If your Steam client is missing images (broken image icon) in the store or other pages then try this fix. First exit the Steam client. Then delete the HTML cache directory at ~/.steam/config/htmlcache. Then start the client and browse to the problem page again. The missing images should be reloaded from the server and display correctly.
The tilde "~" is terminal shorthand for your home directory but you can use any file manager instead of a terminal. A file or directory that starts with a period like ".steam" makes it a hidden directory so you'll have to configure your file manager to show them (Ctrl-H toggles the setting in most file managers).
20141007
Workarounds for some game bit-rot on [A-Z]*Ubuntu 14.04
After upgrading to Xubuntu 14.04 x86_64 several games failed to work including Torchlight (from Humble Indie Bundle 6), Doom3, Quake 4, and Aquaria. I had expected this because bit-rot is a common problem with closed-source games when upgrading.
Aquaria and Doom3 segfaulted. Quake 4 failed to load textures and its log reported r600_dri.so problems. These all had the same cause - the libs they included were incompatible with the newer libs being loaded automatically from the OS. They also had the same solution - rename the included libs. On Quake 4 that included libgcc_s.so.1, libSDL-1.2.id.so.0, and libstdc++.so.6. To determine where a dynamic binary is getting libraries from use the ldd command but only change those necessary to get it working else other compatibility problems may occur.
Torchlight would load but the cursor had a black box around it and none of the menu buttons could be clicked. The only way out of it was Alt-F4. Past experience had taught me that libSDL is a common culprit. It was using version 2, the same that Ubuntu 12.04/Linux Mint 13 supplied, but the game worked without problems on them. I suspected that changes to the lib since (or its dependencies) then had created an incompatibility so I simply copied the lib from 12.04 to the 14.04 system and put it in /usr/local/games/Torchlight/lib64. The game started without problems.
Using different library versions works if they haven't changed much. The better solution is recompiling the game with newer libraries but getting developers to do that with old closed-source games is difficult. While fixing library problems is not n00b-friendly, it's trivial compared to what is required for getting old Loki Software games working.
Aquaria and Doom3 segfaulted. Quake 4 failed to load textures and its log reported r600_dri.so problems. These all had the same cause - the libs they included were incompatible with the newer libs being loaded automatically from the OS. They also had the same solution - rename the included libs. On Quake 4 that included libgcc_s.so.1, libSDL-1.2.id.so.0, and libstdc++.so.6. To determine where a dynamic binary is getting libraries from use the ldd command but only change those necessary to get it working else other compatibility problems may occur.
Torchlight would load but the cursor had a black box around it and none of the menu buttons could be clicked. The only way out of it was Alt-F4. Past experience had taught me that libSDL is a common culprit. It was using version 2, the same that Ubuntu 12.04/Linux Mint 13 supplied, but the game worked without problems on them. I suspected that changes to the lib since (or its dependencies) then had created an incompatibility so I simply copied the lib from 12.04 to the 14.04 system and put it in /usr/local/games/Torchlight/lib64. The game started without problems.
Using different library versions works if they haven't changed much. The better solution is recompiling the game with newer libraries but getting developers to do that with old closed-source games is difficult. While fixing library problems is not n00b-friendly, it's trivial compared to what is required for getting old Loki Software games working.
20140829
Wgetting to the correct file name
One of the annoyances of using wget in scripts is the problem of files from some web sites being named "index.html" instead of the actual file name. This is due to the use of the content-disposition header field (part of MIME) to indicate the file name instead of the URL. Support for this field by wget is incomplete and disabled by default.
There are a few ways around this. The easiest is to tell wget to look for it with the --content-disposition option.
Another option is to use curl --remote-header-name or aria2 instead of wget.
To easily create commands for more complicated file retrieval (with cookies, etc.) the Firefox add-on cliget can provide a command line for curl, wget, and aria2 in the opening download window. It only shows the curl command line by default. You can enable the others in cliget preferences (available in the cliget entry in about:addons).
There are a few ways around this. The easiest is to tell wget to look for it with the --content-disposition option.
Another option is to use curl --remote-header-name or aria2 instead of wget.
To easily create commands for more complicated file retrieval (with cookies, etc.) the Firefox add-on cliget can provide a command line for curl, wget, and aria2 in the opening download window. It only shows the curl command line by default. You can enable the others in cliget preferences (available in the cliget entry in about:addons).
20140411
The Heartbleed Bug and You
TL;DR: Most web sites have been leaking passwords due to a bug for the past two years. Immediately change your Internet passwords for Email and financial accounts, even if you changed your passwords April 7, 2014 or in the days preceding. Don't use the same password for all sites because if one is compromised, they all are even if some sites were not affected by the bug. Use a password manager such as KeePass/KeePassX or Password Safe to keep track of them. Don't click on links in emails, especially any that seem to come from your bank asking to change your password. Go to your bank's web site directly by entering the address in your web browser manually.
Verbose Version
You may have seen reports about the Heartbleed Internet bug in the news lately. Note that the term "bug" doesn't mean malware or a virus, just an unintentional flaw. This particular bug is a vulnerability in the encryption system used by about 2/3rds of the Internet web sites. Ignoring the hype, on a scale of 1 (ignore) to 10 (critical) this is an 11. Read this through entirely before panicking.
The bug allows an attacker to potentially obtain passwords from web sites or the credentials of the web site itself (possibly for creating a fake web site that validates as authentic). Most web server operators can detect if they have the vulnerablity but not if someone exploited it. While there are lists of affected sites and test services that can tell if a web site is affected, there are so many that it's best to assume most sites you have passwords on were exploited. Microsoft's web sites were NOT affected since they have their own encryption system, nor were web sites operating with their software (not that they haven't had many other security problems). But it's difficult for web users to determine what software a site is using now or what was used previously. The software you are using on your computer, tablet, or phone doesn't matter since the vulnerability affects the servers you connect to.
What to do? Immediately change your passwords. You should change them periodically anyways, at least once a year depending on how complicated and long they are. Log into your account there and look for a password change option. Sometimes this option is on the account's "profile" or "preferences" page.
If you change your password on a site that is still affected the benefit will be temporary since an attacker can just obtain it again. Many of the affected web sites have been fixed in the past two days but even those that were safe at the time the bug was found may have already been exploited if they were vulnerable any time in the past two years when the bug was introduced.
You can expect to start receiving notices from major companies about the need to change your passwords. Don't wait for them to contact you. Some web site operators may underestimate the risk or be reluctant to announce it due to liability concerns.
Because of the size of the problem you can also expect fake emails (phishing) prompting you to change your passwords. These are attempts to get your current passwords. To avoid being caught by these never click on a link in an email. Always go to the web site directly by entering the web site address into the web browser's address bar or by searching for the company by name using Google.
I suggest prioritizing password changes as follows. Some web sites and vendor names are listed as examples but not all of them had the Heartbleed vulnerability.
1. Email (Google/Gmail, Yahoo!). Do these first since they can be used to reset passwords on most other web site accounts. If your email provider has other services (Google+, Google Docs, Yahoo! Groups) then changing your email password usually changes it for everything else from them.
Google password change: https://www.google.com/settings/security
Yahoo! password change: https://edit.yahoo.com/config/change_pw
2. Financial (banks, credit unions, investments, IRAs, pensions, PayPal)
3. Government (healthcare.gov, passports, social security, taxes)
4. Password services (a.k.a. "Single Sign-On"). If you are using a service that controls access to multiple web sites (OpenID, Facebook, Google), then change that too since a breach with it can affect multiple sites. Usually these aren't used for financial and government sites so the potential damage is less but they affect many other web sites.
5. Any site that stores your credit card or financial information (Amazon.com and accounting sites like Mint.com).
6. Vendors (insurance, medical) and utilities (power, phone, Internet) that have your Social Security number or you have set up for automatic bill payments.
7. Any site that makes payments to you (eBay, Etsy, Freelancer.com).
8. Computer remote backup services. These usually don't have the encryption key for reading the contents of your backup data but someone with your password may be able to delete your backups. If your encryption key was weak (short and simple), an attacker that obtains your backup data via your password may be able to break the encryption key by trying every possible key combination.
9. File hosting services (Dropbox, MediaFire, Google Drive). An attacker can install malware within the hosted files and spread it to everyone that accesses them.
10. Social networking sites (Twitter, Linked-In, Reddit, dating) and picture hosting sites (Imgur, Panaramio, Photobucket) are less important but worth changing if you have information on them that you want to keep private.
11. Passwords for blogs and web sites you have made should be changed to prevent them from being used to host malware.
Vendors that don't keep your credit card info (i.e., you have to enter it every time you buy something) are less of a risk but you should consider changing those of vendors you depend on the most and keep an eye on your credit card statements.
Passwords used for starting your computer or unlocking your phone are probably not affected.
Some wireless Internet sharing boxes (routers) you may have in your home or business have built-in web servers for configring them and many are affected by the Heartbleed vulnerability. Fortunately the configuration web site ususally can't be accessed by people on the Internet unless the device is intentionally configured to allow remote access. Unfortunately manufacturers aren't likely to fix any that have the problem.
Some security systems and home automation systems also have web access and can be affected. If you have a system that you can control from a web browser (on your computer or phone), then contact the manufacturer or installer to verify it and get it fixed if necessary.
You should not use the same password for multiple sites. If one is compromised, then they all are regardless of which has the Heartbleed bug. Create unique passwords for each and use a password manager program to keep track of them. With a password manager you create a single (preferably long and complicated) master password you can remember. This is used to encrypt its password list. You then use the manager to create complicated random passwords for each web site, preferably random letters and numbers at least 12 characters long. Many web sites accept much longer passwords and typographical characters (@$%*&...) but not all do. You don't have to remember these, just copy and paste them from the password manager as needed.
Many web browsers also have password managers built-in and prompt you to store passwords when you enter them. But these password lists are often not well encrypted which makes it easier for an attacker (or other users of your computer) to obtain them. In addition, if you decide to change web browsers, these password lists can be difficult to transfer. Standalone password managers avoid this problem and can also be used for other codes and non-Internet passwords.
Two popular free password managers for desktop and laptop computers are KeePass and Password Safe. I use KeePassX on Linux and it's installed on every system I build (in the menu: Applications > Accessories > KeePassX). It's compatible with KeePass on Windows. It's available in the repositories of most Linux distributions (Ubuntu, Linux Mint, etc.)
Obviously the password manager will now be the center of your Internet life so it's important to make a backup of its password file, perhaps to a Flash "thumb" drive, and keep it in a safe place. To limit loss in case your computer is burned up in a house fire, keep the backup in a different location like in the house of a relative, your car or a safe deposit box. And don't forget its master password!
Changing many passwords is a pain but don't ignore this critical security problem. The damage is already done and all you can do is prevent further damage to your Internet accounts.
You can panic now.
Verbose Version
You may have seen reports about the Heartbleed Internet bug in the news lately. Note that the term "bug" doesn't mean malware or a virus, just an unintentional flaw. This particular bug is a vulnerability in the encryption system used by about 2/3rds of the Internet web sites. Ignoring the hype, on a scale of 1 (ignore) to 10 (critical) this is an 11. Read this through entirely before panicking.
The bug allows an attacker to potentially obtain passwords from web sites or the credentials of the web site itself (possibly for creating a fake web site that validates as authentic). Most web server operators can detect if they have the vulnerablity but not if someone exploited it. While there are lists of affected sites and test services that can tell if a web site is affected, there are so many that it's best to assume most sites you have passwords on were exploited. Microsoft's web sites were NOT affected since they have their own encryption system, nor were web sites operating with their software (not that they haven't had many other security problems). But it's difficult for web users to determine what software a site is using now or what was used previously. The software you are using on your computer, tablet, or phone doesn't matter since the vulnerability affects the servers you connect to.
What to do? Immediately change your passwords. You should change them periodically anyways, at least once a year depending on how complicated and long they are. Log into your account there and look for a password change option. Sometimes this option is on the account's "profile" or "preferences" page.
If you change your password on a site that is still affected the benefit will be temporary since an attacker can just obtain it again. Many of the affected web sites have been fixed in the past two days but even those that were safe at the time the bug was found may have already been exploited if they were vulnerable any time in the past two years when the bug was introduced.
You can expect to start receiving notices from major companies about the need to change your passwords. Don't wait for them to contact you. Some web site operators may underestimate the risk or be reluctant to announce it due to liability concerns.
Because of the size of the problem you can also expect fake emails (phishing) prompting you to change your passwords. These are attempts to get your current passwords. To avoid being caught by these never click on a link in an email. Always go to the web site directly by entering the web site address into the web browser's address bar or by searching for the company by name using Google.
I suggest prioritizing password changes as follows. Some web sites and vendor names are listed as examples but not all of them had the Heartbleed vulnerability.
1. Email (Google/Gmail, Yahoo!). Do these first since they can be used to reset passwords on most other web site accounts. If your email provider has other services (Google+, Google Docs, Yahoo! Groups) then changing your email password usually changes it for everything else from them.
Google password change: https://www.google.com/settings/security
Yahoo! password change: https://edit.yahoo.com/config/change_pw
2. Financial (banks, credit unions, investments, IRAs, pensions, PayPal)
3. Government (healthcare.gov, passports, social security, taxes)
4. Password services (a.k.a. "Single Sign-On"). If you are using a service that controls access to multiple web sites (OpenID, Facebook, Google), then change that too since a breach with it can affect multiple sites. Usually these aren't used for financial and government sites so the potential damage is less but they affect many other web sites.
5. Any site that stores your credit card or financial information (Amazon.com and accounting sites like Mint.com).
6. Vendors (insurance, medical) and utilities (power, phone, Internet) that have your Social Security number or you have set up for automatic bill payments.
7. Any site that makes payments to you (eBay, Etsy, Freelancer.com).
8. Computer remote backup services. These usually don't have the encryption key for reading the contents of your backup data but someone with your password may be able to delete your backups. If your encryption key was weak (short and simple), an attacker that obtains your backup data via your password may be able to break the encryption key by trying every possible key combination.
9. File hosting services (Dropbox, MediaFire, Google Drive). An attacker can install malware within the hosted files and spread it to everyone that accesses them.
10. Social networking sites (Twitter, Linked-In, Reddit, dating) and picture hosting sites (Imgur, Panaramio, Photobucket) are less important but worth changing if you have information on them that you want to keep private.
11. Passwords for blogs and web sites you have made should be changed to prevent them from being used to host malware.
Vendors that don't keep your credit card info (i.e., you have to enter it every time you buy something) are less of a risk but you should consider changing those of vendors you depend on the most and keep an eye on your credit card statements.
Passwords used for starting your computer or unlocking your phone are probably not affected.
Some wireless Internet sharing boxes (routers) you may have in your home or business have built-in web servers for configring them and many are affected by the Heartbleed vulnerability. Fortunately the configuration web site ususally can't be accessed by people on the Internet unless the device is intentionally configured to allow remote access. Unfortunately manufacturers aren't likely to fix any that have the problem.
Some security systems and home automation systems also have web access and can be affected. If you have a system that you can control from a web browser (on your computer or phone), then contact the manufacturer or installer to verify it and get it fixed if necessary.
You should not use the same password for multiple sites. If one is compromised, then they all are regardless of which has the Heartbleed bug. Create unique passwords for each and use a password manager program to keep track of them. With a password manager you create a single (preferably long and complicated) master password you can remember. This is used to encrypt its password list. You then use the manager to create complicated random passwords for each web site, preferably random letters and numbers at least 12 characters long. Many web sites accept much longer passwords and typographical characters (@$%*&...) but not all do. You don't have to remember these, just copy and paste them from the password manager as needed.
Many web browsers also have password managers built-in and prompt you to store passwords when you enter them. But these password lists are often not well encrypted which makes it easier for an attacker (or other users of your computer) to obtain them. In addition, if you decide to change web browsers, these password lists can be difficult to transfer. Standalone password managers avoid this problem and can also be used for other codes and non-Internet passwords.
Two popular free password managers for desktop and laptop computers are KeePass and Password Safe. I use KeePassX on Linux and it's installed on every system I build (in the menu: Applications > Accessories > KeePassX). It's compatible with KeePass on Windows. It's available in the repositories of most Linux distributions (Ubuntu, Linux Mint, etc.)
Obviously the password manager will now be the center of your Internet life so it's important to make a backup of its password file, perhaps to a Flash "thumb" drive, and keep it in a safe place. To limit loss in case your computer is burned up in a house fire, keep the backup in a different location like in the house of a relative, your car or a safe deposit box. And don't forget its master password!
Changing many passwords is a pain but don't ignore this critical security problem. The damage is already done and all you can do is prevent further damage to your Internet accounts.
You can panic now.
Subscribe to:
Posts (Atom)