Hardware Lock-in: Why You Don't Own Software If You Don't Control the Device

Hardware lock-in is when a vendor uses certification, cloud services, or payment rails to decide what software you're allowed to run on a device you already own. The license or the law might say you have the right. The vendor controls the pipe anyway, and the pipe wins.

Two recent stories make this concrete. Neither is really about phones or 3D printers. Both are about who holds the veto.

How did PayPal and Google use attestation to lock out an operating system?

In July 2023, PayPal permanently locked the donation account belonging to the GrapheneOS Foundation, a nonprofit that builds a privacy-focused, security-hardened Android OS. The account held roughly CA$3,950.75 in donations. PayPal gave no real explanation, just a scripted line about "potential risk," and no path to appeal.¹

That wasn't an isolated glitch. As of the 2025-2026 window, PayPal's own consumer app has become incompatible or unavailable for many GrapheneOS users through the Play Store, and the app no longer shows up as an option for NFC wallet payments on the platform.² A privacy-focused OS user can no longer reliably use PayPal at all, not because of anything they did wrong, but because their phone doesn't present the credentials Google's ecosystem expects.

What is attestation, and why does it matter for software ownership?

The mechanism underneath this is attestation. Google's Play Integrity API and Apple's App Attest let apps check whether a device is running a vendor-certified operating system before granting access. The GrapheneOS Foundation has publicly accused both companies of using this system to lock users into approved hardware and software, warning that it blocks access to "an enormous amount of the web," including banking, digital wallets, and any site gated behind reCAPTCHA.³

Here's the part that should bother you even if you've never heard of GrapheneOS: the underlying hardware attestation standard doesn't require Google's blessing. GrapheneOS supports it directly, and apps that check hardware attestation instead of defaulting to Play Integrity's strict mode can support alternate operating systems just fine.⁴ The exclusion isn't a security necessity. It's a default most developers never question, and a lever Google and Apple can tighten whenever they want.

How did Bambu Lab use an AGPL dispute to threaten a developer?

Swap the phone for a 3D printer and the payment processor for a licensing dispute, and the shape is identical.

Bambu Lab makes popular 3D printers that ship with Bambu Studio, software built partly on AGPLv3-licensed code. The AGPL is explicit: if you distribute code alongside an AGPLv3 project, you have to release the source for it too. The Software Freedom Conservancy found that Bambu never released source code for libbambu_networking, a library bundled with Bambu Studio for roughly four years.⁵

When developer Paweł Jarczak built an OrcaSlicer fork that let users talk to Bambu's cloud without touching the proprietary library, using only Bambu's own incomplete public source as a guide, Bambu Lab sent legal threats demanding he take it down and prepared a cease-and-desist letter.⁶ Bambu's stated position was that its terms of service override the AGPL. SFC calls that claim itself a license violation, since the AGPL explicitly forbids adding restrictions on top of the rights it grants.⁵

SFC has since launched a $250,007 fundraiser and a project called baltobu to reverse-engineer the networking library, maintain an OrcaSlicer fork, and fork Bambu Studio itself, specifically to restore rights that buyers already had on hardware they already own.⁵

The common mechanism: certification, cloud, and terms of service as kill switches

Strip away the industry-specific details and both cases run the same play:

1. Control the chokepoint. A gatekeeper controls something the user depends on — a payment processor, a cloud sync service, an attestation API — that sits between the user and the thing they already own.
2. Skip the argument. The vendor doesn't need to win a case about rights. PayPal never had to prove GrapheneOS was risky. Bambu never had to win an AGPL case in court. They just revoked access.
3. Let terms of service do the work law can't. Bambu's claim that its ToS overrides the AGPL is the clearest version of this, but Google and Apple's attestation defaults do the same thing quietly, by making the legally irrelevant question "is this OS certified" functionally decisive.

Owning the software, or having the legal right to modify and redistribute it, means nothing if someone else controls the wire it has to travel over to be useful.

Is this really new? No, it's the John Deere playbook, generalized

John Deere ran this play first, and got caught. The FTC and five states secured a 10-year settlement requiring Deere to give farmers and independent repair shops the same repair software and diagnostic access it gives authorized dealers, resolving claims that Deere used software control to maintain a repair monopoly.⁷

EFF's framing of that case applies just as well to phones and printers: "if you can't fix it, you don't own it... whether it's farm equipment, a car, a laptop, or even your phone... if you must go hat in hand to an 'approved provider,' you are at the mercy of a corporation."⁸ Swap "fix" for "run the software you choose on" and you have this article. The lesson from agriculture is arriving late to consumer electronics, but it's arriving. All 50 states have introduced some form of right-to-repair legislation, and six, including New York, California, Minnesota, Oregon, Colorado, and Washington, have enacted laws.⁹

What does real software ownership actually require?

Regulation is catching up, but slowly and unevenly. In the meantime, ownership that holds up under pressure needs a few concrete things:

• Unlocked hardware. Bootloaders and alternate operating systems shouldn't be a theoretical option buried in developer settings. They need to be a first-class, warranty-safe path.
• Attestation that checks hardware, not vendor approval. GrapheneOS already supports the standard that would make this possible. The fix is app developers defaulting to it instead of Play Integrity's strict mode.⁴
• Licenses that get enforced, not just written. The AGPL only protects you if someone funds the work of chasing violations, which is exactly what SFC's fundraiser is trying to do.⁵
• Regulatory pressure that treats lock-in as antitrust, not contract law. The FTC treated Deere's repair monopoly as a consumer-protection issue, not a private dispute the vendor gets to win by default.⁷

Most of us have already made this trade without noticing. We treat a phone, a printer, or a piece of farm equipment as something we own outright, when what we actually hold is a lease with extra steps, revocable the moment a company decides our software choices are inconvenient. Real ownership means the device answers to you first. Until certification and cloud chokepoints stop working as backdoor veto power, that's not what most of us have. It's also why the shift toward self-hosted, owned infrastructure, whether that's running your own AI agents instead of renting access through someone else's gated platform, keeps showing up as the more durable answer across every version of this fight.