😳😳 So I procrastinated and did a quick check on the AGPL license compliance of the other big Chinese players slicers... Why did I even do it? 😔
❌ FlashForge FlashStudio (Orca-Flashforge)
- FlashNetwork binary blob networking.
❌ ElegooSlicer
- agora_rtm_sdk binary blob networking.
❌ AnycubicSlicerNext
- libbambu_networking and second unknown networking binary???
❌ CrealityPrint
- libbambu_networking and binary blob cr_tpms without source.
What is more interesting is that AnycubicSlicerNext and CrealityPrint both fetch libbambu_networking.
Creality downloads libbambu_networking binary blob for Bambu users, but doesn't check for any signatures, just runs whatever the server (they don't control) provide ☠️ I think that's CWE-494? 😬 cr_tpms is a binary blob without corresponding source code violating AGPL.
Also in the light of recent days... Will they get a C&D for the libbambu use?
At first AnycubicSlicerNext looks like it's actually using libbambu_networking. But after looking at the binary it seems like their releases have sneaky unknown cloud_sdk and telemetry baked in somewhere in the build process, without any mention in the public repo? 😳 This needs a bit more time.
What is up with the closed source black box networking obsession? You can do it easily with open source libraries, don't deal with licensing and don't risk bad PR and liabilities. Just why? Technical negligence or regulatory requirements?
@josefprusa Don't worry Josef, we're still here. Bensor and me dropped out of the 3D printing business around 2014, when the market was rolled over with too cheap parts (Nicht nur günstig, sondern billig). In December I talked with Kliment about it and he also wanted to start sth. new
@certbund@sec_consult Das ist doch uralt und seit Ewigkeiten bekannt, dass das geht? Wir haben uns als Kinder schon solche Nachrichten mit falschem Absender geschickt und uns einen Spaß daraus gemacht. Das ist bestimmt schon 25-30 Jahre her..