An ongoing 3D-printer AGPL violation

Welcome to LWN.net

The following subscription-only content has been made available to you by an LWN subscriber. Thousands of subscribers depend on LWN for the best news from the Linux and free software communities. If you enjoy this article, please consider subscribing to LWN. Thank you for visiting LWN.net!

At FOSSY 2026, several people from the Software Freedom Conservancy (SFC), which organizes the conference, gave a presentation about an ongoing violation of the Affero General Public License version 3 (AGPLv3). Bradley Kühn, Karen Sandler, and Denver Gingerich spoke about different aspects of the violation, which is in regard to 3D-printer software from Bambu Lab, and what is being done to try to provide users with alternatives. One aspect that is particularly interesting is that the circumvention that the company is employing is precisely what the AGPL was written to prevent.

Kühn began the session by noting that he has been an activist in the free and open-source software (FOSS) communities for over 30 years and that "this moment in history [...] has more activism opportunities than I have seen in my career". In the past, he and his colleagues have been triaging disasters of various sorts but over the past six to eight months they have been triaging opportunities instead. Sandler added that the opportunities being offered are difficult; "it's not like people are saying 'would you like this money or that money?'".

The opportunities he is describing are not really about money, Kühn said, but provide ways "for activists to get stuff done and to engage people". Over the past six months or so, SFC has successfully engaged with "an entire community of enthusiasts", which only had a passing familiarity with FOSS, on a multitude of freedom-centric topics: "free software, free culture, free creation". That is exciting, but he was getting ahead of himself because that is where the story ends, so he wanted to go back to the beginning.

Backstory

Some time ago, 3D printing was invented, which is something that he watched from afar; a breadboard fire when he was an undergraduate convinced him that he should be a software-only person. He is a fan of the 3D-printing culture, and enjoys the talks that come from it, but he does not participate. As part of the license-violation investigation, he and Gingerich did a crash course in the history of 3D-printing, though Gingerich already had much of the background.

Kühn related some of what he learned, including that the hobbyist 3D-printing field started out as a curiosity. People who wanted a 3D printer had to build one themselves, since there were no already assembled devices on the market. Some of those who built the early printers went on to found companies that now sell 3D printers, which is a key element in the development of the community. Like Linux, 3D printers started as a hobby and remained "a hobby for a long-enough period of time that the hobby culture could not be immediately eradicated by venture capitalists".

The "wonderful thing" about 3D printing is that the people developing the software needed to run the devices looked to the free-software community and "thought twice" before they started picking licenses for their code. An important piece of the tooling needed to use these devices is a program known as a "slicer", which turns a 3D model—some slicers also help build these models—into thin 2D slices that can be converted into the language that the printer hardware understands. He likens that language to assembly language, which is an oversimplification, but helps provide a conceptual framework for him.

A longtime free-software enthusiast, Alessandro Ranellucci, created a slicer, which he called "Slic3r". Kühn said that his only criticism of Ranellucci was his choice of the name, which makes it hard to distinguish between the program and the overall type of program in a talk, so Kühn used "slicer with three" to distinguish them. The two spoke over a video chat and Ranellucci said that he chose the AGPLv3 for Slic3r to try to avoid the mess with Bambu Lab: "I anticipated all this, because my biggest worry was that someone was going to do 'Slic3r as a service'".

While there are 3D printers that use other slicers, it is difficult to find one that is not best used with some fork of Slic3r, Kühn said. There are around 18 active forks, but the most well-known is PrusaSlicer. It came about because a friend of Ranellucci's, Josef Prusa, saw 3D printing as not only just a business opportunity, but "a free-software business opportunity". Prusa built a company based on providing customers with printer plans, free software, free firmware, and so on, Kühn said; that company was the dominant player in the market for a time.

At the same time, a parallel market in 3D printers for manufacturing was developing. These were printers that took up a whole room and cost hundreds of thousands of dollars. Meanwhile, though, the hobbyist printers that cost $500-3000 were "becoming really, really, really good", especially toward the top end of that range.

Enter Bambu

That was the state of the market in 2019 and pre-COVID 2020. During COVID, lots of people picked up hobbies, including 3D printing; that attracted a Chinese company, Bambu Lab, to the market. Kühn said that the company is rumored to have ties to the Chinese government, though that has not been confirmed. It decided to start from scratch and make 3D printers; by 2025, the company controlled 38-48% (depending on the analyst report) of the market for $500-3000 printers. In part, that is because the market for room-sized industrial printers is dying and that customers have realized that they can be replaced with fleets of much cheaper, better, and more reliable printers from companies like Bambu Lab; the company has been targeting that market, along with the hobbyist market, thus its success.

Bambu Lab needed a slicer, of course, so it started shipping a modified PrusaSlicer (as Bambu Studio), which it was able to get via the AGPLv3, but without shipping any source code or an offer to provide it. That continued up through 2022 or 2023, Kühn said, until the pressure from the 3D-printing community effectively forced Bambu Lab to make a source release, which was, as is almost always the case for a first release, not the actual corresponding source code.

"You've got to be amused by the ingenuity of copyleft violators", Kühn said; they often rely on mechanisms that an actual judge is not going to care about. In this case, Bambu Studio would pop up a request to download "a little more stuff" with the classic choices of "Yes" or "Ask me later"; users eventually figure out that some functionality in the slicer does not work until they click "Yes". The extras that are downloaded are two .so files built from C++ source. Those shared-library files are dynamically loaded into the slicer—as can plainly be seen from the dlopen() calls in the source code that was released.

Kühn said that Bambu Studio and all of its components would be considered a combined work under the regular GPLv3, but the company has a network-based component that runs up against the restrictions in the AGPLv3 as well. The dynamically loaded part of the slicer is a thin layer that calls out over the network to an extensive 3D application running on Bambu Lab servers; it passes a "key", which is just a specific User-Agent string, that allows access to the extra functionality on the servers. The company claims that the User-Agent, which is the same for all of the clients, is a DMCA anti-circumvention mechanism.

But, he said, that is exactly what the AGPLv3 is meant to prevent: "You can't put part of your Affero-GPLed application on your web server and keep it proprietary". A 3D-printing user from Poland, Paweł Jarczak, reverse-engineered the User-Agent string and network code, which resulted in a DMCA takedown notice from Bambu Lab. "GitHub, of course, honored it, because Microsoft." Jarczak is still maintaining the code in his slicer (OrcaSlicer), which is being mirrored on an SFC repository as part of its baltobu project that is aimed at working around the Bambu Lab AGPLv3 violations.

Gingerich noted that Bambu Lab is not only violating AGPLv3, but is also violating GPLv2 by not providing the source for a Buildroot-based Linux (and other copyleft components) used in the firmware of some 3D-printer models. He downloaded the 300MB firmware image from the Bambu Lab web site, but was unable to find the source or an offer to provide it.

He said that Bambu Lab comes from a silicon-valley-inspired culture that is being built in China, which includes large venture-capital-like investments into companies. Bambu Lab has deep pockets, which allowed it to leapfrog its competitors in various ways, market its products extensively through social media and the like, and to exert control over the message about its products on forums like Reddit. The company took some of the same shortcuts that silicon-valley companies have taken by "violating copyleft licenses on the way".

Gingerich thinks this situation provides "a very good opportunity" to "take back the control that we are owed by the licenses that they chose to use". Bambu Lab could have spent its investment on "reimplementing things from scratch", but it chose not to; there is a large body of high quality free and open-source software available that "takes a long time to replicate".

Bambu Lab has effectively taken the common "then, sue us" approach to these violations, which is certainly an option, Gingerich said. But various ways to remedy these kinds of problems have different timelines; getting the community involved in reverse-engineering and replacing the proprietary pieces will likely take a lot less time than a lawsuit. Kühn noted that companies in violation never actually say "sue us", instead they just stop responding.

Participation

Sandler said that one of the reasons these violations are so interesting is that they have brought more new people into the FOSS community than any other matter that SFC has worked on over the years. People who had never really heard of copyleft or FOSS are excited about it; now they "realize that these licenses grant rights and that we can do something with it". Normally, when the SFC is talking about these kinds of issues, she said, it is talking to the people in the room, or those who will view the recorded video of the session, which is "a narrow set of people and we struggle to explain what the potential is". But the 3D-printing community has really taken the ball and run with it; "multiple YouTubers were putting out deep explanations" and commenters at Reddit and elsewhere were "getting so excited and saying 'wow, this is what these licenses mean, we should use them more!'".

That left more than ten minutes for audience questions, the first of which was "what would make Bambu follow the AGPL?" Gingerich said that there are variety of approaches, including lawsuits like the SFC's versus Vizio (now owned by Walmart); since copyleft licenses are also contracts, that lawsuit is based on contract law. There is a contract between Vizio/Walmart and the software developers who created the GPLv2 and LGPLv2.1 code that was used in televisions; the SFC (and anyone who buys a Vizio TV) are "third-party beneficiaries" of that contract and the SFC is suing to get the rights that are required by it.

Enforcing contracts in this way is standard practice, Kühn said, but has not been used for the GPL family of contracts as far as they know. The more traditional route to enforcement is to sue as a copyright holder in the code, which is what the SFC has done in the past. There are other mechanisms, including using various trade agreements with their "intellectual property" clauses as a tool. While intellectual-property rules may be distasteful, that is in keeping with the original intent of copyleft: "to take any rule like that, flip it around, and use it to defend software freedom".

In conjunction with its work on 3D printing, the SFC ran a fundraiser that ended up far exceeding the lofty goal of $250,000 that was set, Kühn said; it was "a target that we thought we probably would never make". Sandler said: "we picked a number that we thought we could actually accomplish something significant with it", even though there was a good chance that it would not be reached. "We blew past it and most of our donations were teeny tiny donations", which was exciting. Kühn noted that the SFC is now able to hire a full-time litigation attorney; he encouraged attendees to ensure that the word got out.

Many people think that a GPL license is "magic pixie dust", Sandler said; by choosing the license, it will make people follow it and the problem is solved. That is obviously not the case, which was evident from the emphatic head shakes from attendees. "If nobody holds anybody's feet to the fire, if nobody says 'wait a minute, you're not actually doing this', no one ever will do it."

There are multiple ways to pursue enforcement, which requires some creativity, she said. The SFC is trying to "demonstrate the different ways that you can go about getting companies to do the right thing". She advocates that everyone ask for the complete and corresponding source code for all of the devices they purchase; it will demonstrate that there is consumer demand for those rights. An unhappy YouTube video or thread on Reddit if the source code is not released is also a form of enforcement, she said.

Another question was about whether litigation was an effective tool for enforcement. Gingerich noted that a source release from an enforcement action against Linksys was the first commit for the OpenWrt project. It leads to projects that "help us take control of our devices so they do what we want, and not what the companies that sell them want".

In addition, the house lawyers for companies regularly thank Sandler for lawsuits because it makes their jobs a lot easier, she said. If there are no consequences for violating the license, company lawyers have a hard time ensuring compliance. The business side of the company wants to know what the costs are for violating the license, "without lawsuits, there is no answer to that".

The final question was about fixing the root cause of license violations, which can be interpreted in lots of different ways. Kühn said that fixing societal corruption worldwide was a tall order; the same goes for fixing capitalism, Sandler added. The underlying problem is one of power imbalance, Gingerich said, which is something that FOSS and the larger right-to-repair movements are working against. Sandler closed by saying that the goal of these movements is to attack the root cause by bringing about a better world, with improvements in products, technology, and legislation; that requires getting actively involved and helping non-technical people to become invested in these issues as well. That seems like a rather tall order as well, of course.

[I would like to thank the Linux Foundation, LWN's travel sponsor, for its assistance with my trip to Vancouver for FOSSY.]