BambuStudio has been violating PrusaSlicer AGPL license since their fork
Recorded: May 23, 2026, 9:58 a.m.
| Original | Summarized |
Josef Prusa (@josefprusa): "BambuStudio has been violating PrusaSlicer AGPL license since their fork, with the same networking binary black box in question today. Why are they willing to burn the goodwill over it? So maybe their hand is forced as their "network" is too valuable already? Each law on its own, interesting, okay... Read them together, and add any Chinese company with big reach to the mix you get the complete picture. 1) National Intelligence Law (2017) 2) Cryptography Law (2020) 3) Data Security Law (2021) 4) Counter-Espionage Law revision (2023) 5) Network Product Security Vulnerability regulation (2021) Together they describe a system with no neutral exits. Cooperation is required, encryption is real but the spare keys live at the ministry, jurisdiction follows the company across borders, industrial data is in scope, and discovered vulnerabilities flow to an intelligence agency 😬 3D printing became strategic for China in 2020 and joined the “Made in China 2025” plan soon after. Why does 3D printing matter so much? 1/x" | XCancel XCancel Josef Prusa @josefprusa May 13 BambuStudio has been violating PrusaSlicer AGPL license since their fork, with the same networking binary black box in question today. Why are they willing to burn the goodwill over it? So maybe their hand is forced as their "network" is too valuable already? Each law on its own, interesting, okay... Read them together, and add any Chinese company with big reach to the mix you get the complete picture. 1) National Intelligence Law (2017) 2) Cryptography Law (2020) 3) Data Security Law (2021) 4) Counter-Espionage Law revision (2023) 5) Network Product Security Vulnerability regulation (2021) Together they describe a system with no neutral exits. Cooperation is required, encryption is real but the spare keys live at the ministry, jurisdiction follows the company across borders, industrial data is in scope, and discovered vulnerabilities flow to an intelligence agency 😬 3D printing became strategic for China in 2020 and joined the “Made in China 2025” plan soon after. Why does 3D printing matter so much? 1/x Jeff Geerling @geerlingguy May 12 Bambu Lab 3D printers: never again. They're breaking the open source social contract (for the nth time...), and I'm past hoping they'll amend their ways. youtu.be/watch?v=eb48MdtN… May 13, 2026 · 4:39 PM UTC 60 Josef Prusa @josefprusa May 13 Two reasons this is especially dangerous in 3D printing: First, Made in China 2025 designates essentially every advanced technology as strategic, so industrial data broadly fits the "national security and interests" definition. Second, 3D printers concentrate at the places where new IP is created. R&D departments, prototype shops, defense suppliers, university labs, hardware startups. The machine sits next to the thing being invented. And the slicer sits on your computer with the same data and access you have. I'm not claiming I know what's happening inside Bambu. This is relevant to every Chinese manufacturer, not just 3D printing. It's cameras, it's cars, it's the free AI models in your coding tools collecting your data. My personal guess is that the subsidies are not designed for the benefit of Western consumers. What do you think? 2/x 5 Josef Prusa @josefprusa May 13 What does the PrusaSlicer AGPL violation actually look like? PS is licensed under AGPL-3.0. That's the strongest copyleft license there is. It's simple: you can fork it, you can build a business on it, you can ship it commercially. But any derivative work has to stay open source too. You take from the community, you give back to the community. That's the social contract. PS is a fork of Slic3r and even though 90+% of the codebase is now written by us, we are proud about the heritage. BambuStudio (BS) is a fork of PrusaSlicer (PS). They published the slicer parts, that's fine. The networking plugin, the part that actually talks to their cloud, is closed-source. Just a binary black-box. The standard defense for something like this is "the plugin is a separate work, so it's not subject to copyleft." That argument falls apart on contact with the actual software. BS cannot do its primary job without the plugin. The plugin cannot do anything without BS. They are not two products that happen to talk to each other, they are one product split across two files for PR license-laundering convenience 😒 Under AGPL, that's still a violation. You don't get to keep the copyleft piece closed by moving it across a function call boundary and calling it a separate work. The license they inherited from us doesn't allow that. The OrcaSlicer inherited the same license by forking BS and follows the rules. Most people miss that the networking blob isn't even bundled inside BS. It downloads itself at runtime. So you can audit BambuStudio's open source code all you want. You cannot meaningfully audit the part that actually talks to the cloud. It lives outside the published software supply chain, arrives from a CDN you don't control, and can be replaced from one launch to the next without anyone outside Bambu having a chance to look at it first 😬 I flagged this exact architecture publicly in March 2023. The same architecture is in place today. Back then we considered legal action. We seriously did. But the practical reality: PrusaSlicer is software, not hardware. There's no boxed product crossing customs to stop - only real possibility which would make them comply. And jurisdiction for the licensee lands in China, which means the case lands in a Chinese court applying Chinese law to a Chinese company. The AGPL is a license. A license without a viable enforcement path is, in practice, a suggestion. 10 Josef Prusa @josefprusa May 13 A funny story from the very beginning, because I want to be clear how long this has been on our radar. PrusaSlicer 2.4 introduced opt-in anonymous telemetry. Shortly after release, we started seeing entries in our database labeled "BambuSlicer." We hadn't heard of BambuStudio yet. Their internal builds were accidentally configured to send telemetry to our servers instead of theirs 🤭 That's how we found out a fork existed, before they publicly launched. And after launch the community had to call out BambuLab to release the BambuStudio source code in accordance with the AGPL license xcancel.com/Bryan_Vines/status/154… We've known what this software is and where it came from since day one. 9 DavidHasbun @TheDavidHasbun May 17 Replying to @josefprusa They will brick your printer if you don't let them spy on you. DavidHasbun @TheDavidHasbun May 15 Bambu Labs has just effectively bricked every printer that does not send their prints through Bambu Labs servers for them to spy on you. These are expensive, top of the line printers that many people including myself rely on as a source of income. I now have about $1,000 dollars of hardware sitting at my home that is useless unless I allow a Chinese company to spy on me and steal my designs. @BambulabGlobal would you like to explain this crap? @BambuLabSupport any comment? @FTC this HAS to be illegal especially for a foreign company to do to American consumers. Is it possible to ban them from selling printers in the US entirely if they insist on using them to spy on US citizens and steal our work? @bbb_us this is a horrific business that preys on its customers. If you look through my profile I have tagged them in many concerns which they have ignored. How do I go about filing a formal complaint against them? 2 Josef Prusa @josefprusa May 17 😬 1 9 more replies International Cyber Digest @IntCyberDigest May 14 Replying to @josefprusa Until then, the Bambulab printers I have are in LAN mode and blocked from initiating outbound traffic. 4 34 Barnacules Nerdgasm @Barnacules May 14 Replying to @josefprusa 1,939 Hamilton PrintWorks @HPW3D May 13 Replying to @josefprusa @YukonK9 Western governments share blame though, they have been shockingly complacent about how China competes in this industry. We’ve got to start subsidizing local homegrown manufacturing while tariffing foreign competitors. 4 This is Greg @Greg_TheBuilder May 13 Replying to @josefprusa 4,100 Garrett Kinsman @GeKinsman May 13 Replying to @josefprusa 7 Aidas Lemon @Lomanonis May 13 Replying to @josefprusa 12 35 EG33 @084bodicantbias May 13 Replying to @josefprusa 22 Mitch@LilApe1990 Replying to @josefprusa 3 18 2disbetter @2disbetter May 13 Replying to @josefprusa 13 Reza@goofieguru Replying to @josefprusa 2,258 Azzys Design Works @AzzyDesignWorks May 13 Replying to @josefprusa I understand the playbook. I understand how they use the world's law to profit and dominate. What's the West to do, to combat it realistically? 1,549 Clay White@ClayinVA Replying to @josefprusa 7 NVRMOR@NVRMOR23 Replying to @josefprusa 862 Keith@petllama Replying to @josefprusa I can get an A1 with AMS that prints flawlessly for about $400 Or I can (and have) pay $1100 for a single color prusa that provides the same print quality. 1 4 Adam@fknrdcls Replying to @josefprusa 856 xRadiant@x7radiant Replying to @josefprusa 1,530 Chris Fraser @defrisselle May 13 Replying to @josefprusa 1,296 The Lizard King@HappyLizard69 Replying to @josefprusa Bambu for the win 3 Niklas Förstberg@nforstberg Replying to @josefprusa 376 Dennis Moule@Rum_Race Replying to @josefprusa @stlDenise3D 1,606 T Ξ S L Λ Algo @TeslaAlgo May 18 Replying to @josefprusa 1 Gary@BWGaryP Replying to @josefprusa 512 Oliver Draxler@FadiA85308728 Replying to @josefprusa 34 TechThatOut @domo326 May 15 Replying to @josefprusa 473 Backyhouse @backyhouse May 16 Replying to @josefprusa 1 585 5465 ¹@mrdaiber Replying to @josefprusa 1 623 Cooper @CooperZurad May 13 Replying to @josefprusa 1,143 @_@ @dysinger May 17 Replying to @josefprusa 137 krrawn @krrawn May 13 Replying to @josefprusa 1,094 RRRrrr@Ratonisko Replying to @josefprusa Holt je to daň za to, že to bude moje tiskárna 991 Load more |
The discussion centers on the intersection of open-source software licensing, international legal frameworks established by China, and the geopolitical implications for the 3D printing industry. The central conflict is highlighted by Josef Prusa's concerns regarding BambuStudio's actions concerning the PrusaSlicer AGPL license, specifically focusing on a proprietary networking binary black box. Prusa argues that the structure of the relationship between the slicer software and the networking component constitutes a violation of the copyleft principles embedded in the AGPL-3.0 license, asserting that the networking plugin is not a separate work but an inseparable part of the overall system. Prusa contends that the separation of these components for license laundering is invalid under the AGPL, calling for accountability. This software dispute is contextualized by a framework of five laws developed by China between 2017 and 2023, which describes a system lacking neutral exit points regarding international commerce and security. These laws involve mandatory cooperation with intelligence work, state-approval of commercial encryption, extraterritorial jurisdiction over data based on national security concerns, an expansion of espionage definitions to include industrial data, and mandatory reporting of software vulnerabilities to intelligence agencies. The collective effect of these laws establishes a system where cooperation is required, encryption keys are held by the state, jurisdiction follows the company across borders, industrial data is targeted, and discovered vulnerabilities flow directly to intelligence bodies. This legal structure is further implicated by the strategic importance China placed on 3D printing, which was integrated into the "Made in China 2025" plan. Prusa suggests that this context forces the proprietary nature of the networking technology, making the "network" incredibly valuable, potentially compelling parties to accept certain terms. He further elaborates that because industrial data is now inherently included in national security definitions, and because 3D printing concentrates intellectual property creation in areas like R&D and prototype shops, the physical location of the printer itself becomes tied to sensitive data. The consequences of this dynamic are starkly illustrated by user concerns regarding surveillance. Some users have expressed that the proprietary nature of the systems leads to perceived surveillance, with concerns about Chinese entities monitoring user data and stealing designs. This has led to calls for regulatory action, including questions about whether foreign companies operating within the US should be subject to restrictions regarding the sale of hardware and the protection of American consumer data. The debate escalates into a question of the social contract within the technology community, where developers are perceived to be pressured into accepting less favorable terms to maintain access to the market or avoid legal repercussions. Ultimately, the discussion moves beyond a simple licensing dispute to explore broader themes of technological sovereignty, corporate responsibility, and the implications of state control over international technology flows. |