Bambu Lab: The Convenience of the Cloud and Privacy Concerns

Bambu Lab has revolutionized the market with fast and easy-to-use printers, many of which rely heavily on a cloud-based infrastructure for features like remote control and print file submission. While this approach offers undeniable convenience, it has raised serious questions within the 3D printing and open-source communities.

Bambu Lab's slicing software, Bambu Studio, is a fork of OrcaSlicer, which in turn derives from Prusa Slicer, all licensed under AGPLv3 (Affero General Public License v3). This license requires any derived software to keep its code open. However, Josef Prusa, founder of Prusa Research, and the Software Freedom Conservancy (SFC) have accused Bambu Lab of violating this license by keeping its network plugin closed and unauditable.

Key Privacy Concerns with Bambu Lab:

• Telemetry and Identifiers: Bambu Lab collects data such as device_id and user_id, along with information about printed models. Although the company claims this data is anonymous, the presence of permanent identifiers raises questions about true anonymization.
• Cloud Data Flow: By default, print files and commands pass through Bambu Lab's servers. While a LAN mode exists, the convenience of the cloud is a major selling point, leading many users to rely on it.
• Closed Network Plugin: The fact that the network plugin is closed-source and can be updated remotely without auditing raises security concerns, as it is not possible to verify what this component is actually doing with the data.

Prusa Research: Open-Source and Local Control

Prusa Research, on the other hand, has a philosophy deeply rooted in the open-source movement. Its printers and software, such as Prusa Slicer and Prusa Connect, are developed with a strong focus on transparency and user control.

Prusa Connect is Prusa's cloud service, which allows remote control and monitoring of printers. However, Prusa emphasizes the option of local control and transparency regarding the data collected. The company is known for being more open about its practices and for giving users more control over their privacy.

Chinese Data Security Legislation

The issue of Bambu Lab's privacy is further complicated by its Chinese origin and China's strict data security legislation. China has implemented a comprehensive legal framework between 2017 and 2023, which includes the Data Security Law (DSL), the Cybersecurity Law (CSL), and, crucially, the National Intelligence Law (NIL).

This law, along with others, establishes a system where Chinese companies, regardless of their intentions, are legally obliged to cooperate with Chinese state intelligence agencies if requested. This means that even if a company like Bambu Lab has the best intentions in protecting its users' data, Chinese law can force it to share that data with the government.

Implications of Chinese Legislation:

• Government Access: The Chinese government can demand access to data stored by Chinese companies, including data of foreign users, under the pretext of national security.
• Data Localization: The DSL and CSL impose data localization requirements for certain categories of data, meaning some data must be stored within China's borders.
• Lack of Audit: The closed-source nature of certain software components, such as Bambu Lab's network plugin, prevents independent auditing, raising the possibility that backdoors or data collection mechanisms could exist without users' knowledge.