Plus, if some site were using length limits as a security check, would they be counting Unicode glyphs, Unicode codepoints, code units, or bytes? Cause the one

Plus, if some site were using length limits as a security check, would they be counting Unicode glyphs, Unicode codepoints, code units, or bytes? Cause the one thing TFA's domain doesn't do is take up 4 bytes even without the trailing period (which isn't needed for the XSS anyways). No, it takes 7 bytes using UTF-8 and, naturally, precomposition. So TFA's 15-character XSS is actually an 18-byte XSS (in UTF-8). :)