Changes to Authorization announced by BL

[capsel22]

hi,

Just saw the below announcement, not sure what impact will it have on this integration
https://blog.bambulab.com/firmware-update-introducing-new-authorization-control-system-2/

[christabone]

As I understand from the discussions on Reddit, this firmware update will completely remove our ability to control the printer outside of their proprietary software. So this HA addon will no longer function in any capacity except for simply viewing the progress of the print (as they mention in their blog post).

You can submit a "complaint" ticket here: https://bambulab.com/en/my/support/general-inquiry

I've already submitted one earlier today. Not sure whether it will make a difference but it might be worth trying.

[capsel22]

Thanks, I will send a complaint too

[christabone]

There's also an email address provided at the bottom of the Bambu blog post for technical questions: [email protected]

I've copied my complaint and sent it to that address as well.

[northcoastam]

Complaint sent.

[odysseyofmayhem]

This commit in BambuStudio caught my attention:
bambulab/BambuStudio@d9ead02

Looks like it some functionality toward the ability to sign or encrypt messages sent to the printer, along with installing a cert on the printer.

All the flags are set to 0 currently, but I think this shows the direction it's going. At the very least the command messages over MQTT will need to be signed in some way against the cert installed on the printer.

[larryqiann]

They did say they will release a GUI control app for LAN mode, so this technically means the relevant certificate is going to be inside that executable...

[nagi603]

Provided the certs are global and not per-printer/user.
(submitted complaint too)

[lukescott]

Just curious, and asking about workarounds if this does go thru:

• How would this impact Lan Only mode? Do you still have to use their API's for that? - Nevermind. They enabled it on LAN too because: "even when the printer is in LAN mode, the network environment in which the printer is located may still be connected to the public network, and other malicious software may still be able to remotely access the printer" (link to FAQ) -- Sorry Bambu, but my local network security is my business not yours!
• Would X1Plus firmware be a possible alternative?

(Also submitted a complaint)

[odysseyofmayhem]

@larryqiann From reading more on the "Bambu Farm" documentation that can be found in the Bambu wiki you can infer a little more about how this will work (with Google translate):
https://wiki.bambulab.com/zh/software/bambu-farm-manager

I was talking with a someone earlier on this we think it could be something like this:

• Devices contain a Bambu Lab public key which they use for client cert validation for all connections over (d)TLS.
• Each device that needs to connect to the printer raises a CSR to Bambu servers and they provide a signed cert that you use for communicating. The cert probably comes with a 1mo expiry (read in a different post about Bambu Farm), so you need to re-issue certs every month.

If they did this, this is pretty tamper-proof TBH, so chances of reverse-engineering anything is slim (except for performing the first-time CSR) and very sad indeed.

[patschi]

As per above blog article, BambuLabs states:

Bambu Lab will release technical documentation, new software, and offer support to assist partners in adapting their systems and developing software solutions compatible with the new X Series firmware and authorization controls. For access to our technical documentation, please email [email protected].

So I think some (active) maintainer, if time allows, could reach out to them... If they mean their promise of "making this transition as smooth as possible" is somewhat honest, there should be a way in keep everything working as it is today.

[nagi603]

Would X1Plus firmware be a possible alternative?

Even if it does, that sadly does not work for the cheaper P1 series.

[christabone]

They just updated their original blog post with an FAQ. It includes an entry for Home Assistant:

Very disappointing.

[ImSkully]

Incredibly disappointing to see BL going in this direction.

[prolife86]

HA was tested with the new (beta) firmware, results: https://www.reddit.com/r/BambuLab/comments/1i3yajx/firmware_upgrade_home_assistant/

Can't do anymore

⛔ Control Print Speed (Ludicrous, Silent)

⛔ Control Fans

⛔ Control Temperatures

⛔ Pause / Cancel / Resume

Can still do

✅ Control Light

✅ See camera Livestream

✅ Print Status

✅ Read Fans, Temperatures

✅ Read print plate

✅ Read AMS filaments

Could never do (I think? 🤔)

⛔ Move Motors

⛔ Homing

[nagi603]

Keep in mind this is a work-in-progress report of a beta FW, things may change for final version.

[tool666schism]

For me it is a bit positive and a bit negative. I would like my Panda Touch and my Home Assistant, but I also really would like my Bambu Handy App. Personally LAN mode plus a local app would be the best option of all, I could use my Wireguard VPN (or Tailscale) to have a safe connection to my house.

Per the wording it seems it is going te be a choice: LAN mode with (possibly) HA and (possible) Panda Touch but no Bambu Handy -OR- Normal Mode plus Bambu Handy App but no HA/Panda Touch.

Yea, losing the Handy app does kind of suck for the sole reason of using it to cancel individual objects from your print. I know of no other way to do this outside of the handy app.

[nagi603]

With the "we may stop you from printing if we really want you to update" (vague enough to mandate update every x months) carve-out in their ToS, and the "no support for this communication mode", (so it may or may not work, whereas previously it was "official") I simply do not have even remotely enough trust in BBL to upgrade. Especially after how they handled Orca.

TBH it is very reminiscent of the usual tactic of boiling the frog.

[probonopd]

While Developer Mode is a step in the right direction, note how they only announced it for certain models.

[cryptonym64]

Apologies. I'm also on the Orca thread and mixed the replies. It uses Bambu drivers. Ignore this here.

…

On Mon, Jan 20, 2025, 1:04 PM Alexey Skobkin ***@***.***> wrote: As it is written, will it possibly expose more control even? Doesn't sound like that to me. More like Status Quo solution in an opt-out manner. I do hope this opens the door to removing the Bambu binaries for the drivers. What drivers are you talking about? 🤔 — Reply to this email directly, view it on GitHub <#833 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AHAZ24MFOLWRJB2H3AUW2QT2LU3CZAVCNFSM6AAAAABVJXNSEOVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDMMBTGAYDOOBRGU> . You are receiving this because you commented.Message ID: ***@***.***>

[davedamon]

I just received this reply

I just received this reply

Dear Customer,

Thank you for reaching out to us regarding the recent Firmware Authorization changes.

As you mentioned, the introduction of the Authorization Control System has indeed sparked significant discussion. However, as highlighted in our blog post, the primary purpose of releasing this firmware is to enhance product security and safeguard user information.

In response, we have decided to introduce an optional LAN mode feature to grant advanced users greater control and flexibility.

Home Assistant:

Cloud Mode / Standard LAN Mode (Default):
After updating to the latest firmware with enhanced security controls, complete printer control via Home Assistant will be restricted. While Home Assistant will retain the ability to access some printer information, certain functionalities will be limited.
Developer Mode (Optional):
This option is available for advanced users seeking full control over their network security. By enabling Developer Mode and keeping the MQTT channel, live stream, and FTP open. Ensure that the network ports you need to use are open correctly and that Home Assistant functionalities could operate normally. The specific details and functionalities will depend on the configuration settings of the Home Assistant integration.
It is important to note that users will assume full responsibility for safeguarding their local network environment upon manually enabling this feature. Moreover, Bambu Lab will not be able to provide customer support for this mode due to the unofficial communication protocols it employs.

At present, the Firmware Authorization update is available in Open Beta exclusively for the X1 series.
Participation in the beta program is entirely optional, allowing you to explore and provide feedback on the new features. Alternatively, you can continue using your current firmware.

Please feel free to reach out if you still have questions or need further clarification after reading this. We'll do our best to assist you.

Best regards,
Bambu Lab Customer Support

[cryptonym64]

I got the same. I sent some follow up questions as they use all manner of double speak in the blog and posts and even contradict the terms of service. Not expecting any real answers though. One of the big caveats I spotted was they gram the discussion with this is only a beta, then proceed to elaborate. I want to hear a long term commitment to not be evil.

…

On Tue, Jan 21, 2025, 6:59 AM davedamon ***@***.***> wrote: I just received this reply I just received this reply Dear Customer, Thank you for reaching out to us regarding the recent Firmware Authorization changes. As you mentioned, the introduction of the Authorization Control System has indeed sparked significant discussion. However, as highlighted in our blog post, the primary purpose of releasing this firmware is to enhance product security and safeguard user information. In response, we have decided to introduce an optional LAN mode feature to grant advanced users greater control and flexibility. Home Assistant: Cloud Mode / Standard LAN Mode (Default): After updating to the latest firmware with enhanced security controls, complete printer control via Home Assistant will be restricted. While Home Assistant will retain the ability to access some printer information, certain functionalities will be limited. Developer Mode (Optional): This option is available for advanced users seeking full control over their network security. By enabling Developer Mode and keeping the MQTT channel, live stream, and FTP open. Ensure that the network ports you need to use are open correctly and that Home Assistant functionalities could operate normally. The specific details and functionalities will depend on the configuration settings of the Home Assistant integration. It is important to note that users will assume full responsibility for safeguarding their local network environment upon manually enabling this feature. Moreover, Bambu Lab will not be able to provide customer support for this mode due to the unofficial communication protocols it employs. At present, the Firmware Authorization update is available in Open Beta exclusively for the X1 series. Participation in the beta program is entirely optional, allowing you to explore and provide feedback on the new features. Alternatively, you can continue using your current firmware. Please feel free to reach out if you still have questions or need further clarification after reading this. We'll do our best to assist you. Best regards, Bambu Lab Customer Support — Reply to this email directly, view it on GitHub <#833 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AHAZ24M2CZZHNJIGX6UK6P32LYZC3AVCNFSM6AAAAABVJXNSEOVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDMMBUGUZTANBRGY> . You are receiving this because you commented.Message ID: ***@***.***>

[jsnyder]

Ok, I just got a reply. It looks like it behaves like LAN-only mode and cloud is disabled:

Regarding your situation, let me provide you with some clarification:

1. Development Mode is specific to LAN mode, where the printer does not connect to the cloud service, and typically only the client software within the same local area network can access the printer. However, it's important to note that even in LAN mode, the network environment where the printer is located may still be connected to the public network, allowing potential access by other malicious software. This is why we have included LAN mode in the Firmware Authorization Control System.

2. After enabling Development Mode, the printer will no longer restrict protocols such as the MQTT channel. Therefore, in theory, third-party software or accessories should be able to operate normally as long as the network ports are appropriately configured. However, this functionality depends on the configuration settings of the respective products.

So, unfortunately this does change things relative to what works now. i.e. handy app and local control of printing state from HA. This is unfortunate but better than totally taking away this stuff. I hope there's ultimately some way forward that allows control and cloud at the same time even if that requires going through this new connect app. Perhaps there might be a headless version of that which behaves like a local API service?

[prolife86]

Ok, I just got a reply. It looks like it behaves like LAN-only mode and cloud is disabled:

Regarding your situation, let me provide you with some clarification:

1. Development Mode is specific to LAN mode, where the printer does not connect to the cloud service, and typically only the client software within the same local area network can access the printer. However, it's important to note that even in LAN mode, the network environment where the printer is located may still be connected to the public network, allowing potential access by other malicious software. This is why we have included LAN mode in the Firmware Authorization Control System.

2. After enabling Development Mode, the printer will no longer restrict protocols such as the MQTT channel. Therefore, in theory, third-party software or accessories should be able to operate normally as long as the network ports are appropriately configured. However, this functionality depends on the configuration settings of the respective products.

So, unfortunately this does change things relative to what works now. i.e. handy app and local control of printing state from HA. This is unfortunate but better than totally taking away this stuff. I hope there's ultimately some way forward that allows control and cloud at the same time even if that requires going through this new connect app. Perhaps there might be a headless version of that which behaves like a local API service?

As expected unfortunately, it will be a choice:
LAN mode with (possibly) HA and (possible) Panda Touch but no Bambu Handy
-OR-
Normal Mode plus Bambu Handy App but no HA/Panda Touch.

There is hope on the horizon, for IOS at the moment only:
https://www.reddit.com/r/OpenBambu/comments/1i761cn/mobile_app_to_use_printer_in_lan_only_mode/

So that would be perfect, app and HomeAssistant! :)

[jsnyder]

That looks like a nice app and would potentially cover most of the bases for what I would want. The main downside I guess would be that initiating quick print jobs for something you might want off of MakerWorld would need to come from a desktop app. That's not bad anyways since it's probably better to look over a job and the slicing anyways before printing.

[greghesp]

Hey All,

I reached out to Bambu last week, but haven't heard anything back.

Right now on the Beta, as mentioned above, all read access works fine. The only control that there is, is the light, everything else is blocked.

Moving forwards with Developer Mode, the assumption here is as follows:

1. Cloud Connectivity will still not allow control
2. Developer Mode is a subset of LAN mode, and will allow HA to fully control the printer as it does today. The caveat to this, is you lose all cloud functionality -> No Makerworld, No Handy etc

[jsnyder]

Hey All,

I reached out to Bambu last week, but haven't heard anything back.

Right now on the Beta, as mentioned above, all read access works fine. The only control that there is, is the light, everything else is blocked.

Moving forwards with Developer Mode, the assumption here is as follows:

1. Cloud Connectivity will still not allow control
2. Developer Mode is a subset of LAN mode, and will allow HA to fully control the printer as it does today. The caveat to this, is you lose all cloud functionality -> No Makerworld, No Handy etc

Assuming this is basically where we're at, I wonder if there's a potentially successful request to ask for a few "safe" controls on mostly read mode. I.e. for example, in addition to LED control HA could pause a job (for whatever reason.. spaghetti detection, something else is going on that is a good reason, etc..). I mean, we can always turn off a smart plug to kill the printer (less desirable) or set up a switch bot to run the local UI...).

I'm also hopeful that the above suggestion (however less desirable) to run Bambu Connect on Linux might work (I asked them if they might do a headless/containerizable service), but given that they don't want a cloud API maybe they wouldn't do this either? I'm sure someone could make it work (accessibility apis on some platforms or if there are tools for driving whatever GUI framework is in use) even if it's a GUI app, but it would be far from optimal.

[t3chguy]

I'm sure someone could make it work (accessibility apis on some platforms or if there are tools for driving whatever GUI framework is in use) even if it's a GUI app, but it would be far from optimal.

If its still an Electron app one could use Playwright or one of https://www.electronjs.org/docs/latest/tutorial/automated-testing to automate it

[Juhaz]

Bambu Connect does not expose any functionality other than sending a print to third parties, and even that is not something that can be fully automated, you'll still have to click buttons in the connect after you send the file to it to ACTUALLY do anything.

It's not something you can migrate the HA controls to work over whether or not it works on Linux (at least in any sane fashion, I suppose you could technically run it in Xnest and send mouse events to it)

[AdrianGarside]

"Cloud Connectivity will still not allow control"

It does allow control today as long as you are using the cloud mqtt connection. Only hybrid (cloud setup + filament usage + cover image from cloud + local mqtt to printer) blocked the control.

So it's a new restriction vs the current status quo. Cloud mqtt will start behaving the same as local mqtt.

[AdrianGarside]

If this happens that would largely satisfy me:
https://www.reddit.com/r/OpenBambu/comments/1i761cn/mobile_app_to_use_printer_in_lan_only_mode/

I can live without being able to print from the Sofa (nice as that is!) but not being able to use the handy app if I'm forced to switch to developer lan mode would be very annoying.

Edit: I misunderstood - I thought Bambu Handy was going to be updated to work with a lan mode printer. I'd rather invest the time to make the home assistant integration more fully featured than have to use another app. It'll never be as polished as an app as the Home Assistant UX capabilities are pretty crap but there's not a lot of functionality that most people use so chances are we can craft a reasonable experience for the top things.

[cryptonym64]

HA has a thread with code adding skip object feature. Give it to me. I love how many open source projects are stepping it up, as this one, to make lan only mode work as well as possible given the new crippleware decision from Bambu.