Dont use gcode you didnt slice yourself  

RE: Dont use gcode you didnt slice yourself

apparently this is mentioned on Meltzone Podcast Ep14, didn't make it that far in the podcast, but guess im not the only one with this feeling. 

RE: Dont use gcode you didnt slice yourself

I believe it'd be rather easy for the prusaprinter.org to automatically verify the gcode doesn't do anything evil by checking temps against the material type, doing a quick simulation of the movements to ensure the printer doesn't hit already extruded objects. Perhaps they should look into that.

In any case, even with what you describe, you'd probably make a big mess out of the printer, a lot of bad smell by heating the PLA above its chemical stability range, but I don't think you can actually start a fire. The printer has internal constraints on how it'll follow the gcode commands.

I believe having pre-sliced objects for download is a significant value to people without too much experience, but perhaps sharing the Slic3r projects would be a better way to go than the gcode output. Both for safety and because being able to examine and change the project has a lot more educational value than just plugging a gcode file into the printer and waiting for a print to appear.

RE: Dont use gcode you didnt slice yourself

yeap, all valid points, im working on a proof on concept model. and will post it on my web page. the way im going to do it, is not going to show anything out of the ordinary i hope since it will require such a small edit randomly in the gcode so the end result will  still be "the model". . the idea of it being a project output is good. 
still , ive done a load of tuning for my M'crapperhackers roll of petg so it prints properly. whos to say you are not using the same filament i am, how would gcode for meltink's pla work when im using something totally different, extrusion multiplier, fan speeds, bed temp, ext temp, speed, ANY variable you can think. this is where the noob pitfall will be. and where learning basic functions of a slicer is a better option. 
welcome to a mind that still has to think as a blackhat. 

RE: Dont use gcode you didnt slice yourself

Posted by: Migamix

yeap, all valid points, im working on a proof on concept model. and will post it on my web page. the way im going to do it, is not going to show anything out of the ordinary i hope since it will require such a small edit randomly in the gcode so the end result will  still be "the model". 

If you manage to create a gcode that seems innocent, yet will wreak havoc with the printer, I'd definitely like to take a look and analyze it.

welcome to a mind that still has to think as a blackhat. 

I generally try to avoid that. 🙂 There is so many exploitable gaps literally everywhere ...

RE: Dont use gcode you didnt slice yourself

Posted by: Migamix

yeap, all valid points, im working on a proof on concept model.

Somebody posted code that works in one of the early Reddit posts on this topics. Basically, set the 0 position as something higher, then go to 0 and you drive the nozzle into the bed. While the software extent limits work for preventing normal moves from going below 0, this did allow potential damage. I didn't care to test any more. Not sure if you could do any damage with over-temps, but you can definitely hose the print surface.

I'm also not comfortable with downloading gcode compiled by unknown parties. If anything, I could see some value in Prusa providing cloud-based slicing. Let anybody who uploads a model select from a short list of known-good parameters, the generate the gcode up on the Prusa cloud. They maintain control of the profiles, while contributors can select parameters for good results. This is probably a better teaching tool for new users as well. Rather than "just trust my gcode", they could look at settings that work online before trying to slice it themselves.

RE: Dont use gcode you didnt slice yourself

I’m not even thinking about malicious gcode, but also the tweaks for particular printers and filament brands. Could someone else’s perfect gcode be sub-optimal on my printer, and maybe even bad enough to overextrude, maybe I need higher bed temps to get good adhesion... sounds like a recipe for a Blob of Death to me...

RE: Dont use gcode you didnt slice yourself

I think generated gcode can be very useful. Especially if it's provided by an experienced guy who exactly knows the weak/strong spots on his model.  You can easily gain reputation by providing correct and good gcode and also loose everything by making bad gcode. With the reward system it can become pretty safe and beneficial for everybody. 

What I also don't like is the negative 'no-gcode' flag. I think it would be better to have a positive 'ready to print' flag. 

RE: Dont use gcode you didnt slice yourself

I just think it's creepy. 

RE: Dont use gcode you didnt slice yourself

You know, for me, I don't even print using gcode that I don't remember when I generated it. I save the project files (.3mf files) to save how I printed something. Then later when I want to re-print I load the project file, make sure the profiles have my latest and greatest changes, and regenerate g-code.

RE: Dont use gcode you didnt slice yourself

Posted by: Sembazuru

You know, for me, I don't even print using gcode that I don't remember when I generated it. I save the project files (.3mf files) to save how I printed something. Then later when I want to re-print I load the project file, make sure the profiles have my latest and greatest changes, and regenerate g-code.

That's a better idea all around because the new user downloading the 3MF will be able to see the settings you used in their own software instead of just dumbly printing what someone else set up. Unfortunately, unless something has changed, I don't think it's even possible to upload a .3MF.

RE: Dont use gcode you didnt slice yourself

The printing of G-code generated by a third party with multiple filaments (I am thinking MMU here) is a complete nonsense.  The purge values for different filaments can differ tremendously.

And as already mentioned, the possibility malicious code resulting in (at best) printer damage is present.

As for uploading 3MF files, well some of us want to use slicers that work better than Slic3r.

I think the only third-party G-code I would ever print is with a new printer to test out and only then use the files provided on an SD card.

There have been a couple of occasions when I have uploaded G-code files for users to test MMU filament changes and to print temperature towers (which was difficult to do in Slic3r), but that's about it.

So, for me, a good old STL file is all I need.

Peter

RE: Dont use gcode you didnt slice yourself

I absolutely agree with Migamix.

I never printed any downloaded g-code. The only exception was when I found the 3D printer gcode printer test on the i3MK3S SD.Printing  a gcode on your 3D printer is like running a downloaded program on your PC. You have to take and assume the risks.

There are thousands of good open source software that we use.  But almost nobody download their sources, verify the signature, compile them personally, and install and execute on the PC. Almost 99.99999999% of people just download the executable and install/run it.

What is the difference ?     TRUST.

There are some authors and sites that we trust, and we know that there is a reasonable certainly that the application is as it was written by the author (and we trust him).

We trust PRUSA when we install a new firmware, or when we download and install software tool like Slic3R.

But, there are lot and lots of download sites that offer the same applications, and we just do not trust them since they can have tampered the applications with viruses, and we would never download and install something from them.

So, in my opinion, PRUSA to win the game, should be able to ensure the "safety" of the g-code. This is a significant effort in IT infrastructure, since they would need to build a gcode simulator and semantic analyser,  and a "virtual printer" simulator that analyse and "pass" any g-code before being released publicly.

Only in this way they will be able to become a role player that ENSURE all the gcodes they publish are genuine and safe.

Someone could say, we are doing the advocate of the devil, but the history is full of people that had just put "12345" as password thinking that "nobody will guest that I just put a so silly password, so it is secure!".

Imagine the viral mess on social media if some hackers starts to put malicious g-codes on the models...

I don't think Prusa want to be in all newspaper pages for that 😉 

So I strong advice Prusa to build such IT infrastructure control, and at least start to put LEGAL DISCLAIMER near the g-code download.

Regards

RE: Dont use gcode you didnt slice yourself

Posted by: PJR

As for uploading 3MF files, well some of us want to use slicers that work better than Slic3r.

[...]

There have been a couple of occasions when I have uploaded G-code files for users to test MMU filament changes and to print temperature towers (which was difficult to do in Slic3r), but that's about it.

So, for me, a good old STL file is all I need.

Peter

Sometimes the only way to reliably represent how I printed something would be to have the project .3mf file. That file not only includes the three profile settings, but any modifiers and sometimes multiple STL files that I've "stitched" together in Slic3r, and in the case of temperature towers the custom g-code with if statements. (Would be nice if the new color separator function of the development versions was flexible enough to optionally be something other than a filament change. Until then custom g-code is the most elegant way of changing temperatures based on layer number.).

That said, the primary feature of the project files that I save is for myself. On the "other" site I upload my source model file (usually FreeCAD), the STL file (either straight out of FreeCAD, or after a cleanup pass in Meshmixer), and the 3mf project file. I try to remember to describe in the "thing" description the versions of the programs used to generate the uploaded files. It's not my problem if the downloaders don't use the programs that I used to make the files, I do recognize that not everyone uses the programs that I use so I like to provide enough files to cover a cross section of available programs.

Now one of the things that needs to be fixed on the Prussa model site is to open up the filetypes allowed. At very minimum the 3mf files (on the assumption that at least half the users will still be using the provided Slic3rPE), but also source files (Fusion360, FreeCAD, etc) because it is much easier to modify the source file than the generated STL... Maybe even allow Step files and/or other solid model interchange formats so I could have a chance at modifying your F360 in FreeCAD as solid objects (and vice versa, you modify my FreeCAD file in F360) instead of only having a mesh...

I do agree with the start of this thread that gcode downloads can potentially be a vector for mischief. Prusa (as the host) should flag suspect gcode to the uploader so they can fix or remove it, and in the mean time disallow other users to download the suspect gcode. Repeated violations should be investigated by a human to determine if the violations are either intentional (and then lead to banning) or accidental (and then lead to probation until the issue is determined solved).

I was, at first, going to suggest the server to automatically sanitize gcode, but I don't think the service should be automatically modifying anything that is uploaded. That would lead down a slippery slope and erode trust.

RE: Dont use gcode you didnt slice yourself

8

 sounds like a valid use of posting G codes to me. Perhaps your premise needs rework.

RE: Dont use gcode you didnt slice yourself

Posted by: jerry.s3

8

 sounds like a valid use of posting G codes to me. Perhaps your premise needs rework.

Would you mind elaborating just a bit?

RE: Dont use gcode you didnt slice yourself

My Google skills are failing me. What are ignition temperatures for the filaments?

I'm guessing they are above 305°C that we have as a limit on stock printers.

RE: Dont use gcode you didnt slice yourself

I googled a bit:

• PLA 388 ºC
• ABS 416°C
• HIPS 427°C
• PETG 454°C
• PEI 535°C
• PC 580°C

Exact temperatures may vary depending on filament composition by tens of degrees.

RE: Dont use gcode you didnt slice yourself

Ditch G-code and replace with .3MF "projects" for PrusaSlicer.

Generic 'catch all' G-code is near useless these days with all the different versions, different filaments, and the potential for malicious printer torture. From Prusa, sure, but elsewhere.. hmm.

RE: Dont use gcode you didnt slice yourself

I totally agree with that. In my case, I never remember all the parameters of my own g-codes, and I make a new one for each print !!!