Toolforge currently permits tool names to contain Punycode, so that the tool URL can be an internationalized domain name; this is currently used by two redirect-only tools:
- https://🦄🎉.toolforge.org / https://xn--dk8hv9g.toolforge.org ⇒ https://www.mediawiki.org/wiki/Wikimedia_Cloud_Services_team
- https://🦊.toolforge.org / https://xn--9s9h.toolforge.org ⇒ https://meta.wikimedia.org/wiki/User:TheresNoTime/Foxes
In theory, this feature can be abused for homograph attacks. Is this something we’re concerned about in a tool name? Should we prevent it in tool registrations (e.g. in Striker, or by adding xn-- to the Wikitech title blacklist)? Or should we leave the matter to browsers? (Neither Firefox nor Chrome actually show either of the above URLs in encoded form, for example.)