Glonce

Bambu Lab's ongoing AGPLv3 violation draws SFC activism

businessThe Glonce editorsHacker News🔥77Glonce rating77Impact70Novelty60Relevance75Surprise55Players65Credibility85

At the FOSSY 2026 conference, Software Freedom Conservancy (SFC) staff Bradley Kuhn, Karen Sandler, and Denver Gingerich presented on an ongoing license violation by Bambu Lab, a Chinese 3D-printer maker that by 2025 controlled 38-48% of the market for $500-3000 hobbyist printers, depending on the analyst report. Bambu Lab needed a slicer, the software that converts a 3D model into instructions a printer understands, so it shipped a modified fork of PrusaSlicer, itself a fork of Alessandro Ranellucci's AGPLv3-licensed Slic3r, as "Bambu Studio." It did so without releasing the corresponding source or offering to provide it. Community pressure eventually forced a source release around 2022 or 2023, but Kuhn said it was not the actual corresponding source, following what he called a common pattern for first releases from copyleft violators. Bambu Studio prompts users to download "a little more stuff," offering "Yes" or "Ask me later"; declining leaves parts of the slicer non-functional. What downloads are two proprietary .so files, dynamically loaded via dlopen() calls visible in the released source, that call out over the network to an extensive 3D application running on Bambu Lab's own servers. Access is gated by a User-Agent string identical across all clients, which the company describes as a DMCA anti-circumvention mechanism. Kuhn argued this is precisely the mechanism the AGPLv3 was written to close off: a company cannot keep part of its Affero-GPLed application proprietary by running it on its own server instead of shipping it. A Polish user, Pawel Jarczak, reverse-engineered the User-Agent string and network code; Bambu Lab responded with a DMCA takedown that GitHub honored. Jarczak continues maintaining the code in his fork, OrcaSlicer, which SFC now mirrors as part of its "baltobu" project aimed at building working alternatives. Gingerich added that Bambu Lab separately violates GPLv2 by not providing source for a Buildroot-based Linux and other copyleft components in some printers' firmware; he downloaded a 300MB firmware image from Bambu Lab's site and found no source or offer of it. Sandler said the episode has pulled an unusually large number of newcomers into the FOSS and copyleft world, with YouTubers and Reddit commenters explaining the licenses to audiences who had never engaged with them before. Asked how to make Bambu Lab comply, Gingerich pointed to SFC's contract-law-based lawsuit against Vizio (now owned by Walmart) as one enforcement model, alongside the more traditional route of suing as a copyright holder. SFC ran a fundraiser tied to this work that exceeded its stated $250,000 goal, though the source does not state by how much.

Key facts

  • Bambu Lab controlled 38-48% of the $500-3000 hobbyist 3D-printer market by 2025, depending on the analyst report, after entering during the COVID-era hobby boom.
  • Its Bambu Studio slicer is a fork of the AGPLv3-licensed Slic3r/PrusaSlicer lineage; Bambu Lab shipped it without corresponding source, and a source release forced by community pressure around 2022-2023 was, per Bradley Kuhn, not the actual corresponding code.
  • The slicer dynamically loads proprietary .so files that call a Bambu Lab server using a shared User-Agent string the company calls a DMCA anti-circumvention mechanism, which SFC says is exactly the network loophole the AGPLv3 closes.
  • Denver Gingerich also found Bambu Lab has not released source for a Buildroot-based Linux and other GPLv2 components in some printers' 300MB firmware images.
  • SFC mirrors a reverse-engineered alternative, OrcaSlicer by Poland's Pawel Jarczak, under its baltobu project, after GitHub honored a Bambu Lab DMCA takedown against his work.

Why it matters

The case is notable less for the violation itself, common enough in the copyleft world, than for the mechanism Bambu Lab is accused of using: a proprietary network component the AGPLv3 was specifically written to prevent companies from keeping off-client. Bradley Kuhn framed it directly: a company cannot run part of an Affero-GPLed application on its own server and keep that part closed. Denver Gingerich cast the moment as a rare opportunity for the FOSS community to claw back the control that copyleft licenses were meant to guarantee, rather than let a well-funded company use community-built code, PrusaSlicer's lineage in particular, while sidestepping the obligations that came with it.

Who it affects

Bambu Lab's own customers, who cannot get functioning slicer features without agreeing to a proprietary download tied to a closed server component, and the wider hobbyist 3D-printing community built around Slic3r and its roughly 18 active forks, including PrusaSlicer and Josef Prusa's company. It also affects the broader FOSS and copyleft world: SFC's Karen Sandler said the episode has drawn in an unusually large number of newcomers who had never previously engaged with free-software licensing, via YouTube explainers and Reddit discussion.

How to use it

Users who want to avoid the proprietary component can move to OrcaSlicer, the fork maintained by Pawel Jarczak that reverse-engineered Bambu Lab's User-Agent gate, which SFC now mirrors through its baltobu project after Bambu Lab had it taken down from GitHub via DMCA. SFC also ran a fundraiser tied to this work that exceeded its $250,000 goal, which readers can look up directly for ways to support the effort.

How solid is it

The account comes from an LWN report on a named, on-record conference session at FOSSY 2026, with three SFC staff, Bradley Kuhn, Karen Sandler, and Denver Gingerich, speaking on the record and Gingerich describing his own technical findings, including downloading and inspecting Bambu Lab's firmware image directly. Kuhn explicitly flagged as unconfirmed a rumor that Bambu Lab has ties to the Chinese government, and the piece is transparent that Bambu Lab's first source release, once forced, was still not the actual corresponding code, a specific and checkable claim rather than a vague accusation.

Risks and caveats

Bambu Lab's alleged ties to the Chinese government are explicitly described in the source as a rumor, not confirmed fact. No lawsuit against Bambu Lab has been filed as of this talk; Gingerich cited SFC's Vizio suit only as one possible enforcement model, and Kuhn noted that companies in this position typically neither fight nor concede, they simply stop responding. No compliance timeline is given, and the source material available for this piece cuts off mid-sentence during the fundraiser discussion, so any further detail on the fundraiser's final total or next steps is not available here.

“You can't put part of your Affero-GPLed application on your web server and keep it proprietary”

— Bradley Kuhn, Software Freedom Conservancy