Potato I have

Regarding the IDN exploit, Firefox has a security patch release that shows punycode in the status and location bars. It has a new config parameter network.IDN_show_punycode that is enabled by default.

To see the new behavior, I had to remove the unicode filter that I had in adblock (a persistent fix to the IDN problem); with the filter in place, any click on an IDN link would be ignored. I then had to re-enable the network.enableIDN parm, my original (and non-persistent, due to a firefox bug); with that set to false, I get this message from the handy test page for spoofed links:

http://sitefinder.verisign.com/lpc?url=www.theshmo%25D0%25BEgroup.com
&host=www.theshmo%25D0%25BEgroup.com

Network Error (dns_unresolved_hostname)
Your requested host “sitefinder.verisign.com” could not be resolved by DNS.
For assistance, contact your network support team.

Here again is a handy test page, where you can see punycode in both the mouse-over URL in the status bar, and in the location bar after going there.

(again via this article on the reg).