Regarding WebSocket

December 10, 2010 · by Aleksander Aas

Opera resident spec wizard Anne van Kesteren announced that due to the discovered security issues with WebSocket protocol handshake, Opera will ship Opera 11 with WebSockets disabled. ~~Fear not though this potential security issue does not affect Flash or Java in Opera as Opera's implementation prevents abuse here~~.

Not sure what WebSockets are? It's a protocol that allows communication between browsers and servers. For more information check out the pretty sweet http://www.websockets.org/!

Update: We are looking into potential issues with Flash and Java as well.

Readers' comments 14

Left under the original article, as archived.

Joonas LehtolahtiFriday, December 10, 2010 1:40:40 PM
Pretty sweet indeed, they detect Opera 11 as Opera 9.80 (in the upper right corner of the page)
TamilFriday, December 10, 2010 2:00:55 PM
http://files.myopera.com/Tamil/Smilies/Good.gif -
gonzoo305Friday, December 10, 2010 2:25:15 PM
really good pr)) like ope-ra
Michael HayfordFriday, December 10, 2010 3:36:19 PM
Opra is the millennium browser
Artur „Jurgi” JurgawkaFriday, December 10, 2010 3:53:24 PM
A very drastic remedy…
Charles SchlossFriday, December 10, 2010 5:00:23 PM
http://files.myopera.com/Tamil/Smilies/Good.gif -
AvolaFriday, December 10, 2010 5:07:11 PM
Originally posted by godjonez:

Pretty sweet indeed, they detect Opera 11 as Opera 9.80 (in the upper right corner of the page)

About Opera -
Opera/9.80 (Windows NT 6.1; U; en) Presto/2.7.62 Version/11.00
lucideerFriday, December 10, 2010 5:47:08 PM
Originally posted by godjonez:

Pretty sweet indeed, they detect Opera 11 as Opera 9.80 (in the upper right corner of the page)

Which means they're using browser sniffing and not feature detection. Pretty sweet my arse.
d4rkn1ghtFriday, December 10, 2010 5:55:44 PM
AndrewLowFriday, December 10, 2010 6:48:42 PM
Originally posted by lucideer:

Which means they're using browser sniffing and not feature detection. Pretty sweet my arse.

No, I tested, they check the function and then they say which version you're using, in fact, if you activate them a green ok circle is shown

(BTW, I tried the test and Secure WebSocket didn't work, are they supposed to be so, aren't they implement yet, right?)
lucideerFriday, December 10, 2010 7:54:43 PM
Originally posted by AndrewLow:

No, I tested, they check the function and then they say which version you're using, in fact, if you activate them a green ok circle is shown

Hrmm.. interesting. You're right. Wonder why they bother with all those 116 lines of (clearly inaccurate) browser sniffing at all in that case...
HadiSaturday, December 11, 2010 6:01:54 AM
Cutting SpoonWednesday, December 15, 2010 2:35:56 AM
So they're disabling Websockets because the spec itself is not currently safe? Similar to the push for TLS upgrades?
Simon PietersWednesday, December 15, 2010 10:23:33 AM
Originally posted by AndrewLow:

(BTW, I tried the test and Secure WebSocket didn't work, are they supposed to be so, aren't they implement yet, right?)

It's supposed to work. Works for me. Maybe there was a problem with their server when you tested?