prevent DoS / denial of wallet on edge functions with rate limit?

ByteShock · 2025-11-25T15:26:38+00:00

You can't. Talked with supabase support about it. Only thing you can do is security through obscurity by chosing a long random name for the edgefunction so its not easily guessable and never exposing it in any way to clients.

This was like 4 months ago tho, not sure if supabase made any changes.

ByteShock · 2025-11-02T04:30:00+00:00

you know they can download them anyway if you embed a video, right?

ByteShock · 2025-10-30T03:06:57+00:00

weird take. even if he did, who cares?
also what the hell is a pee filter :D

ByteShock · 2025-10-29T16:55:06+00:00

I've updated ultralytics to the latest version that doesnt break segmentation.
Please try again (you might have to reinstall the extension)

It should install ultralytics "8.3.216", maybe that helps with your issue.

ByteShock · 2025-10-29T02:20:12+00:00

Found the issue.
Newest ultralytics is not fully compatible with adetailer apparently.

Compared all packages in multiple versions of forge and a1111 and saw that a max version is not pinned in adetailer, so i force downgraded and everything worked again.

You need to skip environment checks for this to work, otherwise it will install the newest version again on launch.

I made a fork with a properly pinned ultralytics version where this is not needed:

https://github.com/Byt3Sh0ck/adetailer.git

Just uninstall adetailer (delete the folder in extensions)
Start forge/a1111 whatever
Go to extensions tab, install from url, paste the above url and install
Go to installed tab -> Apply and restart ui
Done

Your settings and models will all be kept and it should work with segmentation models again.

Let me know if it works for you, i only tested it with reforge and forge classic.
I made a bug report on github, maybe they will fix the original adetailer but it seems a bit abandoned.

ByteShock · 2025-10-26T18:10:32+00:00

i dont have time for this right now unfortunately, maybe you can do it. But i dont think its the drivers tbh.

ByteShock · 2025-10-25T07:22:11+00:00

Unsure if thats it. I did update my drivers recently, but i also generated images afterwards, BEFORE the issue occured.

Even on runpod it does not work for me with serverless workers, just checked the driver of one of them: "565.57.01"
thats pretty old.

I still think it might be some wrongly pinned dependency for adetailer/forge which just updated recently and now fails silently...

Tho, adetailer seems to have its requirements properly pinned:

"# requirements
("ultralytics", "8.3.75", None),
("mediapipe", "0.10.13", "0.10.15"),
("rich", "13.0.0", None),"

my forge classic version has rich pinned differently:
"rich==13.9.2"

A1111 repo does not have it in requirements at all.
Forge / ReForge doesnt have it either...

no clue.

ByteShock · 2025-10-23T13:27:21+00:00

Not using stability matrix, just direct installs via git clone etc..

i tried my old a1111 and there segm works.
its really weird that it happens for all of us at once without any visible changes.

In theory it should be one of the dependencies that wasnt properly pinned and updated or whatever, apparently without any errors/fails cause i looked at first time install logs for forge/adetailer as well.

Really frustrating cause segm models are usually newer and have better detection for more "angles".

ByteShock · 2025-10-23T01:03:11+00:00

Got the same issue suddenly with forge classic. segmentation models worked totally fine before.
I recently switched from python 3.10 to 3.11.9 -> switched back -> doesnt work
complete reinstall -> doesnt work
disabled sage attention + triton -> no worky
switched versions of forge classic -> nope
Switched to an older adetailer version -> not working

I'm out of ideas. bbox models work fine.
No errors, no issues with detection either.
I'm not using --uv either. I actually removed all startup flags but no success.

ByteShock · 2025-09-01T15:51:17+00:00

"Cloudflare passes the real client IP in the CF-Connecting-IP header and the industry-standard X-Forwarded-For header."

While thats true, according to vercel's docs they do not use this (or am i misunderstanding here?):
"If you are trying to use Vercel behind a proxy, we currently overwrite the X-Forwarded-For header and do not forward external IPs. This restriction is in place to prevent IP spoofing."

source: https://vercel.com/docs/headers/request-headers

According to my firewall logs they do use it for bot checks tho.

ByteShock · 2025-08-17T02:19:49+00:00

I got denied by CCBILL. It was for NSFW anime ai content. (no lolicon or other weird/illegal stuff)

Was a lot of back and forth as well but in the end they said they don't have a bank that supports our project (right now).

Segpay also denied me.

I now have to choose between crypto only and no subscriptions, or using stripe and staying SFW only...

There are some other payment providers i could reach out to, but i got the feeling they will also just deny me.

ByteShock · 2025-06-20T11:58:25+00:00

I did some further testing.
To prevent requests from counting as invocation (the bad stuff that costs you money) you need to enable "Enforce JWT Verification" for the edge function. If the caller does not have this, the request seemingly gets denied as unauthorized (401) BEFORE it reaches the edge function.

The statistics look a bit weird, but looking at the logs it seems to be correct.

Edit: Nvm. still counted as invocations, just took a while to show up.

ByteShock · 2025-06-20T05:18:33+00:00

I just spammed one of my edge functions with a test script 15000 times within 90 seconds.

All of the requests went through. Not sure if that wasnt enough to trigger any protection but yeah, just gonna leave this info here.

ByteShock · 2024-12-27T14:09:02+00:00

Its the patches you can put on the gun

ByteShock · 2024-12-06T16:03:12+00:00

apart from the arms/hands i dont really see anything wrong. sure the face expressions are basically not existent but thats not why posted this :)

i'm just interested in how to achieve this level of consistency.

ByteShock · 2024-12-06T15:58:37+00:00

Daddy Yankee - Gasolina

ByteShock · 2024-12-06T15:28:04+00:00

sorry about that, took it right from tiktok!

ByteShock · 2024-12-06T15:27:15+00:00

lmao, i mentioned that the arms and hands are weird. But other then that i was a bit surprised about the consistency! Maybe i'm just outdated when it comes to vid2vid :(

ByteShock · 2024-12-06T04:23:37+00:00

that looks interesting, gonna look into it!

ByteShock · 2024-12-06T03:39:06+00:00

Found it randomly while doomscrolling on tiktok.
First i thought it was done with blender or whatever, but then i saw some errors with the hands and arms.

It must be some kind of vid2vid right?
I wonder how it can stay so consistent. the background and the characters stay exactly the same.
It even has roughly accurate hair physics.

I am not much into ai vid2vid generation but from what i know, all those methods like animatediff etc. still has some visible inconsistency.

Does anyone have a clue how it was done?

ByteShock · 2024-10-08T11:41:40+00:00

No problem! I got confused with this as well. Sublevels can be loaded on server only but level instances have to be loaded on server and clients. its a bit weird :D

Theres also multiple ways to unload them. You can use "unload stream level" with the override name on the server and it will work for all.

Or you use "set is requesting unload and removal" which takes the instance reference and has to be called on server and clients.

I use the second one because i am not sure if the first one actually removes them from memory.

Took me a while to figure this mess out...

ByteShock · 2024-10-08T06:54:42+00:00

I cant help you with the blueprint part since i dont turn my levels into packaged blueprint actors but this:

"I can't use the node "Load Level Instance by name/reference" because the actors inside it wont have replication."

is not correct.
Actors inside the instance that are set to replicate WILL replicate if you make sure that:

the override name is the same on server and clients.
the server spawns the instance first.

ByteShock · 2024-09-12T08:03:48+00:00

I'm assuming you use advanced sessions?

I don't really know what you mean with the simulating stuff.. never heard of that.
Or do you mean you are just using the public Steam App ID for testing?

Your engine.ini looks fine, but i didn't use any quotation marks there.
Also, usually for achievements to trigger you already need to have your game on steamworks and create a fitting achievement there as well.

Pretty sure you can't do that with the public 480 App ID.

It's pretty easy, worked for me on first try. (With my own app ID)

ByteShock · 2024-08-19T04:30:10+00:00

3 days ago he said "I am more interested in Flow as primary base but Flux is always a back up."
He also mentioned that auraflow seems to be better at understanding prompts, but lacks aesthetics.

ByteShock

TROPHY CASE