@forest SHS, Pseudo permutation.

Gimli is a public permutation, like Keccak.

does it cover all permutations?

It's just one 384-bit permutation.

So it should have 2^384 bijections.

Interesting analysis of real quality exploits are like: googleprojectzero.blogspot.com/2021/01/…

> These exploit chains are designed for efficiency & flexibility through their modularity. They are well-engineered, complex code with a variety of novel exploitation methods, mature logging, sophisticated and calculated post-exploitation techniques, and high volumes of anti-analysis and targeting checks. We believe that teams of experts have designed and developed these exploit chains.

(One year old, but: nassiben.com/lamphone)

This is fascinating, but it's not new. Listening to audio using lightbulb filaments is a known issue and is why highly secured environments are typically not allowed to have windows or bulbs with filaments.

This person here has a point. The CSS XSS vector <DIV STYLE="background-image: url(javascript:alert('XSS'))"> is included in the OWASP XSS cheat sheet, even though it doesn't work. Has the cheat just not been updated, or am I missing something?