Been auditing the black box that is Bambu's networking plugin, thanks to the repo that Rossman is re-hosting for the creator of Orca. It definitely has some interesting behaviors so far, and I can see why they wouldn't want this plugin functional outside of their remote Bambu forest.
Firstly, let's catch some knowledgable printers, who are dunning-krugering themselves over cybersecurity and software, up to speed.
The special sauce of the controversial fork is a custom shim that managed to circumvent the blocks Bambu put in place which have previously made their CLOSED SOURCE libbambu_networking.{so,dylib,dll} plugin non-functional outside of Bambu Studio.
I stress this again, despite the repo being FOSS, the code downloads libbambu_networking which is NOT open source, so this type of analysis does need preformed if a deeper understanding of Bambu's network operations is to be gained.
-----------------
Instrumenting the slicer-side calls shows useful boundaries like connect, send message, start print, local print, SD card print, tracking, and cloud publish. Orca has Bambu telemetry disabled by default.
Attempts to attach debuggers / Frida directly to the plugin appear to trigger a deliberate crash at 0xdead, which strongly suggests anti-debugging or anti-instrumentation behavior. This happens regardless of the presence of any breakpoints or the number of hooks.
The networking library is probably using some combo of ptrace detection + code integrity checking to determine if it should kill the app. A legitimate printer networking library has no justified reason for this behavior.
Through some custom debug logging on the slicer side, we can indeed see that Bambu sends off telemetry as soon as you slice or upload project documents, as long as your account is logged in. There's an argument to be made that this allows for the "Google Docs" level of autosave, but It's worth pointing out regardless.
I'll have to implement a deeper testing strategy to see what else it's sending off, but from Wireshark captures the bambu networking plugin appears to be sending off your g-code to their servers before you even hit print.