The World Bank Institute, the learning arm of the World Bank, has launched an online computer game called EVOKE, designed to get young people involved in finding solutions to urgent problems like hunger, poverty and education. The winners of the ten week game could be mentored by social innovators and business leaders and win a trip to a conference in Washington DC. :up:

Bob Hawkins, the producer of the game says:

"We have designed the game so that it is compatible with Opera Mini which is a browser that you can use on your cell phones," he said. "We mirror the content into Facebook which is a very popular application for students and young people on their mobile phone."

Opera Mini is huge in Africa and it's cool to see games and Web sites render perfectly in Opera Mini. :yes:

You should also read our "Why Opera Mini is important in Africa" article.

Today is an exciting day here at the Opera Mini team. Early this
morning Opera Mini 5 beta was released for Android. It's available now
in the Android Market!

Opera Mini 5 beta for Android is finally here! Featuring all your favorite Opera features such as Speed Dial, tabbed browsing, compression, speed and a smooth design.

We know many of you have been waiting a long time to get Opera Mini for Android, so we're very excited to hear what you think of it!

We want your aid in picking a new header for the Opera Brasil group blog! For a time now, Opera fans in Brasil has created some really cool blog headers, and we're ready to pick one to represent the new look and feel of the blog. :)

All we want you to do is have a look in the photo album and let us know about your favorite header as a comment. :yes:

Executive Summary

The original report about the Windows-only malformed Content-Length header problem is not a security issue, but a variant of the issue, brought to our attention by Secunia, has a theoretical possibility of allowing arbitrary code to run. We have developed a fix for the problem, which is being tested, and are planning to release an update of Opera soon. Until then, if Opera crashes on an untrusted site, you should avoid visiting that site again.

Details

March 4th, just days after the release of Opera 10.50, we learned about a crasher and possible security issue posted the day before to an online vulnerability database. Many security sites reposted this information, claiming it was a buffer overflow.

This crasher used a very large number in the Content-Length HTTP header to trigger the crash. In fact, the number used was much larger than was necessary to trigger the crash. It was over 5000 digits long, but 20 digits would have been enough. This excessive length would prove to be a bit of a distraction when we analyzed the issue.

We quickly determined what was causing the problem: The incorrect use of a signed integer length data type, not properly checking conversion errors, and not limiting the result to only positive values. We could then develop a fix for the problem. We also determined that this example was not exploitable, since it would always trigger an attempt to copy Opera's entire memory (up to 4 GB on 32-bit, much more on 64-bit) from one location to another, an operation that will always crash in a non-exploitable fashion once the copy operation runs into an area of the memory address-space that has not been allocated.

This was the first information available to us, and we passed our preliminary evaluation to several of the security sites, asking if they had any more information. We also made this evaluation available to press inquiries and users, without making a official post about it.

But the size of the test-case had blinded us to one possibility, brought to our attention by Secunia the next day, which existed due to the aforementioned signed integer use: A value in the range is 2⁶³ to 2⁶⁴-1 was returned as a valid number, despite being outside the signed data-range of the compiler provided conversion function (so it should have triggered an error instead), and as a result a negative value was returned in the range -2⁶³ to -1.

This is a much worse scenario than what we were looking at initially. In a 64 bit environment this would still crash, but in a 32 bit environment it would allow the configuration of any copy length the malicious server operator desired, and it could potentially be used to move memory from one location to another without crashing, provided the specified length was not too long. However, the fix we had already developed would also fix this problem.

This is not a buffer overflow, at least in the normal sense of the term, but it would cause memory corruption, and the question was whether or not the resulting corruption could be used to run code provided by the attacker, or if it would just cause a random crash somewhere else?

While investigating the issue with Secunia they provided us with an example that would cause a random crash, showing that it was at least possible to provoke a possible code execution later, which means that the corrupted memory could be in a partly usable state after the corruption occurred. However, there are so many dependencies in data used in an application like Opera that getting valid data into every location that needs it is rather unlikely, and a random crash soon after the corruption is the most likely scenario, unless the final phase of the attack can be carried through very quickly, something which depends on a large number of variables.

Our updated conclusion is that the original test-case is not a security issue, but for Secunia's modified test-case there is a theoretical possibility that an attacker could set up conditions so that arbitrary code can be run, and it is therefore a security issue. However, we think it is unlikely that this can be done is a predictable fashion. We also determined that the problem only existed in our Windows version.

In the event that an attack should successfully get past the hurdles mentioned above, Opera for Windows have for some time supported the security mechanisms DEP (which prevents code execution in the applications data areas) and ASLR (which makes the location of the data less predictable), DEP is available from Windows XP SP2 and later versions of Windows, ASLR from Windows Vista and up, though there may be system specific restrictions. If these two Windows security features are enabled, the probability of carrying through a successful attack becomes much smaller than it already was.

Of course, since this is considered a security issue, even if it is currently theoretical, we have a fix ready and are testing it. The plan is to release an update of Opera soon. Until then, if Opera crashes on an untrusted site, you should avoid visiting that site again.

Vladimir Carrer, a Web designer and developer from Italy, is taking on a challenge to use Opera 10.50 as his primary browser for a week. He's a passionate Firefox user, but he has put himself up for a browser challenge:

Originally posted by Vladimir Carrer:

"Why I’m doing this experiment?

Probably because I want to try to survive one week without Firefox and the second thing I meet two Opera team members last year on one Web conference (Molly and David) who ensure me that Opera is going in right direction.

The experiment is use Opera 10.50 for one week like your primary browser. In this week try to find all good and bad stuff about Opera. Than is up to you if you continue with Opera or not.

Are you willing to try this experiment with me?"

Read more about his challenge...

Our Battlefield: Bad Company 2 contest has come to an end. We are astonished by the amount of entries to this contest and it makes us want to do more contests featuring video games. :)

Here are five gamers we feel deserve a copy of Battlefield: Bad Company 2. We will contact you via private message on My Opera, so please make sure you check your inbox. We would like to thank everyone who shared their gaming experience. Hopefully we'll be back with another contest soon. :yes:

---

I Am The Night... I Am Fear In The Shadows...

Originally posted by Furie:

After so many Batman games in my time had been generic games with the Batman licence tacked on, this finally put me in the cape and cowl.

Congratulations Furie, your gaming experience with Batman Arkham Asylum made us want to boot the game up for yet another playthrough! :up:

---

SidM has left the game.

Originally posted by Sid M:

To complete the illusion, I stretched and got out of my seat, and left the room to get a drink and some fresh air.

Talk about dedication. Sid M is pretty serious when it comes to online gaming. His gaming experience was evil enough to make us laugh out loud with... evil laughter. :devil:

---

That's the day I won a game of NetHack for the first time ever.

Originally posted by ZeroOne01:

Even if an invisible choir had actually been singing I couldn't have heard it for all the adrenaline filled blood that was rushing in my head, making my ears hum.

When gamer ZeroOne01 ascended to the status of "Demigoddess" in a game of NetHack, he could've probably retired from video gaming and lived happily ever after. His gaming experience is personal, unique and powerful. We recommend you read it.

---

I've played the game so many times since then I can probably beat it in my sleep.

Originally posted by Dustin Wilson:

We played the game so much that my mother imposed a rule that we had to eat lunch away from the television as we would disregard our food for extra minutes of gaming.

For those of us growing up with video games, we remember how it was like when a new game or gaming console was released. Days felt like months and hours like years. Dustin Wilson's story brings back the feeling of getting totally immersed in a game..

---

Our fellow players were safe. Justice was done.

Originally posted by jmc777:

In the end it all got a bit too much for him to handle, and after one final 'Mother and dog' profanity-laden verbal onslaught.... He disconnected from the server.

If we ever want to team up with anyone online it has to be jmc777. His gaming experience is about tracking down and pwning a cheater in a game of Medal of Honor: Allied Assault.

We hope he will bring justice to Battlefield: Bad Company 2, because that's where he's heading! :yes:

A few weeks ago we asked you to send BBC Click a video and let them know about your browser of choice. We're not sure how many of you sent in a video about Opera, but we're very happy with the one they picked, so thanks to whoever made it! :yes:

A funny part in the 5 minute segment comes from a girl who says she uses Safari to browse the Internet, because she forgets to download Opera. :love:

Anyway, have a look at clip and let us know what you think as a comment. :cheers:

On Sunday evening (7th of March) we will take My Opera down for a quick maintenance. Fear not, we will of course have our trusted favorite game Bubbles while we work backstage!

Who will have the highscore this time around? :cow:

This week we want to highlight renacor, a fantastic photographer on My Opera from Poland. He's been a member since October 2005 and it's about time we highlight some of his epic shots. Enjoy! :yes:

1Reminds us of Frodo and Sam walking into Mordor from Lord of The Rings. Epic shot.

2A breather in the mountains.

3Arrival at a cabin.

4Fog thick as soup.

5Portrait shot.

6Dreaming of summer.

7Spring cleaning?

8In the mountains in India.

9Almost like the Great Wall of China. Except for the wall.

10Divine shot.

Thanks for all the great shots over the years renacor! Here's too many more! :cheers:

We're closing in on the 10.5 Final for Mac, and we've been working hard on getting it ready. Of course we have been working hard on all the platforms but Mac has made some big strides this week.

Mac Highlights

• Fix for extensive CPU usage and slow down
  
• Drop downs display again
  
• Lots of Flash and other plugin fixes
  
• Java is back!
  
• Mac Universal Binary is back! (including Video on PPC)

Enjoy, and please report issues you find with the build :)

Known Issues

• Carakan less stable on PowerPC
  
• Mac
  • Possible Java issues for PowerPC (PPC)
    
  • Signed Java Applets may cause UI misbehaviour
• UNIX
  • Font problems
    
  • Language input issues
    
  • No .deb or .rpm packages
    
  • No KDE integration
    
  • Problem with address field drop down position under non compositing Window Managers
    
  • Black drop down menus for some KDE3 users
    
  • Black border around Ctrl+Tab dialog when running under a compositing Window Manager
    
  • Some command line options don't work

WARNING: This is a development snapshot: it contains the latest changes, but may also have severe known issues, including crashes and data loss situations. In fact, it may not work at all.

Download

• Windows MSI / Windows Classic
  
• Macintosh (Universal) / Macintosh (Intel-only)
  
• Unix/Linux

I am about to embark on somewhat of a mission. Of education. In March I am visiting a number of universities to give talks on HTML5 and CSS3, along with slotting SXSWi somewhere in the middle of it all to talk about cross-device accessibility and web standards education (and maybe have a beer or two).

The university tour looks like so:

• March 5th: Manchester Metropolitan University, UK. 13:00-14:00 in Geoffrey Manton building, room 201.
• March 9th: Art Institute of Atlanta, Atlanta, Georgia, USA. 17.15-18.15 reception followed by talks 18.30-20.30.
• March 10th: University of Texas in Austin, USA. Talks 19.30-20.30 in Welch Hall (Room 2.304). Cookies included.
• March 12th-16th: Break for SXSWi!
• March 17th: Texas State Technical College, Waco, Texas, USA. Contact College for more details.
• March 19th: University of Tennessee at Chattanooga, USA. My talk here is part of the DevChatt event. **UPDATE** Location and time to be announced; details currently in flux!
• March 23rd: University of Georgia, Atlanta, USA. Talk at 6pm. Contact university for more details.

Downloads:

• HTML5 slides
• CSS3 slides

I will also be promoting my new book along the way — InterAct with Web Standards: A Holistic Approach to Web Design — coauthored along with a number of my friends and colleagues in the WaSP Edu Task Force. With this book we are aiming to provide the ultimate teaching/learning guide for web design basics, and discuss the bigger picture — so many books just yarn on about HTML and/or CSS in isolation, but we also cover using the Web to learn more effectively, information architecture, accessibility, and more. Check it out asap!

We're continuing our press tour in Europe and if you are in Germany on Monday, March 8th, we'd love to meet you for a chat and a drink!

For Windows only, but the Mac release is right around the corner and Linux is not far behind either.

Give Opera 10.50 a try! :up:

Want to know more about how Opera 10.50 came together? Join Opera's Roberto Mateu in Vienna for a exclusive chat about Opera 10.50!

Share your best gaming experience

We know many of you are video game nerds and this week Battlefield: Bad Company 2 is made available in North American and Europe. We're giving you chance to win one out of five free copies for either PC, XBOX 360 or Playstation 3.

All you have to do to enter the contest is share your best gaming experience as a comment in this article. We'll pick our five favorite stories as winners by Monday, March 8th.

We have picked our five favorite stories. Check out our winners post!

About the game

Battlefield: Bad Company 2 is a first-person shooter video game. It features a single-player and multiplayer game mode. The single-player campaign features environments from jungles in South America to snow-capped mountains in Alaska and even in a desert. The multiplayer mode is the star of the Battlefield show. This is where the game truly deliverers a unique gaming experience.

---

Battlefield: Bad Company 2 is rated Mature (17+), so make sure you are 18 years or older before you enter the contest.

Browse your own music and play it directly from the Unite Media Player. No sign-up, no third-party servers and no upload or downloads – just a whole lot of music for you to enjoy. The Unite Media Player connects with Opera Unite and gives you access to your music anywhere you want.

Experience a whole new world of music with Opera Unite!

Today we launched the native version of Opera Mini 5 beta for Windows Mobile 5- and 6- based handsets.

In the beginning of 2009 we started developing support for the persistent storage APIs, Web Storage and Web SQL Databases. Meanwhile, with the Opera 10.50 release cycle, the feature was made public.

Despite being two separate APIs, they share some common design. Both benefit from quota control, which can be tweaked in opera:config. Whenever a web site tries to go over its allowed quota, the user will be requested for more. Privacy mode, delete private data and widgets are also obviously supported. All web storage areas and databases are visible in opera:webstorage and opera:webdatabases respectively. Lastly, all data is placed under the folder "pstorage" in your profile folder.

Currently, we support all features in the Web Storage specification, with the exception of structured storage and the storage mutex. Testing also showed that our Web Storage implementation has nice performance.

Naturally, we chose SQLite as the database engine for Web Databases. SQLite, being in the public domain, allowed us to include it in Opera. Also, we can ensure compatibility with the other browsers that also support Web Databases. SQLite integration went without issues: the online documentation is very good, and allowed us to do everything we wanted. We commend the SQLite project for the great work they are doing.

Unfortunately, the binary footprint of SQLite does not make it perfectly usable in many of the less powerful devices that Opera ships on, so the feature might not be available everywhere. Therefore you should always do proper feature detection before attempting to use the feature, as shown below.

if (window.openDatabase)
{
    /* use web databases */
}
else
{
    /* fallback */
}

Some people have asked if we should support replacing the database engine with something else, like MySql. Currently, there are no plans to do so. Other databases engines are not perfectly interoperable with SQLite, and the integration with an external DBMS is not trivial.

Web Storage support in Dragonfly is already available, and we hope in the future to have nice SQL development tools builtin. For details about the APIs you can refer to the specifications linked above, and to dev.opera.com.