click-jacking and brew

I wanted to swap my personal and development laptops, so I started migrating users around in MacOs.

I ran into this strange bug after I moved the foo-dev user to the personal machine…

brew specifies what users are enabled to call for installation of packages which is mentioned in their docs.

I wanted to reinstall it as the new user onto the machine, I had nuked the other user account, so it seemed “more proper”.

Upon attempting to install I ran into a little uBlock origin ClickJack alert (My first time!)

oh the paranoia started, I ran back to duckduckgo, and checked the search, maybe I in-fact was on the wrong site.

uhhh…

Thats a little weird… This lead me down a rabbit-hole, which one is the real one?

And what triggered the alert? I ended up in the ublock origin AD filter looking at this commit (that allow-listed another site).

Not sure how developers have not run into this issue, maybe its a race condition with how people are installing stuff to their setup, maybe the brew installer was getting installed (for the first time) before uBlock Origin. brew.sh seems like it should be popular enough that someone else would have seen it.

Switching computers can be stressful.