accounting, essentially bricking the device.

Yes still worth pushing them.

[Nominal Animal]

Louis Rossmann is taking on Bambu Lab for this:

[Psi]

Does anyone know if this plugin that allow you to use your own slicer locally still works, or if Bambu have already pushed a firmware/cloud update that stops it working?

As i understand it, this github code still goes through the Bambu cloud stuff, so they could stop it if they wanted to. Just have not gotten around to doing that yet

[exe]

I don't think that plugin is used by bambuddy, though you'd have to setup your own server for cloud functionality.

Thanks for the pointer, I'll try it when I'm back from traveling.

If I remember correctly, bambu lab said they will prevent third-party plugins to connect to h2c printer because "incorrect g-code can damage the printer". So, they explicitly said they only allow communication and calling calibration routines with their proprietary plugin. This is what I'm against. Though current rage is about a different topic, I do hope people will keep bringing the issue. My understanding is, this can be bypassed with developer mode. I had an impression that developer mode permanently sets a flag on the printer, and can be used to deny warranty. At least it "disables safety features". Damn, I just want to use my printer, and have very clear and simple path to do so. I don't want to mess up with developer settings, rooting firmware etc.

[SiliconWizard]

There seems to be two separate issues, more or less: one is accessing their cloud services "illegally", the other is Bambu lab crippling their devices if you use direct access only.

I can understand their position regarding the first one, even if that sucks. Regarding the second, I don't agree with that kind of product design choice, but that's become very common. The disingenuous part of it is when the company changes the terms after a purchase has been made.

If I got it right, the company has used AGPL software and never released their modifications, and Louis is trying to sue them on that front. Good luck with that - it's also very common especially with chinese companies. I don't want to generalize to all of them, of course, but I've seen many that do exactly that. They rarely release the source code of modified open-source software that they use in their products. They seem very reluctant to do that, which is sort of hard to understand, especially considering that they tend to see IP in a different light than we do in the west, but they are very protective of their own IP and that unfortunately often extends to parts that they can't make confidential, such as open-source software.

I was considering a Bambu Lab product, but I'll certainly reconsider it now, at least I'll wait until this case is fully settled one way or another.

[tszaboo]

If there's not good ownership controls in place then whenever engineers build 'awesome' all the terrible high-level managers, CEOs, marketing people and sales people all get drawn to it like moths to a flame to try and control it and turn it into a cash cow at any cost, including its own destruction.

The real issue is IMHO that companies nowadays want 15 EUR a month for forwarding 3 MQTT messages for you, bundled together with a bunch of stuff that nobody asked for.

[richnormand]

Thanks for posting.
Just ordered a Prusa!

This is the kind of crap that is reinforcing the "If buying is not owning then pirating is not stealing" tendency.
In particular when you look how they "evolved" the slicer.

There are too many examples where a university or government group would work on developing a device or process for years and a startup or corporation would come in and paint the pump a different colour and claim the whole thing as theirs.
When NASA would do something, it was available to all, when SpaceX does something, it is theirs even if done with public money....
 

[Nominal Animal]

If I got it right, the company has used AGPL software and never released their modifications

No, no, no.

Bambu Labs sent OrcaSlicer developer a cease and desist letter for using some of the unmodified AGPL:d sources Bambu Labs has released, in OrcaSlicer which is also AGPL-licensed.

[SiliconWizard]

If I got it right, the company has used AGPL software and never released their modifications

No, no, no.

Bambu Labs sent OrcaSlicer developer a cease and desist letter for using some of the unmodified AGPL:d sources Bambu Labs has released, in OrcaSlicer which is also AGPL-licensed.

Well, ok, as I understand it, they did use AGPL code, made their own software around it, released the modified source code (as they should) but decided that nobody could actually *use* the released code. So they are trying to pull a string where the released source code is not meant to be reused, but only viewed, or something., which is indeed against AGPL.

[thm_w]

If I remember correctly, bambu lab said they will prevent third-party plugins to connect to h2c printer because "incorrect g-code can damage the printer". So, they explicitly said they only allow communication and calling calibration routines with their proprietary plugin. This is what I'm against. Though current rage is about a different topic, I do hope people will keep bringing the issue. My understanding is, this can be bypassed with developer mode. I had an impression that developer mode permanently sets a flag on the printer, and can be used to deny warranty. At least it "disables safety features". Damn, I just want to use my printer, and have very clear and simple path to do so. I don't want to mess up with developer settings, rooting firmware etc.

You can run custom gcode on the printer via usb, or cloud. I'm sure you could easily send it some commands that would damage the printer (example here).

The vision encoder calibration is done on the printers firmware itself. AFAIK most of the useful calibration stuff is in startup gcode, which can be copied and pasted into another slicer. But I could be wrong.

Developer mode does not void warranty. But any damage you do due to developer mode is not covered, any support of 3rd party plugins is not covered.

Also saw this cloud option, free for hobby paid for commercial: https://simplyprint.io/setup-guide/bambu-lab/h2c

[exe]

You can run custom gcode on the printer via usb, or cloud. I'm sure you could easily send it some commands that would damage the printer (example here).

Just in case, that was due to a bug in firmware, not because gcode was incorrect.

[Nominal Animal]

Well, ok, as I understand it, they did use AGPL code, made their own software around it, released the modified source code

and after enough sales, modified the code again to remove functionality customers originally had, and pushed it downstream.  All clearly and specifically under the AGPL license.

OrcaSlicer incorporated the original code, so that using OrcaSlicer, Bambu Labs customers got back the original functionality.

The "impersonation" claim is from that very same code.  It does HTTP (over TLS) requests, which include an User-Agent: header (as usual).  Because OrcaSlicer uses the unmodified original code, that too is what it was in the original code, and this is what Bambu Labs claims is "impersonation" and "bypassing a digital lock".

This is particularly notable because for example Opera user agent string on OS X is typically something like "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 OPR/124.0.0.0 (Edition developer)" (source).  Note the Mozilla/5.0?  This is for service compatibility, not authentication or authorization.

Simply put — and you know I am not a FOSS zealot, having worked with and being comfortable working with any license from completely proprietary under NDA to CC0-1.0/Public Domain —, Bambu Labs fucked up royally here.  Their only hope is to start a stretched-out legal battle like the old SCO–Linux lawsuit against open source developers (and possibly the GNU foundation), if they can find someone like Microsoft to help fund it all (they did fund SCO–Linux back then, but today probably would not risk it).

[SiliconWizard]

Simply put — and you know I am not a FOSS zealot, having worked with and being comfortable working with any license from completely proprietary under NDA to CC0-1.0/Public Domain —, Bambu Labs fucked up royally here.  Their only hope is to start a stretched-out legal battle like the old SCO–Linux lawsuit against open source developers (and possibly the GNU foundation), if they can find someone like Microsoft to help fund it all (they did fund SCO–Linux back then, but today probably would not risk it).

One doesn't need to be a FOSS zealot to see what's completely wrong here. Heck, even someone that doesn't like FOSS can perfectly see it from just an IP point of view.

By using an open-source software to begin with, Bambu Labs is effectively using someone else's IP. It just happens that AGPL grants everyone a right to use the source code as long *as they respect the license*, but that's still not their own IP. Period. Once a company decides to use open-source software with such a license, they have made a conscious choice. The only way out of it would be to stop using anything open-source in their own software, *provably* rewrite everything from scratch and then do whatever they want to restrict access to their services.

I have seen that so often. Companies use open-source software to save time and money, yet they want to play it as though it was their own stuff with no strings attached. It doesn't work that way.

And here, as you said, the identifier (agent) is not even something they came up with themselves, it was the original one. So their claim is totally bogus.

It reminds me of what Microchip was doing (and probably still is?) with their XC16 and XC32 compilers based on GCC and how they were "licensing" them with paid options enabling compiler optimizations that were already there in the GCC source code.

[thm_w]

It reminds me of what Microchip was doing (and probably still is?) with their XC16 and XC32 compilers based on GCC and how they were "licensing" them with paid options enabling compiler optimizations that were already there in the GCC source code.

Only 9 in stock, better buy while you still can https://www.microchip.com/en-us/development-tool/SW006029-1

[Simmed]

https://sfconservancy.org/news/2026/may/18/bambu-studio-3d-printer-agpl-violation-response/

First, Bambu does not provide the complete, Corresponding Source Code (“CCS”) for their Slicer software. (The Slicer is used in 3D printing to take a digital design model (i.e., the STL file) and “slice” that file into many horizontal 2D layers for transmission to the printer itself.) Bambu has publicly stated for four years that Bambu's slicer (called “Bambu Studio”) is a modified version of their competitor's AGPLv3'd slicer (“PrusaSlicer”). (PrusaSlicer — in turn — is a modified version of “Slic3r” — originally authored by Alessandro Ranellucci.) While some source code for Bambu Studio can be found on Bambu's Github organizational account, Bambu (in effect) admits publicly that they have violated the AGPLv3 by combining Bambu Studio with a proprietary library — which they distribute to the user via an interactive prompt in the UI.

Keeping their networking library proprietary is not the only way that Bambu violated AGPLv3. A software developer and Bambu Lab user (Paweł Jarczak) released another mechanism to integrate with Bambu Studio's server side components that did not require replacing or modifying the dynamically linked libraries. Instead, Paweł made changes to a different AGPLv3'd slicer (Orca Slicer) by merely examining the (incomplete) source code for Bambu Studio. Those Orca Slicer modifications allowed users to replace Bambu Studio and instead combine Orca Slicer via intimate data communication with Bambu Studio's currently-source-unavailable parts that run on Bambu Lab's servers.

Bambu has behaved badly for years and made multiple, provably false public statements regarding the AGPLv3 and its requirements. The recent aggressive behavior toward Paweł Jarczak was a last straw for us: we have decided to launch a multi-pronged effort that will assist consumers and users in the short-term, and also work toward a long-term strategy to improve the software right to repair for all 3D printer consumers.

The SFC welcomes volunteers to join these efforts immediately; we will need your help! We specifically welcome as our first volunteer Paweł Jarczak himself! Paweł's work has been instrumental in investigating Bambu's various AGPLv3 violations. Paweł has agreed to collaborate with SFC on the efforts we begin today.

 

[Psi]

Never underestimate the willpower of a CEO to bite the hand that feeds.

Seriously, CEOs will do things that any sane person would tell you are a terrible idea that risks extreme blowback. And all while saying "Yeah.. but if can get away with it we will get super rich"

One of the issue is that company CEO's are no longer afraid of the government coming down on them for screwing the public.
They're supposed to be as afraid of government regulators/laws as regular people are of the IRS/IRD/ATO.
That fear is what keeps everything in check, without it things get out of control.

I firmly think that if the government starting coming down hard on CEOs and/or the boards of directors whenever they screwed over the public, then a lot of the societal issues would come right.

[Nominal Animal]

Heh, Software Freedom Conservancy has decided on a new initiative wrt. Bambu Labs.  More here, including the baltobu forks.

Louis Rossmann also has a short-ish video on this, promising to support/contribute to SFC efforts on this: