An ongoing 3D-printer AGPL violation

At FOSSY 2026, respective group from the Software Freedom Conservancy (SFC), which organizes the conference, gave a position astir an ongoing violation of the Affero General Public License type 3 (AGPLv3). Bradley Kühn, Karen Sandler, and Denver Gingerich said astir different aspects of the violation, which is in regard to 3D-printer package from Bambu Lab, and what is being done to effort to supply users pinch alternatives. One facet that is particularly absorbing is that the circumvention that the institution is employing is precisely what the AGPL was written to prevent.

Keep up pinch Linux and free software pinch a free proceedings subscription to LWN, nary in installments paper required.

Kühn began the convention by noting that he has been an activistic successful the free and open-source package (FOSS) communities for complete 30 years and that "this moment successful history [...] has much activism opportunities than I person seen in my career". In the past, he and his colleagues person been triaging disasters of various sorts but complete the past six to 8 months they have been triaging opportunities instead. Sandler added that the opportunities being offered are difficult; "it's not for illustration group are saying 'would you like this money aliases that money?'".

The opportunities he is describing are not really astir money, Kühn said, but supply ways "for activists to get worldly done and to engage people". Over the past six months aliases so, SFC has successfully engaged with "an full organization of enthusiasts", which only had a passing familiarity pinch FOSS, connected a multitude of freedom-centric topics: "free software, free culture, free creation". That is exciting, but he was getting up of himself because that is wherever the story ends, truthful he wanted to spell backmost to the beginning.

Backstory

Some clip ago, 3D printing was invented, which is thing that he watched from afar; a breadboard occurrence erstwhile he was an undergraduate convinced him that he should be a software-only person. He is simply a instrumentality of the 3D-printing culture, and enjoys the talks that travel from it, but he does not participate. As part of the license-violation investigation, he and Gingerich did a crash course successful the history of 3D-printing, though Gingerich already had overmuch of the background.

Kühn related immoderate of what he learned, including that the hobbyist 3D-printing section started retired arsenic a curiosity. People who wanted a 3D printer had to build 1 themselves, since location were nary already assembled devices connected the market. Some of those who built the early printers went on to recovered companies that now waste 3D printers, which is simply a cardinal constituent successful the development of the community. Like Linux, 3D printers started arsenic a hobby and remained "a hobby for a long-enough play of clip that the hobby culture could not beryllium instantly eradicated by task capitalists".

The "wonderful thing" astir 3D printing is that the people developing the package needed to tally the devices looked to the free-software organization and "thought twice" earlier they started picking licenses for their code. An important portion of the tooling needed to usage these devices is simply a programme known arsenic a "slicer", which turns a 3D model—some slicers besides thief build these models—into thin 2D slices that tin beryllium converted into the connection that the printer hardware understands. He likens that connection to assembly language, which is an oversimplification, but helps supply a conceptual model for him.

A longtime free-software enthusiast, Alessandro Ranellucci, created a slicer, which he called "Slic3r". Kühn said that his only disapproval of Ranellucci was his prime of the name, which makes it difficult to separate betwixt the programme and the wide type of programme successful a talk, truthful Kühn utilized "slicer pinch three" to separate them. The 2 said complete a video chat and Ranellucci said that he chose the AGPLv3 for Slic3r to effort to debar the messiness pinch Bambu Lab: "I anticipated each this, because my biggest interest was that personification was going to do 'Slic3r arsenic a service'".

While location are 3D printers that usage different slicers, it is difficult to find one that is not champion utilized pinch immoderate fork of Slic3r, Kühn said. There are around 18 progressive forks, but the astir well-known is PrusaSlicer. It came about because a friend of Ranellucci's, Josef Prusa, saw 3D printing as not only conscionable a business opportunity, but "a free-software business opportunity". Prusa built a institution based connected providing customers pinch printer plans, free software, free firmware, and truthful on, Kühn said; that institution was the ascendant subordinate successful the marketplace for a time.

At the aforesaid time, a parallel marketplace successful 3D printers for manufacturing was developing. These were printers that took up a full room and cost hundreds of thousands of dollars. Meanwhile, though, the hobbyist printers that costs $500-3000 were "becoming really, really, really good", especially toward the apical extremity of that range.

Enter Bambu

That was the authorities of the marketplace successful 2019 and pre-COVID 2020. During COVID, lots of group picked up hobbies, including 3D printing; that attracted a Chinese company, Bambu Lab, to the market. Kühn said that the institution is rumored to person ties to the Chinese government, though that has not been confirmed. It decided to commencement from scratch and make 3D printers; by 2025, the institution controlled 38-48% (depending connected the expert report) of the market for $500-3000 printers. In part, that is because the marketplace for room-sized business printers is dying and that customers person realized that they tin beryllium replaced pinch fleets of overmuch cheaper, better, and much reliable printers from companies for illustration Bambu Lab; the institution has been targeting that market, along with the hobbyist market, frankincense its success.

Bambu Lab needed a slicer, of course, truthful it started shipping a modified PrusaSlicer (as Bambu Studio), which it was capable to get via the AGPLv3, but without shipping immoderate source code aliases an connection to supply it. That continued up done 2022 aliases 2023, Kühn said, until the unit from the 3D-printing organization effectively forced Bambu Lab to make a root release, which was, arsenic is almost always the lawsuit for a first release, not the existent corresponding root code.

"You've sewage to beryllium amused by the ingenuity of copyleft violators", Kühn said; they often trust connected mechanisms that an existent judge is not going to care about. In this case, Bambu Studio would popular up a petition to download "a small much stuff" pinch the classical choices of "Yes" or "Ask maine later"; users yet fig retired that immoderate functionality successful the slicer does not activity until they click "Yes". The extras that are downloaded are 2 .so files built from C++ source. Those shared-library files are dynamically loaded into the slicer—as tin plainly be seen from the dlopen() calls successful the root codification that was released.

Kühn said that Bambu Studio and each of its components would be considered a mixed activity nether the regular GPLv3, but the institution has a network-based constituent that runs up against the restrictions successful the AGPLv3 arsenic well. The dynamically loaded portion of the slicer is simply a bladed layer that calls retired over the web to an extended 3D exertion moving connected Bambu Lab servers; it passes a "key", which is conscionable a circumstantial User-Agent string, that allows entree to the other functionality connected the servers. The institution claims that the User-Agent, which is the aforesaid for each of the clients, is simply a DMCA anti-circumvention mechanism.

But, he said, that is precisely what the AGPLv3 is meant to prevent: "You can't put portion of your Affero-GPLed exertion connected your web server and keep it proprietary". A 3D-printing personification from Poland, Paweł Jarczak, reverse-engineered the User-Agent drawstring and web code, which resulted in a DMCA takedown announcement from Bambu Lab. "GitHub, of course, honored it, because Microsoft." Jarczak is still maintaining the codification successful his slicer (OrcaSlicer), which is being mirrored connected an SFC repository arsenic portion of its baltobu project that is aimed astatine moving astir the Bambu Lab AGPLv3 violations.

Gingerich noted that Bambu Lab is not only violating AGPLv3, but is also violating GPLv2 by not providing the root for a Buildroot-based Linux (and different copyleft components) utilized successful the firmware of immoderate 3D-printer models. He downloaded the 300MB firmware image from the Bambu Lab web site, but was incapable to find the root aliases an offer to supply it.

He said that Bambu Lab comes from a silicon-valley-inspired civilization that is being built successful China, which includes ample venture-capital-like investments into companies. Bambu Lab has heavy pockets, which allowed it to leapfrog its competitors successful various ways, marketplace its products extensively done societal media and the like, and to exert power over the connection astir its products connected forums for illustration Reddit. The institution took some of the aforesaid shortcuts that silicon-valley companies person taken by "violating copyleft licenses connected the way".

Gingerich thinks this business provides "a very bully opportunity" to "take backmost the power that we are owed by the licenses that they chose to use". Bambu Lab could person spent its finance on "reimplementing things from scratch", but it chose not to; location is a ample assemblage of precocious value free and open-source package disposable that "takes a agelong clip to replicate".

Bambu Lab has efficaciously taken the communal "then, writer us" attack to these violations, which is surely an option, Gingerich said. But various ways to remedy these kinds of problems person different timelines; getting the community progressive successful reverse-engineering and replacing the proprietary pieces will apt return a batch little clip than a lawsuit. Kühn noted that companies successful usurpation ne'er really opportunity "sue us", alternatively they conscionable extremity responding.

Participation

Sandler said that 1 of the reasons these violations are truthful interesting is that they person brought much caller group into the FOSS organization than any other matter that SFC has worked connected complete the years. People who had never really heard of copyleft aliases FOSS are excited astir it; now they "realize that these licenses assistance authorities and that we tin do something with it". Normally, erstwhile the SFC is talking astir these kinds of issues, she said, it is talking to the group successful the room, aliases those who will position the recorded video of the session, which is "a constrictive group of people and we struggle to explicate what the imaginable is". But the 3D-printing organization has really taken the shot and tally pinch it; "multiple YouTubers were putting retired heavy explanations" and commenters astatine Reddit and elsewhere were "getting truthful excited and saying 'wow, this is what these licenses mean, we should usage them more!'".

That near much than 10 minutes for assemblage questions, the first of which was "what would make Bambu travel the AGPL?" Gingerich said that there are assortment of approaches, including lawsuits for illustration the SFC's versus Vizio (now owned by Walmart); since copyleft licenses are also contracts, that suit is based connected statement law. There is simply a contract between Vizio/Walmart and the package developers who created the GPLv2 and LGPLv2.1 codification that was utilized successful televisions; the SFC (and anyone who buys a Vizio TV) are "third-party beneficiaries" of that statement and the SFC is suing to get the authorities that are required by it.

Enforcing contracts successful this measurement is modular practice, Kühn said, but has not been utilized for the GPL family of contracts arsenic acold arsenic they know. The more accepted way to enforcement is to writer arsenic a copyright holder in the code, which is what the SFC has done successful the past. There are other mechanisms, including utilizing various waste and acquisition agreements pinch their "intellectual property" clauses arsenic a tool. While intellectual-property rules whitethorn beryllium distasteful, that is successful keeping pinch the original intent of copyleft: "to return immoderate norm for illustration that, flip it around, and usage it to defend package freedom".

In conjunction pinch its activity connected 3D printing, the SFC ran a fundraiser that ended up far exceeding the lofty extremity of $250,000 that was set, Kühn said; it was "a target that we thought we astir apt would ne'er make". Sandler said: "we picked a number that we thought we could really accomplish something important pinch it", moreover though location was a bully chance that it would not beryllium reached. "We blew past it and astir of our donations were teeny mini donations", which was exciting. Kühn noted that the SFC is now capable to prosecute a full-time litigation attorney; he encouraged attendees to guarantee that the connection sewage out.

Many group deliberation that a GPL licence is "magic pixie dust", Sandler said; by choosing the license, it will make people travel it and the problem is solved. That is evidently not the case, which was evident from the emphatic caput shakes from attendees. "If cipher holds anybody's feet to the fire, if cipher says 'wait a minute, you're not really doing this', nary 1 ever will do it."

There are aggregate ways to prosecute enforcement, which requires some creativity, she said. The SFC is trying to "demonstrate the different ways that you tin spell astir getting companies to do the correct thing". She advocates that everyone inquire for the complete and corresponding source code for each of the devices they purchase; it will show that there is user request for those rights. An unhappy YouTube video aliases thread on Reddit if the root codification is not released is besides a shape of enforcement, she said.

Another mobility was astir whether litigation was an effective instrumentality for enforcement. Gingerich noted that a root merchandise from an enforcement action against Linksys was the first perpetrate for the OpenWrt project. It leads to projects that "help america return power of our devices truthful they do what we want, and not what the companies that waste them want".

In addition, the location lawyers for companies regularly convey Sandler for lawsuits because it makes their jobs a batch easier, she said. If location are no consequences for violating the license, institution lawyers person a difficult time ensuring compliance. The business broadside of the institution wants to cognize what the costs are for violating the license, "without lawsuits, location is no answer to that".

The last mobility was astir fixing the guidelines origin of licence violations, which tin beryllium interpreted successful tons of different ways. Kühn said that fixing societal corruption worldwide was a gangly order; the aforesaid goes for fixing capitalism, Sandler added. The underlying problem is 1 of power imbalance, Gingerich said, which is thing that FOSS and the larger right-to-repair movements are moving against. Sandler closed by saying that the extremity of these movements is to onslaught the guidelines origin by bringing astir a amended world, pinch improvements successful products, technology, and legislation; that requires getting actively progressive and helping non-technical group to go invested successful these issues arsenic well. That seems for illustration a alternatively gangly bid arsenic well, of course.

[I would for illustration to convey the Linux Foundation, LWN's recreation sponsor, for its assistance pinch my travel to Vancouver for FOSSY.]

---