final edit: You want real logs instead? add this to your kernel command: drm.panic_screen=kmsg
Kinda funny, kinda neat.
I have no idea what the QR-code might reveal (I could not read it from this picture), so I pixelised it just to be sure.
FWIW I know exactly what happened and did not panic. To reproduce, boot your device with init=/bin/sh, then type exit.
CachyOS
The picture above is generated by Drm panic which is part of the kernel itself, or maybe a separate module. The data in the QR code is the kmsg log.
Not systemd, which wasn't running when that happened.
And it's been around for years; I guess I haven't had a kernel panic in a long time.
So it's leaking information about your system to an external site?
That's just what we need.
The theory is that the site just hosts a small JS snippet that locally decodes and shows you your logs.
But yeah, now that you mention it, it would be trivial for the site to get and store the logs, and you wouldn't even notice.
Oh I see. If the URL puts the sensitive information after the anchor, like
https://example.com/bsod#sensitive-info-goes-herethen the browser would never send that part to the server. Everything after the anchor is just used locally by the browser to scroll the page to a specific place (or in this case for the javascript to read and process).You'd need to check every time you scan a QR code though that the
#is in the URL and it's not malformed. Trivially replacing the#with a?would turn the private URL into one that sends all the data in theGETrequest. It's training users to do something risky.Oh and it also assumes that the javascript hasn't been tampered with to upload the data somewhere.
I don't like it.
It's possible to use QR code reader apps that do not automatically go to the WWW.
But who's going to go to that effort on their slab of glass?
I agree that the whole concept of QR code scanning is problematic.
Those who would like to make extra sure their data stays private. On an unrelated note, what kinds of data could be considered confidential in said log?
Yes, well, exactly. You know not every question is a literal question, right?
I was wondering that myself. It's "the kmsg log", something to do with kernel mode switching or "graphics". My guess: the log itself is not problematic, but there might be some metadata added. Or then one creates that metadata by submitting the QR code.
I use URLChecker on Android as my default browser so I can inspect any kind of link before opening it. It's the most useful tool I've found on mobile.
No.
Scanning the QR code (on a different device presumably) might do that though.
It's kinda what QR codes do.
But I agree, it's not a good idea. Because people will scan that code and let their slabs of glass do their thing.