OctoPrint on Air delayed, so here's a written update for you (Patreon)

Hey there! After I finally pushed out 1.10.0 and now also 1.10.1 with a security fix, the original plan was to finally also record a new OctoPrint on Air.

However, I'm getting some new neighbors here and apparently they are renovating their apartment, at least based on the quite loud power drilling and hammering sounds in the house. I hope the recording situation will soon resolve itself, but until it does, here's a written update for now...

So, first of all, what have I been up to? Since the last OctoPrint on Air I released 1.10.0rc4 on April 8th and then the stable 1.10.0 on April 24th. The RC phase all in all continued to be quite uneventful, which is a really good thing. I still pushed out 1.10.0 with some known issues which had been reported after the code freeze, and as they weren't regressions I decided against fixing them in the RC phase and instead planned their fixes for a bug fix release.

Which I already knew I'd have to anyhow due to a high security issue I had gotten reported in March. The problem here was that if you had autologin enabled (not the default) the authentication could be bypassed by spoofing the IP via an HTTP header. This has now been fixed in 1.10.1, but the fix was a bit more complicated. I didn't want to risk issues with the 1.10.0 stable release by pushing this out with it last minute, and it being a rather nasty issue I also couldn't make it public prior to a stable release being available, as that could have put people at risk. So I decided to push it out pretty much right after 1.10.0, after making sure that was a stable one first.

Alongside the security issue I also fixed all of the known issues mentioned in 1.10.0's change log with 1.10.1. And I rolled back the switch of a third party dependency we had done for 1.10.0. We saw some issues caused by the new replacement dependency netifaces2, especially where no compiled wheel was already available. This might also have been the reason for some issues observed with the 1.10.0 OctoPi-UpToDate image build on Raspberry Pi Zero Ws. While OctoPrint doesn't support the Raspberry Pi Zero W (it is terribly underpowered thanks to how its wifi interface is attached internally), it was still weird that on the new image things completely stopped working - and rolling back solved that as I checked myself. I'll look at going back to netifaces2 in a future version though, as netifaces is no longer maintained. Or I might look at a Python only implementation I spotted on PyPI, we'll see. For now at least, that issues is solved.

Now, you might also remember that I discovered a security issue in OrcaSlicer, which I mentioned last time - that happened to also be present in BambuStudio, and now that the people at Bambu have released a fixed (beta) version I can finally talk about that properly. As a reminder, both OrcaSlicer and BambuStudio would happily leak your OctoPrint or other host API keys in their generated GCODE files, if you had configured their host integration. That could get nasty in case of shared GCODE files (as e.g. sometimes uploaded on printables.com). To warn affected people about this I also updated the bundled FileCheck plugin to scan for leaked credentials in your GCODE files and show you a warning if something is found. Those credentials will btw not magically unleak themselves - you'll need to remove and reslice affected files with a fixed version of either slicer - and should obviously also rotate your API keys if you are affected.

And after all of this, now, what are the next steps? Some work has already started on 1.11.0 - originally that should have happened sooner, but 1.10.x took way more time than anticipated. That's also the reason why I haven't gotten a chance to look at the current blocking camera stack issue, so nothing new here sadly - those tasks are still on the TODO list.

But I have the news to share that I'll be two events in the near future!

The first one will be the GPN in Karlsruhe later this month. That will be more of personal rather than a work thing for me, but still, if you see me there and want to say hi, feel free to do so!

The other one with be the EuroPython conference in Prague at the start of July. It's now been five years since my last in-person Python event, and I've never been to EuroPython (in-person) so far, so I figured it's time. I'm really looking forward to meeting some people and also plenty of talks and chats on all things Python, learning new stuff, tools, language features and so on. That will be some exhausting but amazing days I think! And of course, should you also end up there, also feel free to say hi!

Now, that's all that I had planned to talk about in the next OctoPrint on Air episode. If I get around to recording that soon, it will have pretty much the same content, but we'll have to see how that goes 😅

In any case, I hope an update in this shape is a good compromise while a recording is currently not working out thanks to circumstances, and it was interesting even though in a different form than usual 🙂