final edit: You want real logs instead? add this to your kernel command: drm.panic_screen=kmsg
Kinda funny, kinda neat.
I have no idea what the QR-code might reveal (I could not read it from this picture), so I pixelised it just to be sure.
FWIW I know exactly what happened and did not panic. To reproduce, boot your device with init=/bin/sh, then type exit.
CachyOS
The picture above is generated by Drm panic which is part of the kernel itself, or maybe a separate module. The data in the QR code is the kmsg log.
Not systemd, which wasn't running when that happened.
And it's been around for years; I guess I haven't had a kernel panic in a long time.
The QR code contains the panic stack trace text, directly encoded into a URL and a parameter. When you scan it, it goes to the website, which takes the parameter, decodes it and displays it as plain text.
Personally, I think it's a terrible idea compared to just showing the logs, because now you need internet and a phone with a camera to read a kernel panic log.
Edit: yes, it was Systemd who implemented it.
Nah, systemd-bsod is different and designed to show info about boot failures:
It's rather quite useless.
drm_panic on the other hand has nothing to do with systemd, and is what's shown in OPs post. The link can be quite useful for users to post their issues on bug reports or whatever. But if you know what you're doing, then it's pretty easy to configure it to print text instead.
Also remember, the reason drm_panic exists is because graphical outputs would otherwise freeze during a kernel panic, and not show anything useful.
Thanks for the info, but this is not that.
The picture above is generated by Drm panic which is part of the kernel itself, or maybe a separate module. The data in the QR code is the
kmsglog.Not systemd, which makes sense considering systemd was not running when that happened.
It's a kernel thing, not systemd
That QR code could be helpful, but why can’t we have both? Show me the backtrace and logs, and stick a code in the corner in case I need the Internet’s help.
The QR stacktrace allows a method of copying the information off the machine, which may now be unable to function any longer.
If this error meant you can no longer boot to retrieve the error it’s goin to take you a lot longer to fix it because you have to now find the problem with no clues.
I get it. It’s more descriptive than an error message, and the few kilobytes you can cram into a QR code is great for that.
It sounded like other people were worried about data exfiltration, or disclosure to a third party. I haven’t had a chance to test this. Where does the QR code go?
I disagree. The logs typically do not fit on the screen in text form, especially on low resolutions (like if the system has to fall back on an alternative graphics mode, which tends to happen more frequently in the event of a crash). Granted, a website is not the best possible solution and has the risk of leaking data but at least it is "a" solution. The data is encoded sure, but not in an obfuscated way. If you wanted, you could decode it with other means (for example a dedicated app that scans it).
So it's leaking information about your system to an external site?
That's just what we need.
The theory is that the site just hosts a small JS snippet that locally decodes and shows you your logs.
But yeah, now that you mention it, it would be trivial for the site to get and store the logs, and you wouldn't even notice.
Oh I see. If the URL puts the sensitive information after the anchor, like
https://example.com/bsod#sensitive-info-goes-herethen the browser would never send that part to the server. Everything after the anchor is just used locally by the browser to scroll the page to a specific place (or in this case for the javascript to read and process).You'd need to check every time you scan a QR code though that the
#is in the URL and it's not malformed. Trivially replacing the#with a?would turn the private URL into one that sends all the data in theGETrequest. It's training users to do something risky.Oh and it also assumes that the javascript hasn't been tampered with to upload the data somewhere.
I don't like it.
It's possible to use QR code reader apps that do not automatically go to the WWW.
But who's going to go to that effort on their slab of glass?
I agree that the whole concept of QR code scanning is problematic.
Those who would like to make extra sure their data stays private. On an unrelated note, what kinds of data could be considered confidential in said log?
Yes, well, exactly. You know not every question is a literal question, right?
I was wondering that myself. It's "the kmsg log", something to do with kernel mode switching or "graphics". My guess: the log itself is not problematic, but there might be some metadata added. Or then one creates that metadata by submitting the QR code.
I use URLChecker on Android as my default browser so I can inspect any kind of link before opening it. It's the most useful tool I've found on mobile.
No.
Scanning the QR code (on a different device presumably) might do that though.
It's kinda what QR codes do.
But I agree, it's not a good idea. Because people will scan that code and let their slabs of glass do their thing.