BambuStudio has been violating PrusaSlicer AGPL license since their fork
xcancel.com224 points by Tomte 6 hours ago
224 points by Tomte 6 hours ago
Can I just say: thank you for posting an xcancel link and not linking to X directly! I forgot Xcancel was a thing, I might actually start using it occasionally now.
What are the benefits of using xcancel?
You don't have to login to X or download the app (if you're on mobile). X won't let you see the replies otherwise. I also prefer that the layout is denser and you can see more content at once, at least on my phone.
In addition to the other benefits, it's very lightweight. There is an anti-SPAM redirect but no huge JS bundles, just basic HTML.
I can't help but wonder how could, Bambulabs or the Chinese government, actually mine that data? In my mind, 3D models fail into two categories: artistic and utilitarian, though there's a continuum between those two. With the artistic side, the Chinese government could find itself in possession of tons and tons of Western miniatures. With the utilitarian side, they will find themselves in possession of lots and lots of random parts with no way to know what they are for. Of course, there's no telling if the next step of boiling the frog is to require users to attach metadata to their models before the printer prints them...
I think you are underestimating how many companies use 3D printing for prototyping. It's not just hobbyists printing miniatures.
To give an example, I had RSI and use a high-end, expensive ergonomic keyboard. The company that makes these keyboards does not go immediately from design idea to an expensive mold. There are many design iterations and prototypes and they are all 3D prints.
The same is probably true for air humidifiers, drones, or whatever other object you can come up with.
If you have access to everyone's STLs, you basically have access to all the design prototypes and something close to the final product.
It's like industrial espionage, except companies are willingly giving you the data, because they do not want to spend the extra money for a farm of Prusa printers.
It's a brilliant play of the Chinese government. Exploiting that we prefer short-term savings over long-term strategy.
This pattern repeats over and over again, from 3D printers to people buying Chinese fitness watches because they are cheaper than EU and US counterparts.
I think you're overestimate the value of these prototypes. The print itself is either a plastic render of the final product without any value, or it's a shell without any actual useful parts/machinery. If we imagine we're talking about the 1% of 1% of 1% which could end up as useful IP stuff, but which might be very hard/impossible to find/understand/do anything with it, for which cases don't use bambu.
You’re making the assumption that customer product prototypes are the only prototypes produced by 3D printers.
There’s plenty of other more valuable things that are prototyped using 3D printers, such as high end commercial machines, or components that go into those machines.
I suspect that getting hold of STLs from US defence manufacturers would be extremely valuable. Why bother trying to capture a copy of your enemies technology, when they’ll happy just send you all the prototype STLs. Even if it’s not defence, don’t you think access to prototype components from EUV machines from ASML would be crazy valuable to Chinese companies trying to close the gap between Chinese and Western chip fabrication technologies?
> I suspect that getting hold of STLs from US defence manufacturers would be extremely valuable
It would be, yes. There’s a reason why Prussia has optional connectivity and the camera can be physically removed and unplugged.
Chinese have made it part of their economy to steal the IP of US and Europe. It’s not unfathomable.
Not everything that a Chinese company does is for nefarious reason or under the hidden agenda of the Chinese government.
The reality is much more mundane: many Chinese companies do not understand the expectations around open source. There isn’t anything really equivalent in China. The closest mindset is that things that are available to use, are available to take.
The notion of copyright -while not inexistent- is not really a basic cultural notion. Even more so, not caring about ownership, and not enforcing the legalities of it, is partly what allowed innovation at such rapid pace in China.
After all, the Chinese government mandated for decades that all foreign companies setting up shop in China had to have a 51% majority local partner, and technology transfer was mandatory. Basically a government-mandated mandatory transfer of knowledge, to be freely used by the local recipients of it.
So the intricacies of Open Source licenses are a bit lost. Many understand the benefit of it, but not the expectations put on them for this benefit.
In the case of Bambulabs, I suspect that, in their mind, they just want to control their platform. They show their misunderstanding of Open Source rights and expectations and I’m pretty sure they are baffled by the reaction.
It not necessarily malevolent or malicious, though it looks that way from a Western perspective, but more of a cultural impedance mismatch.
They are not idiots, but not everyone at that company will actually understand the duties that come with these licenses.
This reminds me of the fights Naomi Wu used to have a few years ago, going to other 3D printer manufacturers in ShenZhen who were using GPL software but would not release their modifications for their equipment.
She had a hard time making them understand and see the duties and benefits that came with using these types of licenses.
> They are not idiots, but not everyone at that company will actually understand the duties that come with these licenses.
Copyright is not some kind of spiritual nonsense. It's law. You don't need to understand how, you just need to follow it. There can be legal questions on what exactly you can do, but those can arise for any kind of law.
Of course you could also ignore copyright law - but that's the same with any other law.
> The reality is much more mundane: many Chinese companies do not understand the expectations around open source.
Except that Bambu is not a small player in the game, and they made threats of using the DMCA which shows they are fully aware of "western" IP law and the nature of licenses, Open or otherwise.
Aren't you saying the same thing as parent? The expectation is usually NOT to send DMCA notices, so if they do, doesn't that also allude to what parent said, that they don't understand the expectations around open source?
There are cultural differences in attitudes toward individual ownership of IP under communism. It is a recent change for China firms to bother getting international patents and trademarks.
Naomi Wu made herself notable in media, and in China "the nail that sticks out gets hammered down". Unfortunate, as she seemed like a real entrepreneurial leader with skill. =3
And who was it that put her in that situation? An American Journalist that didn't respect boundaries even after it was made clear to them that this would cause issues for her in China.
> Vice published a profile on Wu that included personal details regarding her sexual orientation, which she had explicitly asked them to keep off the record out of fear of state censorship and government retaliation in China.
> Of course, there's no telling if the next step of boiling the frog is to require users to attach metadata to their models before the printer prints them...
Custom firmware is always a thing for these printers.
I was curious about this as well. Hypothetically, if they are really trying to extract insight, they could be:
- Industrial trend pattern: even if only people accidentally leave the Cloud Feature on initially, there could be some that slip through. It could be product categories way before the public knows about it.
- Defence and aerospace: obviously less likely, but if people use Strava in odd locations, and people share classified defence info on War Thunder, then it wouldn’t surprise me if someone slipped something through.
It wouldn’t surprise me if such automated analysis is setup somewhere in China.
In general, the PRC government will install local politically connected members into advisor roles in almost all large companies. It is something a lot of businesses simply have no control over in that country, or in the US for that matter.
The locked ecosystem posture is simply because with a billion people a firm of any size always has irrational competitors/cloners. Sometimes the governments national policy aligns with a firm, but the support always comes at a price for every business owner. Communism is certainly different with subsidized labor pools, and worker support obligations.
Both China and the US governments engage in trade policy/intelligence shenanigans to try to position themselves for whats more than fair.
Global businesses must learn there is no difference between feigned incompetence, and real negligence. As a small firm most simply can't afford to defend themselves legally if targeted, and vastly undervalue why QA checkpoint roles are important. =3
https://www.gutenberg.org/files/26184/26184-h/26184-h.htm
China is a big place, having both good and bad businesses... just like the US. =3
> It is something a lot of businesses simply have no control over in that country, or in the US for that matter.
Can you expand on instances where the US government has installed overseers in large US companies? This sounds preposterous.
There are companies that run lots of machines in parallel and use them to print their products. They could steal these designs and use them to create copycats
I use my printer to make prototypes for my business. There is no way in hell I'm sending them into the internet for some random to examine.
I think my next printer will be mostly 3D printed, with a few generic parts like motor controllers, the odd bit of metal tubing, off the shelf bed levelling system, open source software etc.
I only need single colour prints for work, and AFAIK the fastest printer on the planet is mostly 3D printed, I'd start with that one as a base and adapt it for my needs. I considered Bambu until they started down the road that ends with me not having control of the product I own. Any company on that path does not get my money.
There are options, albeit chinese, that don’t phone home. I have a qidi q2 that’s an awesome printer, and runs open firmware (klipper+fluid) and is pretty much a voron with closed-source hardware. I’m told flashforge printers, the current new hotness because of its multi-nozzle printing, is pretty much open as well.
> I think my next printer will be mostly 3D printed
What you're looking for then is a Voron. They're the printers that Bambu was "inspired" by and are made with all off-the-shelf parts.
I really enjoyed building my Voron 2.4. I bought a kit that included all the wires pre-harnessed which made it much simpler to do.
Going from Bambu to a self printed 3d printer I don't even think counts as the same category of devices. Bambu is concentrated on making a plug and play device that just works.
Seems like an overreaction. Licensing aside it is trivial to use a Bambu completely air gapped. If someone uses AI at all but cares about this I hope the irony is not lost on them.
Or a Prusa. They even sell a variant with no network hardware at all, for the terminally paranoid.
Or, just maybe, buy a printer that does not actively disrespect their users?
I guess it depends on what you value more highly, a machine from a company that respects intellectual property, or a machine that reliably prints parts without intervention.
This was true a couple years ago, but the other vendors have caught up. Today you have options that reliably print without intervention and aren’t bambus
Cannot agree more with Josef on how dangerous this is for our intellectual property; Of course there laws and mechanisms in China for the government to obtain any information retained by their companies under any possible justification, but the US does so, and thanks to the Cloud Act they can simply decide to do the same with any of the big players sitting in their territory (even to servers located out of their territory).
So, taking into account >80% of European companies rely either on Amazon, Microsoft or Google to store all their most private and business sensitive data, is this any different from all the data we are possibly leaking already? Same with AI, same with the phones and payment systems we use on a daily basis...
Sometimes I just have the impression that this has nothing to do with protecting our intellectual property but rather with finding an enemy and focus on that while pretending everything else is fine... and a blogpost from the owner of Prusa Research talking about their main competitor is a good demonstration of that.
What's frustrating is that Prusa isn't too far removed from how Bambu works today. Prusa-Link (the onboard firmware) allows you to do very basic job control but has essentially zero machine control and very little telemetry. All the major functionality is behind their PrusaConnect cloud service, which they've now added a paid tier to, and which they've been promising for years to open source in order to allow print farms to run offline.
I love Prusa printers and all my machines are Prusa, but they really do need to get their software situation sorted because in it's current form, it's somewhat hard to distinguish from the operational reality of Bambu - if I want to use all the features on my XL, I need to send my files to Czechia first.
> pretending everything else is fine
No one pretends that everything else is fine.
It is in my opinion reasonable to call out any violations of any law or any violations of the users' or companies' privacy as they are spotted. And everyone is best suited to spot issues in areas or fields in which they operate.
I don't like all this shaming on social media. It feels performative and leaves a bad taste in my mouth.
If they're in violation of your copyright agreements, sue them. If you can't sue them because it's unenforceable, well, that sucks, but too bad.
I don't know what they expect to happen here. Is there even a clear call to action? Boycott? Do something.
> Back then we considered legal action. We seriously did. But the practical reality: PrusaSlicer is software, not hardware. There's no boxed product crossing customs to stop - only real possibility which would make them comply. And jurisdiction for the licensee lands in China, which means the case lands in a Chinese court applying Chinese law to a Chinese company.
If there is no legal recourse, but you believe in the ideas and philosophy of copyleft, then all that is left is social enforcement. I.e. don’t buy their printers and tell your friends not to buy their printers.
But you seem to have a problem with that second part because it’s “performative”? Ok…
Or is it just that you’d rather the call to action was clearer? Because it’s pretty clear to me.
Oh please, they deserve shaming. This is a great use of social media. Put the facts out there as you see them. No need to sue or have a call to action.
I think the courts are so inefficient, not to mention limited to single countries, that huge "social protests" like this seems more efficient if you actually want to see some change, rather than the year-long process of going through the courts.
I do agree with you though, that every time these things happen I also get a somewhat sour taste in my mouth. Ideally there'd be better venues for things like this, but based on history it seems to be the most effective way, sadly.
It's become rather clear that Open source licenses are vulnerable, since defending them costs large amount of money, and proving violations can be hard since by definition the products that break them are closed-source.
Software Freedom Conservancy is at least fighting back.
https://sfconservancy.org/news/2026/may/18/bambu-studio-3d-p...
I am annoyed that they just claim that "reverse engineering" will take care of this, instead of really trying to fight back legally.
This is a social problem, and reverse engineering can only help up to a point.
A legal battle is expensive and time consuming. For example they have been fighting one with Visio since 2021[0]. It’s going to court this year.
I’m not sure how well tested AGPL has been tested in court, but assuming it has, the SFC has the right to reverse engineer anything covered by the license. That will help people sooner than trying to get a court to make a decision.
They are likely pretty busy with their lawsuit against Vizio, which is going to trial in August and would set a very interesting precedent if won.
Open source for medium and small projects is dead if enforcement is a consideration. Trivial to reimplement in same or other language and give yourself plausible deniability.
With DeepSeek making their price rebates permanent we now have some data what China values data access at.
Western providers of the open weight models are 3 times or more as expensive as DeepSeek itself right now.
Of course the data access for the Chinese is not the only part valued in there, but I am pretty sure it is one.
I sure hope none of Ukrainian shops use Bambu Cloud printers to do their drone manufacturing.
Can you just sue them over it? Sure they are a Chinese company but they also operate in Europe and US?
You can sue them if they have operations in a country you choose to sue in, or supply people in that country, or you can sue their importers and distributors. Maybe even marketplace sites if they sell through those.
I would like some precedents, to see if AGPL is actually enforceable. Many licenses put several demands on user, but are some parts are void and illegal. Like OEM licenses for MS Windows, that forbit reselling.
License can not order someone to publish something. They may not have a rights to publish code, or it was created as part of employment...
> License can not order someone to publish something.
No it can't, you are right.
By default, you don't have any right to use any given software. The license outlines the conditions under which you have are permitted to use it. If you don't comply with the conditions, you aren't permitted to use it.
The license isn't ordering you to do anything, you can simply not use the software!
accepting AGPL means you're vowing to publish derivative work. if you aren't legally allowed to publish that work, you violated its terms. the Court may not order you to publish to cure the violation, if you lack the rights to do so, but they can still order you to pay damages.
if I sign a contract saying I'll produce a million Iron Man action figures, but I don't have the IP for Iron Man, I can't just shrug my shoulders and say "well, you can't make me." the Court would make me pay damages.
AGPLv3 still has the termination clause which is at least in the worst case (total failure to comply) entirely self-contained.
I'm not however convinced they are really in violation by calling a binary plugin. GPL itself does not forbid you from dynamically linking to or calling unrelated software. The network plugin is analogous to a device driver, it's not core part of the slicer.
GPL differentiates between a "Combined Work" and an "Aggregate":
> A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, and which are not combined with it such as to form a larger program, in or on a volume of a storage or distribution medium, is called an "aggregate" if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation's users beyond what the individual works permit. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate.
If they tried to add DRM to Bambu Studio and prevent you from replacing their blackbox with a different one then that would be where they would clearly go against the v3's TiVo provisions.
> GPL itself does not forbid you from dynamically linking
GPL does not contain the words "dynamically linking". That‘s just a common interpretation as a shortcut.
In this case there are arguments for the program-plugin communication to be "intimate" and as such falling under "derivative work". But it‘s easy to take the other side, as well.
I put the actual clause under, but let's forget the actual legal definition for a moment.
GPL license in spirit is about assuring the user freedoms. No user freedoms are limited in this case. You are free to modify and redistribute the software as you like. OrcaSlicer pulls changes from Bambu without any issues.
I don't think trying to enforce the license in this way, even if possible (which again I think if it was it would happen with Linux drivers long before), is the right thing to do anyway. All it's doing is painting the GPL as a liability to any business for no benefit.
A license is as enforceable as there are lawyers to advocate for it in court, judges to make rulings for it, and a system of enforcement to make any rulings a reality. Doesn't really matter what's in the license itself.
Its a chinese company. They don't give a single flying fuck. Nor do almost all consumers as long as the product is good. And no western government is gonna care because we let ourselves become so dependent on cheap chinese manufacturing.
Western courts have a different perspective since they pretty much universally don't have the larger issue of the Chinese manufacturing as a consideration.
Which is to day you can go to any western court and have import stopped at the border.
[dead]
Kind of love the irony of this being an xcancel link
What is the irony here?
Xcancel is against the x terms of service. But no one really cares because it is not perceived as an issue, similar to this situation
Terms of service are not legally binding, copyright licenses are legally binding.
This is not universally true. Some, but not all, terms of service are explicitly a contract between the business and the user.
There is no precedent for AGPL enforcement against Chinese companies, so no, not really.
Feel free to post a docket if you disagree though. Also there are plenty of cases for ToS violations look up Facebook vs BrandTotal, or more recently Epic vs Apple.
In the same way no one here cares about archive.org paywall circumvention, non techie end users don't care about open source violations (why should they). Look at the very link we are discussing for proof.
This post is now gone. Click the down button and stop reading.
It seems we have arrived at the "HN does not read license texts" hour again.
> Because the AGPL (and even general GPL) are copyright licenses, they simply do not have anything to say about software that is distributed separately
Of course they can. The nature of any software license boils down to "this work is protected by copyright. If you comply to A, B and C, you can do D, E and F that otherwise would have violated copyright law". A, B and C can be whatever you want. It can be "don't use this in nuclear power plants" (MS likes that condition), it can be "if you make less than $100k anually" (Unity etc), or it can be "if you share the source code" (copyleft). You can make that clause as wide or unrelated as you want
The real issue with GPL and AGPL is how badly defined the boundary is unless you have a single compiled C program
> Which reduces the problem down to "is Bambu doing that"? Given the installer is 300 megabytes, it probably contains both the application and the plugin, but you go launch an international lawsuit over "probably".
No, the plugin is downloaded at runtime on first launch
The amount of outright obfuscation with this issue is absurd. Either many of the big names that have jumped on the bandwagon are credulous idiots or deliberately misrepresenting what has happened for their own gain.
I think copyleft was a mistake. I don't understand the value of it beyond increasing the reach of open source, it has no direct benefit to the source. It imposes a higher cost than if you just charged for the license. Not to mention the cost to the publisher of enforcing it.
Open source is about freedom, that should include the freedom of consumers to make whatever choice fits their target. If we want to increase its reach, we should emphasize the value of that freedom. People have a strong instinct for reciprocity and it is strongest when it is entirely their choice.
Open Source was made by someone. With copyleft they decided: You can use my code, you can modify my code but if you build on my work you will also open source that.
Open Source is not necessarily a business decision but often a personal one. Often authors start without any pay but instead because they thought it was a nice thing they want to share. So it's their right to say what people can or can't do with their original work.
Companies have the ability to write their own software if they don't want to follow these rules.
That presumes consumers have a choice to make in maintaining that freedom.
For a concrete example look at OpenWRT, there were not many good choices before copyleft forced the linksys release. Now they have exploded and there is an entire ecosystem of open software and modifications on routers.
Copyleft is about freedom of consumers to make whatever choice fits their target, unlike permissive licensing, which is about freedom of corporations to take away freedom of consumers.
Surprisingly, there are use-cases for closed source other than the of greed of corporations. A server is one of those use-cases. I love to see open source servers and have worked on them myself but there are obvious reasons why that is not always feasible.
Greed is a loaded word, there are economic realities of paying developers to create the open source software. Could you elaborate on the non-economic use cases you are thinking of?