Top all-time · #13644
Ammar Askar
Personal blog · blog.ammaraskar.comsecurityhardwareprogramming
Ammar Askar writes Ammar's Blog, a personal blog at blog.ammaraskar.com about security, hardware and programming. Since 2015, 5 different Hacker News readers have linked it 9 times, most often “1-Click GitHub Token Stealing via a VSCode Bug”. It is still writing: the last post was on 2026-06-02, and you can follow it by feed.
Too few sampled comments (2) to say how often HN recommends it.?
Why HN links it
HN readers cite this blog's security write-ups, such as a post on a one-click GitHub token-stealing vulnerability in web-based VSCode. Commenters use it as a reference for their own points.
Summarised by Claude from a sample of 2 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
My latest ramblings
Most-linked posts?
- 1-Click GitHub Token Stealing via a VSCode Bug2 people · 2 mentions · first linked 2026-06-02
- Reverse-engineering a Roku to control background lights2 people · 2 mentions · first linked 2021-05-19
What Hacker News says?
Smart TV SoCs usually have a capture engine that taps into the video stream being sent to the screen after HDCP decryption and allows it to be DMA'd directly to main RAM [1], and from there analyzed and sent to the manufacturer's ad partner of choice. As long as the firmware does not allow the end user to access these decrypted frames in any way, the TV will still pass HDCP certification with no issues. [1] https://…
Comment linking /roku-tv-philips-hues
on “Vizio TVs are now showing banner ads over live TV”Submitted Reverse-engineering a Roku to control background lights as a story · 75 points
HN discussionWeb-based IDEs like VSCode on github just had a 1-click github token stealing vulnerability: https://blog.ammaraskar.com/github-token-stealing/ You could argue this is probably on GitHub for creating a token here that gives blanket access to all repos vs a scoped token for just the repo.
Comment linking /github-token-stealing/
on “Microsoft's open source tools were hacked to steal passwords of AI developers”Submitted Minecraft Vulnerability Advisory as a story · 13 points
HN discussionIt's not just based on that, if you read the linked report from 2023 ( https://blog.ammaraskar.com/vscode-rce/ ), I had a bug with the exact same impact of token exfiltration (It did need one additional click on the VSCode interface). They marked it as low severity, fixed it silently, didn't acknowledge that it had security impact and did not provide me any credit much less a bounty.
Comment linking /vscode-rce/
on “1-Click GitHub Token Stealing via a VSCode Bug”Submitted 1-Click GitHub Token Stealing via a VSCode Bug as a story · 3 points
HN discussionSubmitted Remote code execution bug in VSCode triggerable from untrusted workspaces as a story · 2 points
HN discussionSubmitted Gaining root access on a Roku TV to control lights as a story · 1 points
HN discussionSubmitted Reverse Engineering the iClicker Base Station as a story · 1 points
HN discussion