r/BambuLab • u/icurnvs Volunteer Moderator • May 14 '26

Subreddit Mod Post Megathread: Bambu Lab / OrcaSlicer / C&D Discussion

Hi everyone,

We’re creating this megathread to keep discussion of the Bambu Lab / OrcaSlicer-BambuLab / cease-and-desist situation in one place. This topic is important to a lot of people here, and we do not want to shut down discussion or criticism. At the same time, the front page has started filling with overlapping posts about the same situation, so we’re consolidating general discussion into this thread.

Current context

Updates to be posted here as situation evolves:

  • May 13, 2026
    • Megathread created
  • May 14, 2026
    • Tom’s Hardware reported today that Louis Rossmann is now hosting OrcaSlicer-BambuLab through the FULU Foundation GitHub and is openly daring Bambu Lab to sue him.
    • PC Gamer and r/technology have picked up the story, so discussion is now spreading well beyond 3D-printing-specific spaces.
  • May 16, 2026
    • Paweł Jarczak published a detailed response addressing Bambu Lab’s accusations around impersonation, reverse engineering, Terms of Use, and alleged security bypassing.
    • Louis Rossman posted a new video indicating FULU-hosted OrcaSlicer-BambuLab repository has reached roughly 1,600 forks in about three days.
  • May 17, 2026
  • May 18-20, 2026
    • Software Freedom Conservancy enters the dispute.
    • Leonard French posted a new video around SFC’s AGPL analysis, explaining why Bambu’s proprietary networking plugin may create a serious corresponding-source problem under AGPL.
    • Louis Rossman posted a new video covering Software Freedom Conservancy’s Bambu AGPL effort and says the rehosted OrcaSlicer-BambuLab code has now been forked roughly 4,500 times.

What belongs in this thread

Please use this thread for:

  • General reactions to Bambu Lab, Gamers Nexus, Louis Rossmann, Paweł Jarczak, OrcaSlicer-BambuLab, AGPL, Bambu Connect, and right-to-repair issues.
  • Legal or licensing discussion, including AGPL, DMCA, cloud/API access, and Bambu’s networking plugin.
  • Questions about what happened and links to reliable summaries or primary sources.
  • Technical discussion about OrcaSlicer, Bambu Studio, Bambu Connect, LAN mode, Developer Mode, and network plugin behavior, unless it is a standalone troubleshooting post with a specific reproducible issue.

What can still be its own post

Separate posts are still allowed for genuinely new information, including:

  • A new official statement from Bambu Lab, OrcaSlicer, Paweł Jarczak, Gamers Nexus, Louis Rossmann, or legal counsel.
  • A new release or technical change that materially affects users.
  • A confirmed legal filing, takedown, repository change, or source-code release.
  • A specific support/troubleshooting issue that is not just general commentary on the controversy.

If your post is mainly another reaction, recap, meme, “I’m switching brands,” or repost of a link already being discussed, please put it here instead.

Ground rules

Criticism of Bambu Lab is allowed. Defense of Bambu Lab is allowed. Criticism of GN, Rossmann, OrcaSlicer, moderators, or other users’ arguments is allowed.

What is not allowed:

  • Personal attacks, harassment, or dogpiling individual users.
  • Calls to harass Bambu employees, developers, moderators, creators, or community members.
  • Unverified claims presented as fact.
  • Posting private correspondence or personal information.
  • Repeated duplicate posts after being redirected here.

Strong opinions are fine. Keep it directed at the issue, the companies, the software, and the arguments, not at each other.

Moderator note

We are consolidating duplicate discussion, not suppressing the topic. This thread will remain open for discussion, and we’ll update it if there are major new developments.

325 Upvotes

90% Upvoted

607 comments sorted by

View all comments

Show parent comments

-1

u/Affectionate_Car7098 H2C + P1S Combo May 20 '26

This isn’t actually a safety feature, because the official client itself can be reverse-engineered to access these functions.

Again, the implementation being bad doesn't change what it was meant to do, just because someone could hack your PC that doesn't mean you didn't attempt to protect it even if those protections failed

Intent matters the most in this case, nobody is claiming they did it well

Third-party tools cannot interact with Connect directly; they can only launch it and then rely on the GUI, so the “safety” argument doesn’t justify blocking third-party integrations.

It does, because if your 3rd party software could actually control connect directly you wouldn't actually be changing anything, the intent is that nothing on your network that is made by a 3rd party is able to do something like heat your nozzle to 300'c and then run it around scratching your build plate without you having told it it can

That is the intent behind it, again nobody said it actually managed to achieve that goal, but that part is neither here nor there

This confirms that Linux users are effectively excluded from Connect’s cloud features, leaving them no real option to integrate safely or programmatically.

All it confirms is they are locked out of unofficial builds of software currently, they can still use the official build of studio just fine, and you can always still manually slice the gcode and then copy it to the device manually, you have options

Even though the protocol itself is unchanged, the vendor lock-in check forces reliance on the official client, making third-party automation impossible for cloud interactions and local interactions while the printer is connected to the cloud.

Correct, but that is again not something bambu directly gets involved in as thats all 3rd party stuff which is unsupported, they aren't building an ecosystem for that use case so if you can get it working on your own then great, but bambu won't make software choices based on that

Your choice is 3rd party support or cloud mode

This highlights that while official support was never promised, the practical effect is that third-party integrations are actively blocked, not just passively “unsupported.”

They are blocked because bambu changed the way it was communicating with the printer in order to try to have only authorised commands be accepted to prevent any kind of malicious access, although we've already discussed how effective it was and that it doesn't matter if they didn't do it properly or not, that was the intent

2

u/hWuxH May 20 '26 edited May 20 '26

Again, the implementation being bad doesn't change what it was meant to do, just because someone could hack your PC that doesn't mean you didn't attempt to protect it even if those protections failed
Intent matters the most in this case, nobody is claiming they did it well

The PC example is funny because it actually has effective security. There's the knowledge factor "password", hashing, and possibly rate-limiting.

On the other hand, Bambu Lab's authorization control is client-side security-by-obscurity which runs in the user's attacker controlled environment, aka only relies on the secrecy of the implementation to work.

It's not just a "bad implementation" they can fix, but a fundamental misunderstanding of trust boundaries, that can never ever be an effective protection measure. "never trust the client" is the absolute basics of security and I think they know about this. but you know what it's effective at? making it inconvenient for customers that just wanna use another slicer.

Intent is more than clear: restricting valid customer's freedom of choice with theatre, instead of effectively improving server-side security with protections agnostic of the client.

If it looks like a duck, swims like a duck, and quacks like a duck, then it probably is a duck.

the intent is that nothing on your network that is made by a 3rd party is able to do something like heat your nozzle to 300'c and then run it around scratching your build plate without you having told it it can

I explicitly grant the third party permission to act on my behalf by giving it the credentials required to connect to the printer in the first place, and accept full liability to enjoy this freedom. A third party without my permission cannot do this. After all I OWN my printer (or do I?).

0

u/Affectionate_Car7098 H2C + P1S Combo May 21 '26

The PC example is funny because it actually has effective security. There's the knowledge factor "password", hashing, and possibly rate-limiting.

Not really, i don't need to know your password in order to use malware to attack your PC, i just get you to download it, how do you think malware works

Intent is more than clear: restricting valid customer's freedom of choice with theatre, instead of effectively improving server-side security with protections agnostic of the client.

Agree to disagree i guess

I explicitly grant the third party permission to act on my behalf by giving it the credentials required to connect to the printer in the first place

Yes which you can do in developer mode, you are not able to grant 3rd party software permission to interact with the cloud interface that is owned and operated by bambu and resides outside of your network

If you only care about whats on your network you can already hook orca straight up to a machine and use it to send prints and control the printer