Forum Moderators: open
Firstly it's a completely unwanted function. I don't care if my website loads a second faster than it usually would. Secondly it can get your machine to download malware from websites you have not even visited.
For instance, I was doing some Google SERP analysis for one of my clients who sells adult products and what do I see? Malware being downloaded from a website I did not even visit.
I did shut down the function later on, but this is a nuisance. This is definitely not bright coming from a browser that claims to be super secure.
Hope chrome does not have this feature.
[edited by: tedster at 5:27 pm (utc) on Jan. 23, 2010]
[edit reason] moved from another location [/edit]
I'd never given this a lot of thought, which is why I looked into it. Out of curiosity, if your AVG is up to date and doing it's job, wouldn't this offer some form of protection against this?
RewriteCond %{X-moz} ^prefetch [NC]
RewriteRule (.*) - [F,L]
Prefetch is more and more a liability, IMO - especially the way malware is proliferating and become quite devious today.
Prefetch is more and more a liability, IMO - especially the way malware is proliferating and become quite devious today.
I've disabled prefetching on all my profiles. To disable prefetching add the following to your prefs.js:
user_pref("network.prefetch-next", false);
I think the Firefox developers are so enamored with their prefetch idea that they are not willing to see just how big of a security issue it could pose.
- New tab, type about:config
- If you get the warranty void warning, click "ok I'll be careful"
- in the Filter field, enter network.prefetch-next
- If set to false, you're good, otherwise double-click the config line which will set it to false.
The more I think about this, the more I wonder W** they were thinking. "Internet Destroyer Emulation mode?"
stumble.2893641.prefetch;true
stumble.2893641.prefetcher_fetch_depth_in_topic;3
stumble.2893641.prefetcher_pass_1_timeout_ms;10000
stumble.2893641.prefetcher_pass_2_timeout_ms;30000
stumble.2893641.prefetcher_pass_3_timeout_ms;120000
stumble.2893641.prefetcher_pass_max;3
stumble.2893641.prefetcher_skip_resources;false
stumble.log_prefetch_progress;false
I am assuming these came from my stumbleupon toolbar.
Could these be a problem as well?
Thanks for the step by step instructions.
Much appreciated!
I had never heard of prefetch before this thread, so I can imagine that most everyday people would not have a clue as to what it does.
When I've accidentally tripped on malicious sites, my AVG goes off like a ten alarm fire. Hopefully, a prefetched malicious site would do the same thing. Still, why pull the wildcat's tail . . .
Could these be a problem as well? stumble settings in config
I missed this on page 1, I don't know. A good way to find out might be to run HTTP Live Headers while you visit stumble upon.
As far as downloading malware goes, there is a big difference between downloading code and executing it. Until it's executed it's not a threat.
I suppose it's possible that FF left some kind of hole in their prefetcher that would allow an app to run itself... but the chances are remote, that's the kind of mistake even IE would be unlikely to make.
Hope that clarifies the issue.
Kaled.
refetch is NOT a security problem. It simply means that data is buffered into memory
You land some spam page Google served up as a top 10 result, it's a dicey page with shady links to dubious places, you try to get out as quick as possible but TOO LATE as you've pre-fetched all sorts of things from places you aren't supposed to be going.
Try to explain that you didn't go to that adult site, it was your browser, to your HR dept. and try to keep a straight face.
WHAT warranty? What's this about? Firefox comes with a warranty?
RewriteCond %{X-moz} ^prefetch [NC]
RewriteRule (.*) - [F,L]
F always implies L so you only need F.
RewriteCond %{HTTP:X-moz} ^prefetch [NC]
RewriteRule . - [F]You also don't need to backreference the pattern as you are not reusing it.
Be aware that the above rule, while widely used, doesn't stop requests for the root "/" URL of any site.
Pre-fetching something also bombed massively with Vista which treats RAM like a RAM drive (they are two totally different things).
Pre-fetching websites is obviously bad for security, but it also skews statistics and wastes resources.
In regards to software pre-fetching it should only be done intelligently. For example many video games have launcher programs associated with them (e.g. World of Warcraft and Oblivion). The OS should see what executable (that has an actual open window) commonly calls another (must be an actual open window and not just a background-process) executable. Then and only then is the correct way to do any kind of pre-fetching. If speed is truly that important to the person using their computer they can spend the extra money to get a faster computer if need be.
- John
I have to agree with Physics, if Firefox is going to have prefetch, it REALLY needs needs to be a check box setting in the options panel.
Yes, and the default setting should be "prefetch off."
"This might void your warranty!"WHAT warranty? What's this about? Firefox comes with a warranty?
This was simply a "little joke" in the UI -- an amusing (if perhaps ill-advised) way to word a warning that changing Firefox settings using About:config can cause performance, functional, or security problems in Firefox or in the network.
...RewriteCond %{HTTP:X-moz} ^prefetch [NC]
RewriteRule . - [F]
Be aware that the above rule, while widely used, doesn't stop requests for the root "/" URL of any site.
If a custom 403 error page is used, then it will have to be excluded from the rule to prevent an 'infinite' rewrite/error loop. If not already done "globally" in your config code, this can be accomplished by using a negative-match pattern such as
RewriteRule !^URL-path-to-my-custom-403-error-page\.html$ - [F]
Jim
If speed is truly that important to the person using their computer they can spend the extra money to get a faster computer if need be.
Pre-fetch is about bandwidth speed and internet and server latency issues, it has nothing to do with local computer speed because the fastest computer in the world still can't download a page from the same web server any faster, but can only format it for display faster.
Pre-fetching websites is obviously bad for security
Everyone keeps saying this but nobody can identify a single security issue.
Pre-fetch only downloads a web page in advance, it does not execute the page.
For a security problem to happen the page must be executed, specifically javascript, flash, PDF, etc. and those elements are not downloaded nor activated until that page is physically displayed by action of the user.
Don't get me wrong, I'm not defending the technology as I'm completely against pre-fetch because in theory if everyone was using it, it could overload our networks and servers in relatively short time.
However, that doesn't mean we should be spreading FUD that has no merit about the technology because at the end of the day pre-fetch simply wastes bandwidth and server resources, nothing more.
The browser observes all of these hints and queues up each unique request to be prefetched when the browser is idle. There can be multiple hints per page, as it might make sense to prefetch multiple documents. For example, the next document might contain several large images.
I want to learn more about prefetching. Apparently the source can provide prefetch hints which are typically found in the link rel element.
What are the prefetching hints? - The browser looks for either an HTML link tag or an HTTP Link: header with a relation type of either next or prefetch.
For some reason I just don't feel 100% comfortable with that prefetch mechanism - FUD or not. :)
I do agree that FF should make it an option easy to find, and should be default OFF.
Anyhow, if speeding up load times is part of the deal, will turning off prefetch slow load times down?
And if so, will that have any consequences inrelation to the recent talk about Google using apge load times as a ranking factor? (Or do I have that concept wrong too?)
