jeff geerling

Bambu Lab, a major maker of 3D printers for home users and commercial “farms,” is pushing an update to its devices that it claims will improve security while still offering third-party tools “authorized” access. Some in the user community—and 3D printing advocates broadly—are pushing back, suggesting the firm has other, more controlling motives.

As is perhaps appropriate for 3D printing, this matter has many layers, some long-standing arguments about freedom and rights baked in, and a good deal of heat.

Printing more, tweaking less

Bambu Lab, launched in 2022, has stood out in the burgeoning consumer 3D printing market because of its printers’ capacity for printing at high speeds without excessive tinkering or maintenance. The product page for the X1 series, the printer first targeted for new security, starts with the credo, “We hated 3D printing as much as we loved it.” Bambu’s faster, less fussy multicolor printers garnered attention—including an ongoing patent lawsuit from established commercial printer Stratasys.

Part of Bambu’s “just works” nature relies on a relatively more closed system than its often open-minded counterparts. Sending a print to most Bambu printers typically requires either Bambu’s cloud service, or, in “LAN mode,” a manual “sneakernet” transfer through SD cards. Cloud connections also grant perks like remote monitoring, and many customers have accepted the trade-off.

However, other customers, eager to tinker with third-party software and accessories, along with those fearing a subscription-based future for 3D printing, see Bambu Lab’s purported security concerns as something else. And Bambu acknowledges that its messaging on its upcoming change came out in rough shape.

Authorized access and operations

“Firmware Update Introducing New Authorization Control System,” posted by Bambu Lab on January 16 (and since updated twice), states that Bambu’s printers—starting with its popular X series, then the P and A lines—will receive a “significant security enhancement to ensure only authorized access and operations are permitted.” This would, Bambu suggested, mitigate risks of “remote hacks or printer exposure issues” and lower the risk of “abnormal traffic or attacks.”