andrewguenther

[Disclaimer, I work at OpenAI]

Sites has been one of the most valuable ships for us internally outside of general model releases imo. A few things that I think are incredibly underrated:

1. Plugin usage. I can build a site with some data vis and when someone else in the company logs in, it uses their access to evaluate those queries. The access model/BYO connection is really powerful.

2. Ephemeral sites. Setting up a site is so easy they can be ephemeral. I can set up a whole site for a presentation, or a complex form, or just a meme, and then never touch it again because it cost me basically none of my time.

3. Sites as plugins. Sites directly integrate with the plugin ecosystem in that a site itself can provide/be a plugin. Combine that with Sign in with Chat (byo subscription) and you can build some really cool experiences really easily. I've been working on a deck grader for Magic the Gathering the last few months for my own uses and now I could pretty trivially publish it as a site for others to use.

I don't see sites being abandoned any time soon :)

The self-hosted environment is just the backend for shell calls the agent wants to make. The inference bits, thread persistence, and (optionally) mcp/tool calls happen from the API.

That is correct. It is possible they didn't opt out and given the timeline and anonymization of data unclear whether a particular conversation would have made it into the training set if they hadn't.

No, remotes still work fine

Having a "buy me a coffee" link is an incredibly terrible way to monetize to the point where I highly doubt that the vast majority of these are profit motivated as the author implies.

I have personal projects that I pay >$100/mo to operate. I can afford to do so, it is not impactful to my life. People have, without prompting, offered to give me money for these projects as a way to show appreciation. I have no intent to ever make money off of these things, I don't even hope to break even, but offering some money is a material way to show appreciation for a service you find valuable and I don't think there should be any shame in it.

It looks like this doesn't work for users without accounts? It works when I'm logged in, but not logged out. I went ahead and reported it to the team. Thanks for letting us know!

How long ago was this? I had this same experience, but there's a new implementation for memory as of a few months ago which seems to have solved this weird "I need to mention every memory in every answer" behavior.

In 2025 there's no reason for anyone to be logging into an AWS account via the root credentials and this should have been addressed in the preventative measures.

There's no actual control improvements here, just "we'll follow our procedures better next time" which imo is effectively doing nothing.

Also this is really lacking in detail about how it was determined that no PII was accessed. What audit logs were checked? Where was this data stored?

Overall this is a super disappointing postmortem...

Yes, you can start with a still and a prompt

How does that statement convey inexperience? The presentation doesn't try to present that as a novel conclusion, it's just a true statement.

Hardly fair when most commands don't work and you can't copy paste...

None. Windows Defender is actually quite good and the third party options are so bad I'd argue in many cases you're worse off having them installed.

Yes, but S3 has single region redundancy that is better than GCP. Your data in two AZs in one region is in two physically separate buildings. So multi-region is less important to durability.

Also if you're open to it, I'd love to reach out and get some feedback on your experience with fck-nat, how many environments you're running it in, etc. Is that something you'd be open to? If so, what's a good way to get in touch?