KristopherLeads

KristopherLeads

@kristopherleads.bsky.social

I’m a product marketing and developer relations leader with more than a decade of experience turning technical products into movements and fans into evangelists

7 followers41 following22 posts

I think this just doubles down on what I've been saying - AI extends humanity, it doesn't replace it. It makes you able to move faster, sure, but at the end of the day, it comes down to you, the human, using a tool.

David Gura@davidgura.bsky.social

cool, cool

re: Anthropic filing: 1. The per-employee performance here is wild. 2. Anthropic is going to be the blueprint for AI orgs going public in the next 12 months. 3. The "AI Bubble" fear is real - and this is going to reinforce the naysayers as well as the fans. So are you going to invest in #ANT?

AI hot take: it makes you 10x across the board. That means 10x faster. But also if you're bad at something, that means 10x more drift, 10x more frustration, 10x worse outcomes...10x faster. #ArtificialIntelligence #IndustrialAutomation

The key to effective product marketing is honesty. Really, that's it. Also figuring out SEO, AEO, GEO, comparative analytics, competitor positioning, narrative strength, and a billion other variables. But mostly honesty. #productmarketing #marketing

An LLM audits a production flows.json and finds 16 crimes. Claude cleans up messy MQTT. Real-time OEE runs on a tea bag line. Node-RED Con 2026: 12 talks from people running Node-RED in production. Free and online, Nov 3. nrcon.nodered.org #nodered #industrialautomation #flowfuse

nrcon.nodered.orgNode-RED Con 2026 - November 3, 2026Node-RED Con brings the community together to share how Node-RED is being used to solve real problems — from factory floors to edge deployments and AI integration.
View full thread

Mistake #7: Stop assuming every caller is human. More and more traffic is coming from agents. If your API can't tell user from agent, your audit trail and rate limits are worthless. Start paying attention - and dealing with it properly.

This whole list has a common problem - we keep securing the connection but not paying attention to the intent. The work devs need to do to get this right starts on their side - but it impacts the other side too. Pay attention, be logical, and put the effort into it.

View full thread

Mistake #5: Stop sending the whole object and just letting the frontend filter it. That whole object contains a ridiculous amount of info that can be used for horizontal escalation. Return only what the client needs - and do the work to figure that out first.

Mistake #6: If you don't know what APIs you are actually running, you're asking for trouble. Keep an inventory and actually pay attention. It can be a spreadsheet, but that's pretty silly - make an API directory and keep it constantly updated.

View full thread

Mistake #3: Using API keys as identity. That's never what it was meant to do - and when keys get copied into repos, Slack, Claude, screenshots, whatever, you break the system. Deploy actual identity management, PLEASE.

Mistake #4: Letting your tokens run everything. Tokens that can do anything are awful and you're basically asking to be attacked. One token with full scope is easy for you - but it's easy for an attacker too. Least privilege should be table stakes at this point.

Mistake #1: Checking who you are, but not what you're allowed to touch. I see this over and over again. If I can change from orders/1001 to orders/1002 and see someone's order, that's BOLA, which has topped OWASP top ten for years now.

Mistake #2: Treating the API gateway as a security model. A gateway is just a front door, and it doesn't know your business logic, data relationships, or who owns which record. If authorisation only lives at the edge, you don't actually have authorisation.

Me in 2016: Man, AI is interesting. I should probably learn some better maths to understand what’s going on. Me in 2026: Writing a paper on the epistemological reality of AI and the delta between performant knowledge in humans vs. RAG systems. The AI trap is real!

You are up to date.