It's a possibility, but it's not how these kernel panic viewer websites are currently implemented. They do the decoding on the clientside, with the data stored in the URL fragment, which is not sent to the server by default.
Still good to have alternative implementations, though. The Javascript could be silently stealing the URL fragment on only specific requests, so there's no real way to audit it to be sure.
For context, kernel panic QR codes seem to sometimes be encoded as a URL by distros. The panic text is encoded as a numeric parameter. For example:
https://jexposit.fedorapeople.org/drm-panic/#?a=x86_64&v=6.17.0-rc2+&z=640167080454085846813051618361759010657877897271730610040416716330885911862863637865629876538143479424501684305108526815246884351579112416213658591538197326904066495250432477741109137529913891705603204551637814390799863373567102735011646456675550848214802373263012070738317101764828501215130799514552173100464226323283035104742647807880303016111647745731220181725103046725626673798313499244415603609976795733414017504856193883754936010234315170039423982724526624590659186737336223463702[... many many more digits]
It being user-hostile is debatable. It's meant to be friendlier, as described in the Fedora link I shared. Coincidentally though, I got a panic yesterday and my phone wasn't able to scan the QR code, lol, so who knows what the panic was.
The non-QR/textual panics can be restored with a kernel/module parameter.
its not user hostile. As demonstrated here it doesn't require it going to an external service (its just constructed as such to make it easy for users)
its meant to make it easy to extract the panic as unless one has a serial console attached, wont have it in a text form that one can use in any manner.
21 comments
[ 255 ms ] story [ 1146 ms ] threadhttps://www.usenix.org/system/files/usenixsecurity23-han-xin...
https://www.tomsguide.com/computing/online-security/new-qr-c...
Still good to have alternative implementations, though. The Javascript could be silently stealing the URL fragment on only specific requests, so there's no real way to audit it to be sure.
Qr -> URL -> Panic Log
https://discussion.fedoraproject.org/t/f45-change-proposal-d...
Seems this HN post is about having a script to not need someone else's server to decode.
This script is to decode such kernel panics without needing to provide it to an external service.
WTF. A solution for an entirely self-inflicted problem.
Distro and user are separate people. Also a person viewing the QR code is not necessarily the owner of the panicked system.
No, they don't have to be. How did this user-hostile attitude infect Linux too?
Also, a person viewing the QR code is not necessarily the owner of the panicked system.
So what? Stop hiding things from users. If they don't care they don't have to read. If they do, don't make them jump through additional hoops.
The non-QR/textual panics can be restored with a kernel/module parameter.
https://wiki.archlinux.org/title/Kernel#QR_code_on_a_blue_sc...
The QR code can be made to provide the text itself (non-URL-encoded) by rebuilding the kernel with CONFIG_DRM_PANIC_SCREEN_QR_CODE_URL unset.
its meant to make it easy to extract the panic as unless one has a serial console attached, wont have it in a text form that one can use in any manner.