final edit: You want real logs instead? add this to your kernel command: drm.panic_screen=kmsg

Kinda funny, kinda neat.

I have no idea what the QR-code might reveal (I could not read it from this picture), so I pixelised it just to be sure.

FWIW I know exactly what happened and did not panic. To reproduce, boot your device with init=/bin/sh, then type exit.

CachyOS

The picture above is generated by Drm panic which is part of the kernel itself, or maybe a separate module. The data in the QR code is the kmsg log.

Not systemd, which wasn’t running when that happened.

And it’s been around for years; I guess I haven’t had a kernel panic in a long time.

  • black0ut@pawb.social
    51·
    1 day ago

    The theory is that the site just hosts a small JS snippet that locally decodes and shows you your logs.

    But yeah, now that you mention it, it would be trivial for the site to get and store the logs, and you wouldn’t even notice.

    • eleijeep@piefed.socialEnglish
      41·
      1 day ago

      Oh I see. If the URL puts the sensitive information after the anchor, like https://example.com/bsod#sensitive-info-goes-here then the browser would never send that part to the server. Everything after the anchor is just used locally by the browser to scroll the page to a specific place (or in this case for the javascript to read and process).

      You’d need to check every time you scan a QR code though that the # is in the URL and it’s not malformed. Trivially replacing the # with a ? would turn the private URL into one that sends all the data in the GET request. It’s training users to do something risky.

      Oh and it also assumes that the javascript hasn’t been tampered with to upload the data somewhere.

      I don’t like it.

      • A_norny_mousse@piefed.zipOPEnglish
        4·
        1 day ago

        It’s possible to use QR code reader apps that do not automatically go to the WWW.

        But who’s going to go to that effort on their slab of glass?

        I agree that the whole concept of QR code scanning is problematic.

        • LeLachs@lemmy.ml
          3·
          18 hours ago

          But who’s going to go to that effort on their slab of glass?

          Those who would like to make extra sure their data stays private. On an unrelated note, what kinds of data could be considered confidential in said log?

          • A_norny_mousse@piefed.zipOPEnglish
            1·
            7 hours ago

            Those who would like to make extra sure their data stays private.

            Yes, well, exactly. You know not every question is a literal question, right?

            what kinds of data could be considered confidential in said log?

            I was wondering that myself. It’s “the kmsg log”, something to do with kernel mode switching or “graphics”. My guess: the log itself is not problematic, but there might be some metadata added. Or then one creates that metadata by submitting the QR code.

        • b000rg@midwest.socialEnglish
          2·
          20 hours ago

          I use URLChecker on Android as my default browser so I can inspect any kind of link before opening it. It’s the most useful tool I’ve found on mobile.