back to article Cloud load balancer snafu leads to 3D printer user printing on a stranger's kit

A 3D printer remote monitoring company accidentally exposed users' printers to each other after a cloud reconfiguration snafu. Just over 70 of The Spaghetti Detective's users were able to control others' devices as a result – something the service said it doesn't normally allow to happen. "I made a stupid mistake last night …

  1. karlkarl Silver badge

    OK, at least that "cloud" system in place is there for a reason.

    I was half expecting to find out that many 3D printers have strict DRM that connect to the vendors restriction servers before they allow the machine to function. That way when the company goes out of business, they can ensure no-one can benefit from the hardware any longer.

    Cautiously going to say, glad that isn't the case :)

    1. chuBb.

      Even with DRM wouldnt be difficult to swap the controller board out for something friendlier, there are only so many ways you can connect stepper motors and thermo-couples...

      And given the meta hobby of pissing about with your 3d printer to get it to work as advertised i doubt a board swap would deter many hobbyists

      1. Stuart Castle Silver badge

        Might not deter many hobbyists. What about companies who have bought their 3D printers so their designers can do test prints of things like product designs. A designer probably won’t have the knowledge required to muck around with pcbs.

        Or even design schools buying 3D printers for student use. You really don’t want students messing around with things like that.

    2. J. Cook Silver badge
      Go

      You mean like several other models that had an RFID chip in the filament spools and refused to use the spool unless it could read the chip, and which kept track of how much filament was used from the spool and refused to let one spool fresh filament to it?

      or the current generations of Makerbot, which have reduced the hot end to a proprietary module and has become user-hostile to people who want to mod them?

      Or other printers that are dependant on a cloud server to drip-feed them commands, because the controller boards don't have engough grunt or a smart enough firmware to process gcode?

      Or all the various ideas that have been floated to try and limit what people can print on their machines? (I have a separate rant about this one and copyright, but that's out of scope for the moment.)

      1. karlkarl Silver badge

        err, yeah exactly those.

        Damn, I didn't imagine there were so many crooked attempts of this kind of shite :(

        1. imanidiot Silver badge

          Unfortunately yes.

          Fortunately with the cost of todays basic electronics for running a 3d printer being fairly low (though prone to rise due to fab capacity shortages) the proprietary solutions are very often more expensive and more shit than the free alternatives. There's little my fairly stock Creality Ender 3 couldn't do that a much, much more expensive "closed source" printer does.

          1. Anonymous Coward
            Anonymous Coward

            "prone to rise due to fab capacity shortages"

            If only we had a way to fairly cheaply make our own parts at home... too bad the printers can't make circuit boards (yet).

    3. This post has been deleted by its author

    4. Stuart Castle Silver badge

      Re “ I was half expecting to find out that many 3D printers have strict DRM that connect to the vendors restriction servers”

      Ahh, the unnecessary drm. Reminds me of a kickstarter project called “Juicero”. The project was essentially a Wi-Fi connected juice press that used its own bags of juice, each of which was rfid equipped (apparently this was so the company could ensure freshness). Iirc it was a subscription service and the user got so many bags a month..

      Unnecessary drm. Us humans are perfectly capable of looking a a best before date. We don’t need to be told we can’t eat or drink something after that date.

      1. J. Cook Silver badge
        Coat

        The people behind Juicero were also into the 'raw water' movement, which is a good way to give yourself food poisoning or worse by drinking untreated, unprocessed water without any form of removing any potential bacteria or other nasties in it.

        Not the best product idea in the world, unless you were looking to 'juice' your customers of their money...

  2. RichardBarrell

    Using the IP address for authentication and authorization like that seems like a slightly hazardous plan to me. Ignoring the idea of deliberately spoofing IP addresses, there's the fact that CGNAT is deployed in the wild. This means we already see public IP addresses shared between different people as a matter of course. We should expect the use of CGNAT will be expanding every year in the future as IPv4 address space gets more expensive.

    1. Anonymous Coward
      Anonymous Coward

      Its a problem with makers in my opinion, shun whats come before reinvent at every turn and cut corners through ignorance (there are some very good ones, i my self am a self described maker, but some of the dangerous crap wiring, crap design and wilful disregard of safety features has soured my opinion)

      Double whammy of that when you combine cloud with makers, relying on IP just reinforces my opinion that they "know enough to be dangerous"

      Again if makers used real tools or bothered to understand the 40 odd years of automated Design Rule Checks and CNC and CAD in general 99% of failed 3d prints could be avoided, most of the time it comes down to forgetting to cut the feed to the extruder and moving or just not understanding the tolerances of the machine your using, million and one ways of detecting both with no need to invoke the "give me money" buzzword of AI, but rather than invest in the makers experience the software suppliers instead tries and hides necessary complexity so that people can cling to the 2012 dream of extruded plastic somehow being a startrek replicator and presenting a big pastel coloured print button

      1. MisterHappy

        Not so much a problem with "Makers" as such, I have a 3d printer churning away quite happily.

        However I use a VPN connection back into my home network if I want to check on things when I am away. The issue is more Joe public and "You can do this using the cloud".

        Someone brings up TSD as a remote monitoring tool at least once a week on various 3d printing forums & it's about 70% "It's great, I love it" to 30% "Use a vpn, this sh*t isn't secure"

        1. Anonymous Coward
          Anonymous Coward

          I disagree, half of the problem with 3d printers is that they have been maker made and designed, and then joe public buys them.

          If i had a pound for every time i see simple 3axis machine guaranteed to need fettling back to tolerances after half a print because rather than get a farnell/RS account and buy say nylon sprockets the maker chooses to print them instead, or use sort of true threaded rod in place of a ballscrew or acme thread with backlash adjustment and instead rely on the thread cut into plastic to provide precise movement.

          I admit things have improved but when i started building machines 20 odd years ago, my starting point was ripping apart old printers and using battle proven bits, i mean if its survived 20 years in a dot matrix printer printing daily then its probably gonna be just fine in my rinkydink desktop milling machines. Im more surprised that the high street hasnt been filled with 3d print shops, taking the place of where colour photo copier facilities were in the 90's....

          1. cornetman Silver badge

            > Im more surprised that the high street hasnt been filled with 3d print shops, taking the place of where colour photo copier facilities were in the 90's....

            It kinda has actually, it's just not in the high street.

            There are plenty of people out there with 3D printing farms making money from orders for small run parts.

            It's the kind of thing that I wouldn't mind getting into myself.

            Most recent, off-the-shelf 3D printers these days are extraordinarily good and the problem de jour is that they are all getting a bit samey and many are just Creality Ender 3 clones. If people can just get their head around the basics (keep your bed clean and level and take the time to get the first layer spacing right, understand the printer's limitations), they are actually very reliable and you can do some really cool things.

            1. cornetman Silver badge

              I should add that I do actually have a Creality Ender 3 V2 printer at home. Got it direct from Creality at their recent Father's Day sale for a sweet price of $212 Canadian with free shipping (a *lot* less than they are on Amazon for).

              New to the field, I was having a lot of trouble getting some prints to stick properly and they would mess up when starting some small details on the bed. Installing Jyer's firmware to it and setting up a bed mesh was a revelation and I would *strongly* recommend everyone that has one of these machines to do the same. The glass bed is not completely flat and has a pronounced dip in the middle which meant that detail printed in the middle of the bed wouldn't stick properly. The bed mesh means that the firmware can follow a non-flat bed profile by applying height adjustments interpolated between the levelling points.

              Once I got that sorted, it really is start-the-print and leave it by and large. I would recommend everyone that likes to tinker to get one. They really are a lot of fun.

              1. chuBb.

                Heh didnt take long for my meta hobby comment further up to be validated ;)

                1. J. Cook Silver badge

                  Yep.

                  My first was a printrbot simple metal I put togather from a box o parts. it was decent enough for 2014. It got a few factory (and non-factory) mods and replacement parts put into it, but what killed it was the hot end dying, combined with printrbot as a company going casters up.

                  I tried to refurbish a flashforge dreamer, but hit the wall of "for the amount of money I need to sink into it for replacement parts, I can buy a new one" so I did. my CR-6 has been more or less solid for me, Although the Community firmware for it blows the factory firmware out of the water in terms of features and usability. (that is one of two mods I've done, the second was hard-wiring a power cord to the supply and trashing the power entrance that blew out on me and is listed as a "known issue" with the first-gen run of that model...)

                2. cornetman Silver badge

                  > Heh didnt take long for my meta hobby comment further up to be validated ;)

                  You're not wrong really.

                  I think most of the complaints that I have seen about the machine that I have seen are along the lines of "the stock, uncustomised firmware would have been much better that this monstrosity that it came with". IIRC this 3rd party Jyer's firmware is just Marlin with all the cool features switched back on and honestly I don't really understand that. Why make a machine that is deliberately hobbled when it doesn't even really compete with your other models?

                  Which manufacturer wouldn't want to hear reviews saying, "this machine is perfect for the price"?

                  1. chuBb.

                    Same reason as cisco, ms, oracle etc does, money printing through software licensing

                    And reducing the support burden when bumblefuck the unlearned fiddles with things they don't understand burns the house down and still bitches on the forum that they couldn't get the hello world cube to print

  3. DJV Silver badge
    Happy

    I fully expect this story to return here as a "Who Me?" in a few years time with Kenneth Jiang's name Regomised to Shirley or something equally inappropriate!

    1. bombastic bob Silver badge
      Coat

      I'm thinking of a scenario where a Custom Adult Toy maker sends a design to a 3D printer, only it's someone ELSE's printer, maybe at a school. That'd TRULY be a "cock up".

      1. chuBb.

        id be more surprised if a school 3d printer wasnt printing phalluses

      2. SuperGeek

        "I'm thinking of a scenario where a Custom Adult Toy maker sends a design to a 3D printer, only it's someone ELSE's printer, maybe at a school. That'd TRULY be a "cock up".

        And a dil-DOH! moment for Homer!!

  4. Adrian 4
    WTF?

    signing

    'Coalfire pointed out was the apparent lack of signing for firmware updates, meaning anyone could install any binary to the device."

    I'd consider that a basic requirement of any such device. Why would I want a machine I couldn't fix ?

    1. John Brown (no body) Silver badge

      Re: signing

      So long the "anyone" installing "any binary" can only be a local user, and not some stranger elsewhere on the Internet at large.

  5. This post has been deleted by its author

  6. Rob F

    I experienced a similar NAT problem about a decade ago

    A security engineer installed a new Barracuda appliance at a community college. The next day I get a call out that their SBS server had crashed and no mail was being sent or received and the SBS was generally not serving requests.

    When I looked at the system, the mail queue had 300k objects and I had to halt all services just to stop things crashing. I did a lot of cleanup, which I won't bore you with the details of. I then investigated wtf happened and it turned out that the Barracuda had NATd all public SMTP delivery to appear as an internal IP to the Exchange server. The problem is that the college had previously put in a SMTP relay configuration that trusted all internal IPs. Some spammers had quickly identified this and smashed it to send out their payloads. The public IP finally got blacklisted and I had to then go through the fun of getting them whitelisted through all the PBLs etc.

    Security had managed to make the environment worse, but did fix it afterwards.

  7. MachDiamond Silver badge

    Not gonna connect to the cloud

    I've worked in several industries where divulging designs was not only against company policy but against the law. This has made me very suspicious of any bit of kit that must have a connection to the Net to work. Not only that, I don't want the status of my internet connection to dictate whether I can get work done or not. The reliability at home this summer has been horrible. It shouldn't be an issue anyway. Big CNC machines work just fine without having to phone home so why can't a piddly little 3D printer? The electronics are dirt cheap compared to 30 years ago when I bought my first CNC mill. The main board in that mill was the price of a good used car to replace. Fortunately, I was able to find where the magic smoke came out and replace that cap rather than get a refurbed board after I found out what that would cost. These days, a full set of motor controllers is the price of a nice dinner date with drinks (no desert). A low end PC to drive them is dang near free.

  8. FlamingDeath Silver badge

    First name: Not

    Last name: Sure

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon