back to article Opera update plugs heap big buffer overflow bug

Opera has fixed three potentially nasty security vulnerabilities with the release of a major new version of its web browser software. A heap buffer overflow bug involving the string to number conversion technology in previous versions of Opera created a means to inject hostile code onto vulnerable systems. Opera version 10.10 …

COMMENTS

This topic is closed for new posts.
  1. Anonymous Coward
    Happy

    Opera Problems...

    ..probably Microsoft's fault?

  2. MarkOne
    Thumb Up

    Just just best Opera yet..

    Best browser yet...

  3. Patrick O'Reilly
    Thumb Up

    Queue the Opera Bashers *Yawn*

    Bash Opera all you want they still make a great browser, giving users the same great performance not matter what OS or device they are using.

    Sure they've been at it a long time and still have a relatively small user base, unsurprisingly given they are up against Microsoft's built-in browser and the marketing power of Google's Chome.

    Opera Unite isn't for everyone but it is still only in it's infancy and could prove pretty useful in the not too distant future.

  4. Toastan Buttar
    WTF?

    Bu..buu...bbbbbuuuuut

    I thought Opera was the Bestest Browser Ever and you'd have to be the victim of a cruel medical experiment to choose any other.

  5. Christoph
    FAIL

    Great security update!

    What a great idea - this security update includes the ability to open up your hard disk to the web for anyone to access.

    And when you get the announcement screen for the new version, see the new feature, and click on that to see what it does, it doesn't bother telling you about it it just starts downloading it! Lucky I noticed in time to cancel.

  6. Whitter
    Thumb Down

    What's good for the goose

    I'm annoyed that major new functionality was released at the same time as a significant bug-fix. What if I don't want Unite on my system? What if my IT department want to have a look at such functionality in my system before OKing it or not? If MS or Apple were to do similar there would be widespread anger - Opera users should (though probably won't) be complaining ASAP.

    1. Anonymous Coward
      FAIL

      Pathetic

      If you don't want Unite, just don't use it. It's DISABLED BY DEFAULT.

      Only morons would complain about something that is even disabled by default.

  7. Anonymous Coward
    Thumb Up

    @Toastan Buttar

    No, that would be Firefox, which is why it has such a superior track record to any other browser these days :-)

    Opera Unite is better than I expected. It's actually quite good and more enticing than widgets! In fact, I wonder if at some stage they'll merge widgets and Unite into one general 'thing', because widgets are similar to apps, just without the third-party interactivity.

    It wasn't quite as easy to get up and running as I expected though, but it wasn't hard, especially if you want to leave all the default settings.

    I like the media streaming app, but it's a bit ugly and clunky. The functionality is good, it just needs a proper UI like the 'media player' app already has.

    Nice to see the HTML5-based whiteboard app even works in modern versions of Firefox.

    The web server app seems very simple and easy to use. Even someone's dotty grandmother could run and admin it.

    Hopefully we'll see the list of apps grow soon, just as it did for widgets. It's still new so thare are a limited number of apps at the moment, but it looks very promising so far. Whether it's a success depends on the fickle public's reaction to being offered interactive apps for their own computer. Given the way they take to Facebook, Twitter and YouTube, it's possible they'll love Unite. Or they might lose interest when they realise the computer needs to be on for it to work and is throttled by their own unload speeds. I don't think anyone can tell what people will do. Logic and reason would have led any sensible person to rule out just about every major website from the last 5 years ever taking off!

  8. Anonymous Coward
    Grenade

    (title)

    @Whitter: If you go to the Opera Forums you will see that we are complaining loudly about Unite. It has been shoved into the browser without any clear enough rules about disabling it. It takes digging into the forum to find all the ways to turn Unite and the Webserver off. For sysadmins there is one ini file that can be dropped into \Windows\System32\ which can act as an overall kill file.

    It is annoying to see an old and loyal friend like Opera try and ape Facebook and other such saddo sites. Even more frustrating is that the Opera Devs posting on the forum don't seem to twig why we don't want this Social Networking stuff in our Web Browser.

    1. Anonymous Coward
      FAIL

      fail

      It's disabled by default, numbnuts.

      And Unite is NOT supposed to ape Facebook. Get a clue.

  9. Charlie Clark Silver badge
    Thumb Up

    Unite is useful

    I've been playing with some of the apps - DocumentCourier is particularly useful. I've recently received and made large files (> 100 MB) available.

    I do agree that the security fixes should be available separately.

  10. Roby
    Thumb Down

    How to get even less people to use Opera...

    ...forcibly bundle Opera Unite with the browser, with no option not to install it. Now your browser is also a web server, file sharing app etc. Just what you wanted your browser to do.

    Seriously bad move imo.

    1. Anonymous Coward
      FAIL

      How to be a moron

      Opera isn't forcing anything or anyone. Unite is disabled by default.

      You are clueless.

  11. Whitter

    Responses

    @AC#2 You mean there are widgits worth using? Well done if you found any. I thought they were up for the chop in future Opera plans, but I may have misread that.

    @AC#3 It's not obvious, but one of those complainers was me!

  12. Ross 7

    blah

    Re: the Opera bashers - well one browser has to be the best (it being a relative term), and whilst I am not saying here that Opera is the best, whichever browser is has security updates. So really your comments are a fat waste of electrons.

    Regarding the alleged security issue with Unite - if you have that problem then Unite is by far the tiniest risk to your system. Anyone that joined the C21st will have hardware firewalling. If you don't then your system (especially a Windows one) is wide open to exploitation by any number of worms.

    The biggest issue would therefore be the extra CPU cycles it eats waiting for packets that can never arrive. Anyone got any numbers on that?...

  13. Dave 129

    Still out on Unite

    I tried it in the previous betas, and for me it's pretty pointless though I can see some utility for those people who want to send large files and who would usually go for email (baulk!).

    On the other hand, I recently switched to Operas M2 mail client, and despite some initial reservations I have to say I am pleasantly surprised. It's a little clunky in places, but it does everything I want out of a mail client - and it's cross-platform.

    @Whitter re: widgets; I think the plan is to make them standalone and no longer tied to the browser window itself so they can float on the OS desktop. Well that was my understanding. I still think they should be dropped altogether. Never found anything of use out of them. Perhaps a better plugin framework would be good, but with that said when I use Firefox plugins it is to bring Firefox up to the default level of functionality that Opera has... read into that what you want ;)

  14. windywoo
    Unhappy

    What if your IT department want to have a look at it?

    If your IT department want to have a say in such things why have they given you permissions to install software at all? Why have you updated Opera without telling them first? Why all this fuss about it anyway? Its disabled by default, no security risks until YOU turn it on. Your OS has web server capabilities but as is the case with Opera they are turned off by default. Are you going to complain that Windows or Linux are insecure because of features they CAN have?

  15. MarkOne
    FAIL

    @Whitter @AC

    Are you retarded or something? It's disabled by default, If you do nothing, it works the same was as non-Unite Opera.

    Jesus. I suggest you stop using computers, and clearly you are too thick to comprehend basic principles...

  16. Steve 72

    Still a long way for Opera to go...

    to achieve a 44% ownership of browser exploits year to date though.

    (And it wasn't even IE that achieved that little gem).

    Ref:http://www.theregister.co.uk/2009/11/10/web_security_survey/

  17. CC
    Thumb Down

    Opera's Status Quo...."It's Standards Compliant"

    They still haven't made a decent browser since version 7.23 that can do media or just get you from site A to site B without messing up and they still offer the same lame excuses for why their doesn't work and everyone elses does...their's are not standards compliant like Opera.

    Year after year they keep bringing out new groundbreaking features and year after year they still can't make their browser do what everyone elses has been doing for years....browse.

    1. Anonymous Coward
      FAIL

      Stop spreading this insane myth.

      "they still offer the same lame excuses for why their doesn't work and everyone elses does...their's are not standards compliant like Opera"

      This is a blatant lie. It is quite the opposite: They are clearly saying that Opera was designed from the ground up to handle badly coded sites, and they ask you to report any sites that aren't working to them, so that they can fix it.

      Most of the time, sites break because of browser sniffing, not Opera's imagined inability to handle bad code.

      "Year after year they keep bringing out new groundbreaking features and year after year they still can't make their browser do what everyone elses has been doing for years....browse."

      Your ignorance is amazing. Do you really think compatibility is that simple? If it was, then Chrome would have been working with Gmail, and IE8 wouldn't have to fall back to the IE7 engine for thousands of sites.

      You need to stop spreading the insane myth that Opera's standards compliance prevents compatibility, and that Opera blames sites for not being standards compliant.

  18. Anonymous Coward
    WTF?

    Whine, whine, whine

    @Whitter: "What if I don't want Unite on my system?"

    Ah, just dont' use it? If you don't actually enable it, it stays disabled and out of your way.

    @Roby: "forcibly bundle Opera Unite with the browser, with no option not to install it"

    It's disabled by default. If you don't enable it, you'll never even know that it's there.

  19. Anonymous Coward
    FAIL

    Aping facebook? Social networking in the browser?

    "It is annoying to see an old and loyal friend like Opera try and ape Facebook and other such saddo sites."

    "Even more frustrating is that the Opera Devs posting on the forum don't seem to twig why we don't want this Social Networking stuff in our Web Browser."

    WOW. Talk about missing the point!

    Unite is NOT an attempt to ape Facebook. Opera already has the My Opera site for social networking.

    Unite is about letting computers connect directly to each other, and without having to use special clients on both ends.

    If you don't want to use it, just don't enable it! It's as simple as that.

  20. Anonymous Coward
    Anonymous Coward

    Missing something?

    Am I missing something or is opera unite disabled by default and requiring of not just an opt in by browser, but an opt-in by log in account to opera?

    Without this, nothing runs.

    Or is it the mere fact that some functionality you don't want has been included in your browser that has you enraged?

  21. Pete 6
    WTF?

    Unite actually works well

    Been using it for a while in the betas and it beats the hell out of mucking about with flaky file transfers over IM programs. It's not enabled by default, so what's to complain about?

  22. MarkOne
    FAIL

    Just to throw a spanner in the works

    of the Microsoft employees here, or the Firefox wanktards, Unite is disabled by default. Hardly a security hole, if you are too stupid to understand it, you are too stupid to start it.

    Anyway, only smart people use Opera, all the clueless idiots follow the myth that opensauce is secure and live in Firefix cuckoo land.

    As for useful widgets, there are quite a few. The Twitter one is very good, the Youtube video downloader, the daily crossword are ones that get regular use for me.

    As for dropping them, thats just wishful thinking, a recent labs release showed Opera Widgets unchained from the browser, as proper desktop apps.

    http://labs.opera.com/news/2009/10/15/

    1. MarkOne
      Alert

      Lo and Behold

      Opera 10.20 Alpha with Widgets as proper desktop applications:

      http://my.opera.com/desktopteam/blog/opera-10-20-goes-alpha

  23. Anonymous Coward
    FAIL

    Re: Opera's Status Quo...."It's Standards Compliant"

    "they still offer the same lame excuses for why their doesn't work and everyone elses does...their's are not standards compliant like Opera"

    This is a blatant lie. It is quite the opposite: They are clearly saying that Opera was designed from the ground up to handle badly coded sites, and they ask you to report any sites that aren't working to them, so that they can fix it.

    Most of the time, sites break because of browser sniffing, not Opera's imagined inability to handle bad code.

    "Year after year they keep bringing out new groundbreaking features and year after year they still can't make their browser do what everyone elses has been doing for years....browse."

    Your ignorance is amazing. Do you really think compatibility is that simple? If it was, then Chrome would have been working with Gmail, and IE8 wouldn't have to fall back to the IE7 engine for thousands of sites.

    You need to stop spreading the insane myth that Opera's standards compliance prevents compatibility, and that Opera blames sites for not being standards compliant.

  24. Anonymous Coward
    Anonymous Coward

    Lots of hot air

    The comments here really do highlight how lots of people just mindlessly click the comment button and throw in their tuppence without knowing what they're talking about. They use technical terms such as 'CPU cycles' to sound authoritative when it's clear they've never even bothered to look at what they're commenting about.

    And this is the same for most messageboards and social networking sites. People just gush mental diarrhoea based upon which flag they've chosen to align themselves with rather than the merrits or failures of the matter at hand.

    No wonder Opera wanted to help people cut the crap and share things with their real friends directly.

    And as an aside, how come The Register didn't run an article about Opera's work on hardware accelerated rendering when it was first shown in a YouTube video a few years ago, or when it was given a proper announcement a few months ago? The IE team said they've been playing with things for a few days and get blanket coverage.

  25. Relgoshan
    Grenade

    Omigod It's A Bomb!

    Case in point: Would an army stop using grenades "because they explode"? No, they'll issue them to everyone "because they explode", and trust the soldiers are smart enough to know this WON'T HAPPEN until you pull the pin.

    Unite is like a very safe grenade that can't even explode in your hand. The biggest danger is if you serve a virus-tainted file to other people, which is not Opera's fault. Running chat? You can set a login password and kick abusive posters. Got a fridge? Delete unwanted comments. No problem at all.

    Unite cannot work until you set it up, so there are no holes and no wasted cycles there.

This topic is closed for new posts.

Other stories you might like