final edit: You want real logs instead? add this to your kernel command: drm.panic_screen=kmsg

Kinda funny, kinda neat.

I have no idea what the QR-code might reveal (I could not read it from this picture), so I pixelised it just to be sure.

FWIW I know exactly what happened and did not panic. To reproduce, boot your device with init=/bin/sh, then type exit.

CachyOS

The picture above is generated by Drm panic which is part of the kernel itself, or maybe a separate module. The data in the QR code is the kmsg log.

Not systemd, which wasn’t running when that happened.

And it’s been around for years; I guess I haven’t had a kernel panic in a long time.

  • eleijeep@piefed.socialEnglish
    41·
    24 hours ago

    Oh I see. If the URL puts the sensitive information after the anchor, like https://example.com/bsod#sensitive-info-goes-here then the browser would never send that part to the server. Everything after the anchor is just used locally by the browser to scroll the page to a specific place (or in this case for the javascript to read and process).

    You’d need to check every time you scan a QR code though that the # is in the URL and it’s not malformed. Trivially replacing the # with a ? would turn the private URL into one that sends all the data in the GET request. It’s training users to do something risky.

    Oh and it also assumes that the javascript hasn’t been tampered with to upload the data somewhere.

    I don’t like it.

    • A_norny_mousse@piefed.zipOPEnglish
      4·
      22 hours ago

      It’s possible to use QR code reader apps that do not automatically go to the WWW.

      But who’s going to go to that effort on their slab of glass?

      I agree that the whole concept of QR code scanning is problematic.

      • LeLachs@lemmy.ml
        3·
        16 hours ago

        But who’s going to go to that effort on their slab of glass?

        Those who would like to make extra sure their data stays private. On an unrelated note, what kinds of data could be considered confidential in said log?

        • A_norny_mousse@piefed.zipOPEnglish
          1·
          4 hours ago

          Those who would like to make extra sure their data stays private.

          Yes, well, exactly. You know not every question is a literal question, right?

          what kinds of data could be considered confidential in said log?

          I was wondering that myself. It’s “the kmsg log”, something to do with kernel mode switching or “graphics”. My guess: the log itself is not problematic, but there might be some metadata added. Or then one creates that metadata by submitting the QR code.

      • b000rg@midwest.socialEnglish
        2·
        18 hours ago

        I use URLChecker on Android as my default browser so I can inspect any kind of link before opening it. It’s the most useful tool I’ve found on mobile.