When trying to update my #Debian box today, it would not work because some third-party PGP key had expired:

Err:5 https://deb.librewolf.net bookworm InRelease
  The following signatures were invalid: EXPKEYSIG D29FBD5F93C0CFC3 Malte Jürgens <maltejur@dismail.de>
Reading package lists... Done
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: https://deb.librewolf.net bookworm InRelease: The following signatures were invalid: EXPKEYSIG D29FBD5F93C0CFC3 Malte Jürgens <maltejur@dismail.de>
E: Failed to fetch https://deb.librewolf.net/dists/bookworm/InRelease  The following signatures were invalid: EXPKEYSIG D29FBD5F93C0CFC3 Malte Jürgens <maltejur@dismail.de>
E: Some index files failed to download. They have been ignored, or old ones used instead.

Turns out this is caused by my favourite web browser #LibreWolf which I installed many months ago. In the meantime, the recommended installation method for Debian has changed. So what I had to do to fix this was to remove one file …

sudo rm /etc/apt/sources.list.d/librewolf.sources

… and after that, follow the new installation instructions for Debian.

PS: You should remove more files, LibreWolf's Debian Migration Guide says. I only discovered it now.

RIP #Ryujinx, here is an announcement from the discord server:

“Yesterday, gdkchan was contacted by Nintendo and offered an agreement to stop working on the project, remove the organization and all related assets he's in control of. While awaiting confirmation on whether he would take this agreement, the organization has been removed, so I think it's safe to say what the outcome is. Rather than leave you with only panic and speculation, I decided to write this short message to give some closure.

These words are my own. I don't want to speak for anyone else here, so just remember that while reading.

Thank you to @everyone who has contributed code, documentation or issue reports to the project. Thank you all for following us throughout the development. I was able to learn a lot of really neat things about games that I love, enjoy them with renewed qualities and in unique circumstances, and I'm sure you all have experiences that are similarly special. I'm extending my own massive thanks to our moderation team, who have been here through some rough circumstances and always found ways to make light of it.” -riperiperi, Ryujinx developer

fuck #Nintendo.

@thephd To be fair as far as I can tell Fedora doesn't even ship with cups-browsed enabled by default, nor the firewall hole to allow it inbound UDP.

And then the whole thing is remote code execution... as the lp user. Which on any reasonably configured system shouldn't be able to do things like read your home directory.

And you need to actually print to the printer to trigger it.

If it doesn't affect servers, and it only affects some desktop distros, and it needs user action (and a user action that isn't that common these days), and it's highly unlikely to be triggerable remotely for most desktop systems (firewalled or NATed) so you need LAN access, and at the end of the day it's only code execution as a limited privileges system user... then yeah, it pretty much qualifies as a nothingburger.

Distros will patch this, desktop users will update their system (happens a lot more consistently than servers), and life will move on with most likely zero exploited users.