Claude Cowork, Claude Design объединили в один Claude

➡️ Читайте на сайте: https://aff.top/blog/claude-cowork-claude-design-obedinili-v-odin-claude

🧠 Ещё больше инсайтов → в канале AFF.top

WAF Placement SOP: Edge vs Server
Deciding between Cloudflare WAF and a server-side WAF (ModSecurity, NAXSI). Pick by attack surface.

— Use edge WAF when: origin IP is hidden, you face volumetric/L7 floods, you want rules without touching the box.
— Use server WAF when: traffic must be inspected after TLS at origin, you run multi-tenant on one box, or compliance forbids third-party TLS termination.
— Verify edge can't be bypassed: lock origin firewall to Cloudflare IP ranges only. An edge WAF with an open origin is theater.
— Run both for layered defense: edge for volume, ModSecurity CRS for app-specific payloads.
— Confirm: curl the origin IP directly. If it answers, your edge rules are skippable.

Run this every time you front a site with a CDN.

Myth-Busting SOP: 'Editors Are Safe, Only Admins Are Dangerous'

The Editor role can publish unfiltered HTML, embed scripts via certain plugins, and pivot through file-upload flaws. Over-privileged 'safe' roles are how breaches spread laterally. Audit by capability:

— Step 1: List every role and its actual capabilities with a role-editor view, not the label.
— Step 2: Strip unfiltered_html from non-admins (it's off by default in multisite — match that).
— Step 3: Give contributors the lowest role that lets them do the job; create custom roles if needed.
— Step 4: Separate the daily-driver account from the super-admin account for every person.
— Step 5: Verify by logging in as each role and attempting a privileged action — it must fail.

Least privilege means capabilities, not job titles. Run this every time.

Microsoft планирует вставлять рекламу в игры

➡️ Читайте на сайте: https://aff.top/blog/microsoft-planiruet-vstavliat-reklamu-v-igry

🧠 Ещё больше инсайтов → в канале AFF.top

Rate-Limit Placement SOP
Edge rate-limiting vs nginx limit_req vs app-level throttle. Layer by cost.

— Use edge limits (Cloudflare, fastly) for crude volume: cheapest place to drop a flood before it costs you bandwidth.
— Use nginx limit_req_zone for path-specific caps: wp-login.php at 1r/s, /xmlrpc.php blocked, API at 10r/s. Runs before PHP spins up.
— Use app-level throttle (Laravel throttle, plugin) when: limits must key on authenticated user ID, not just IP.
— Verify burst settings: a too-tight burst breaks legit users behind shared NAT.
— Confirm: hammer the login path, watch the 429s appear at nginx, not in PHP error logs.

Run this on every public form endpoint.

Myth-Busting SOP: 'robots.txt Disallow Hides Sensitive Paths'

Disallow: /admin doesn't block access — it publishes a map of what you want hidden, and the URL stays reachable. Robots is a crawl request, not a control. Fix the confusion:

— Step 1: Remove sensitive paths from robots.txt; you were advertising them.
— Step 2: Protect those paths with authentication or IP rules at the server, not a text file.
— Step 3: To keep a page out of search, use X-Robots-Tag: noindex on an access-controlled URL.
— Step 4: Confirm the path returns 401/403 to anonymous requests, not 200.
— Step 5: Verify by fetching the URL directly — robots.txt won't stop a curl, only auth will.

robots.txt guides crawlers; it guards nothing. Run this every time.

Myth-Busting SOP: 'DISALLOW_FILE_EDIT Stops Code Injection'

Setting DISALLOW_FILE_EDIT only hides the dashboard theme editor. An attacker with admin can still install a plugin, upload a zip, or write via FTP. It closes one door in a hallway. Lock the rest:

— Step 1: Keep DISALLOW_FILE_EDIT true, but log it as one of several steps.
— Step 2: Add DISALLOW_FILE_MODS true to also block plugin/theme installs and updates from the UI.
— Step 3: Deny PHP execution in wp-content/uploads at the server level — the real injection target.
— Step 4: Make core files read-only to the web user so no process can rewrite them.
— Step 5: Verify by attempting to upload a .php file to uploads and execute it — it must 403.

The constant blocks the menu, not the method. Run this every time.

New-Site Hardening SOP
Run this in order before a site ever sees public traffic.

— Step 1: Force HTTPS, install HSTS, redirect all HTTP to HTTPS.
— Step 2: Delete the default 'admin' username; create a named admin with a 20+ char passphrase.
— Step 3: Enforce 2FA on that account immediately.
— Step 4: Disable file editing and file mods in wp-config.
— Step 5: Set directory 755 / file 644 permissions; wp-config to 600.
— Step 6: Disable XML-RPC and user-enumeration via /?author=1.
— Step 7: Deploy the seven security headers.
— Step 8: Install a login lockout policy.
— Step 9: Confirm automatic core security updates are on.

Run this every time.

Myth-Busting SOP: 'Setting One Security Header Is Good Enough'

Adding X-Frame-Options and calling it done leaves clickjacking partly open and ignores sniffing, referrer leaks, and feature abuse. Headers work as a set. Deploy the full baseline:

— Step 1: X-Content-Type-Options: nosniff — stop MIME-sniffing attacks.
— Step 2: Content-Security-Policy: frame-ancestors 'self' — the modern replacement for X-Frame-Options.
— Step 3: Referrer-Policy: strict-origin-when-cross-origin — stop leaking full URLs.
— Step 4: Permissions-Policy: geolocation=(), camera=(), microphone=() — disable unused APIs.
— Step 5: Verify all five on securityheaders.com and confirm none are duplicated (plugin + server) causing conflicts.

One header is a gap, not a policy. Run this every time.

На Anthropic, OpenAI, Google и SpaceXAI подали в суд из-за ИИ

В Калифорнии против ИИ-компаний подали антимонопольный иск: регулятору показалось подозрительным, что игроки синхронно призывают ограничить развитие нейросетей ради безопасности. Смысл спора в том, что инвестиции в ИИ уже обгоняют реальный прогресс, а бизнесу выгодны правила, которые защитят капитал. Вывод: быстрых прорывов ждать не стоит, лучше выжимать максимум из текущих инструментов.

➡️ Читайте на сайте: https://aff.top/blog/na-anthropic-openai-google-i-spacexai-podali-v-sud-iz-za-ii

🧠 Ещё больше инсайтов → в канале AFF.top

Myth-Busting SOP: 'We Have HTTPS, So the Site Is Secure'

TLS encrypts transport. It does nothing against SQL injection, weak passwords, or a vulnerable plugin. Close the gap:

— Step 1: Confirm HTTPS is enforced, then stop treating the padlock as a finish line.
— Step 2: Add HSTS: Strict-Transport-Security: max-age=63072000; includeSubDomains; preload.
— Step 3: Patch application layer — auto-update core, audit plugins monthly.
— Step 4: Enforce 2FA and least-privilege roles; TLS protects the password in transit, not a leaked one.
— Step 5: Verify with a vuln scanner (wpscan, Nikto) over the live HTTPS site — the padlock won't catch what they find.

Encryption protects the wire, not the app. Run this every time.

Google ads начал показывать расходы конкурентов

Google Ads запустил Peer Spending — инструмент, который сравнивает расходы аккаунта с рекламодателями из той же ниши без раскрытия чужих данных. Он показывает, тратите вы больше, меньше или примерно на уровне конкурентов на уровне кампаний и групп объявлений. Для арбитража это скорее ориентир по бенчмаркам, чем инструмент прямого усиления залива.

➡️ Читайте на сайте: https://aff.top/blog/google-ads-nachal-pokazyvat-raskhody-konkurentov

🧠 Ещё больше инсайтов → в канале AFF.top

Минфин РФ планирует выпустить собственный стейблкоин

Власти РФ обсуждают запуск рублёвого стейблкоина: сейчас решают, как его обеспечить, какие операции разрешить и будет ли на него спрос. Основной кейс — международные переводы, а не использование физлицами. Если проект доведут до запуска, он может стать частью новой криптоинфраструктуры и альтернативой токенам, привязанным к дружественным валютам.

➡️ Читайте на сайте: https://aff.top/blog/minfin-rf-planiruet-vypustit-sobstvennyi-steiblkoin

🧠 Ещё больше инсайтов → в канале AFF.top