Cory Doctorow, a great story teller, has written an essay arguing that there was a single “they” spending forty years killing the VCR, and that in 1998 “they” succeeded. It reminded me of Greek mythology, not least of all because I lived through the time and technology he speaks of and easily can check dates.

They disinvented the VCR. You might think that the reason we don’t have VCRs anymore is because VCRs were supplanted by DVDs, PVRs and streaming, but that’s not the case. They had it in for the VCR from the very start, and they never stopped trying to kill it. Eventually, they succeeded.

When I raised chronology concerns with him on Mastodon, his answer was that he was there. He attended the meetings, he reported the broadcast flag first, he worked on Grokster at EFF.

Just to be clear: I was at EFF when we argued Grokster. I worked on the case with Fred, who argued it on appeal, and helped strategize our SCOTUS appeal.

I suppose all of that is true, which makes him a valuable source with a particular perspective. It means he was a participant. And the participant’s account is where a historian differs, because a source is a source: it records, for the position it was written from, to be compared against dated artifacts.

Doctorow’s position is even a well-known one. The EFF loudly litigated the topic for two decades. It has an activist style of libertarian counsel with a particular settled view of 1201. Their view is actually their argument, as a lobby, and a fair one. But the fair EFF argument he is making is a fairly different thing from someone giving a fair history of what happened. His whole essay presents one argument as if it is the same thing as everyone’s shared history. However, from my view, his telling diverges from history at most of the points where his essay is trying to sound the most confident about what happened.

Consider how a historian’s discipline works. Fix the chronology before trying to dig into analysis, let alone cause. Name the actors and check any shift, whether they stayed the course. Read the primary source rather than the (always suspect) summary of it. Test the story against the counterfactual the author dismisses.

I will tell you straight up, for example, his essay cites Wikipedia for a Supreme Court opinion that the Library of Congress hosts as a PDF. I mean, WTF. Wikipedia? As source? Everybody must know by now that Wikipedia is a disgrace to data integrity, with more breaches than there are ships on the floor of the ocean.

I said on Mastodon I’d post what I found, so here’s a quick list of where I found myself choking the most on his essay.

Although it’s a table, for my own edification really, the sum of its parts reveals something bigger than the individual corrections. In every row the essay takes one actor only and says they are headed in one direction only. That’s suspicious on its own. Actual history is far, far more complex and interesting than this binary “good guy bad guy” perspective, with many actors moving around in many directions.

Betamax itself was decided by a Court that then flipped, they reversed on their own first vote. The DVD Forum that is said to have banned recording is who published the recordable standard. Record scratch? The broadcast flag was proposed by one arm of the government and then it was vacated by another arm of that same government. Cable was forced open by statute in 1996, and then it was held open by the FCC in 2003 and 2007, and then the D.C. Circuit vacated those FCC rules in 2013, with Congress ending the integration ban in 2014. That’s real history. Writing about the world you wish existed instead of the one we’re in is a different sort of skill.

None of the history lands as a simple and single will (bad guy) because the political landscape is a human contest. Imagine a soccer field with five teams on it and three goals. His essay writes team EFF’s view of the contest as being the whole thing, because it’s method to generate followers (e.g. subscribers, patrons).

This is where the participant versus observer framing problem returns. Doctorow is fighting for a side in the contest, calling people to adopt his view, by profession and by conviction. When a witness who fought the fight writes the history of the fight, the temptation is to record intent and defeats how it would serve one side. It’s natural to lobbyists, as that’s how they lobby. The historian is trained to watch for this exact thing, to seek a sense of balance.

What would mean balance here? It seems there’s a matter of dates. A mandate that was attempted in 2003 and vacated in 2005 reads obviously as the defeat of that mandate. There was a statute that preserved fair use in subsection (c)(1) and wrote a 1985 copy-protection scheme into subsection (k). Both of those belong in the account of VCR history.

Note what this simple observation gives the reader that a one-sided account did not. The essay tells us we are being pushed into a locked room. However, reading the artifacts tells us there were a whole bunch of big doors being opened: Carterfone in 1968 (hooray!), Section 629 in 1996, the CableCARD order and its encoding caps in 2003, the flag vacated in 2005, the integration ban in 2007. Each one of those is evidence of a regulator or a court forcing a device open over the objection of the incumbent. That’s not in the essay from the lobbyist who wants a world where the VCR can be built again. The archive already contains what we’re being told was taken away. But it’s still there.

His essay had a better place to go. Anti-circumvention law constrained formats that came after the VCR, and the industry drove us into that shit world within months of losing in court. That loss of freedom is well documented, and it is maddening, and should point us all at the remedy. While a forty-year grudge makes for excited mythology-telling to rabble-rouse (fund the EFF?) it’s not really what happened. I get the temptation to invent a battle of the gods with monsters and heroes and all that, but to be a historian is to dispense with the myths and tell the human story.

Doctorow’s memory of these years is a source for an archive, especially to show how the EFF thinks and operates. Historians are trained for a specific reason, to test the integrity of information, if not also respond and remediate the breaches. The archive as a whole usually shows something duller and more durable than any single source does: a licensing office, a standards body, a treaty annex, and similar giving us some options to work with, as boring as they are. The discipline of a historian treats Doctorow’s writing as just one source, and works to restore the whole picture based on facts, starting with a date.

Way back when, once upon a time, webshell meant a product. It was like having a shell for the web, one that you could buy.

Positive Software sold WebShell 2.2 in November 1998, as a browser application to manage files on your website. The oldest saved copy of the company site advertises it as a finished commercial release. Version 2.2 wasn’t the first, meaning that product name was already in use before the archive captured it the first time.

Today that word never seems to mean ordinary commercial software sold to people running web servers. We now speak of the almost complete opposite. It assumes unauthorized attackers have left scripts on servers they have cracked into. And yet, a harmless product name was in use for at least four years before anyone started calling it an attack method.

To be fair, the history of the web and shell both run a long time before webshell. So we should pay tribute to the roots.

First, however, look at the tools often cited as webshell origins, related to the rise of PHP in the early 2000s. c99 and r57 are the attack scripts of the mid-2000s. Each carries a date in its own code. r57 came from the Russian group RST, which was publishing by 2003, and the tool is attributed to 2004. c99 gives its author as tristram of the Captain Crunch Security Team, and carries a version history running back to November 2004, eight months before its download page was archived on ccteam.ru in July 2005. These groups were naming their tools with a technique that wasn’t new.

To put it another way, attackers wanted admin-level authorization. They wanted the same tools that admins already had, without the authentication step. Martin Geisler released PHP Shell by 2000, the year in its own copyright header, which ran commands on a web server through a browser. His own notes call it a stand-in for a telnet login, for maintaining your own site. Ugh, telnet should give you a clue about the level of security awareness back then. Rohitab Batra released CGI-Telnet, the same thing in Perl, and it was on his site by April 2001. Both were written and described as administrative software. You know, the thing telnet was terrible for because it was cleartext.

The capability for a webshell actually goes all the way back to the NCSA web server of 1993, which introduced the Common Gateway Interface, which let a web page run an outside program, and Server-Side Includes, which ran a shell command and placed its output into the page. Running commands on a server through a web request was possible in the first year the web had servers. The phf flaw, usually dated to its loud 1996 warning, was the widespread abuse of something the web was known to be doing to itself three years earlier.

And that brings us back to the roots, that running commands on someone else’s machine is old. The tool known as rsh (remote shell) shipped with Unix in 1983 and, as the name suggests, ran commands on another computer across a network. A webshell is just that, a shell running over the web, and really should have been named wsh, or at least websh.

The shell itself? It goes all the way back to 1965. Louis Pouzin coined the word at MIT for the command language of Multics, at the turn of that year. It’s worth looking at three things he came up with. He built the shell as an ordinary program rather than part of the operating system, which means anything able to reach it can hand it commands. He deliberately made a typed command and a stored program interchangeable, each able to stand in for the other. And he took his handling of commands and their arguments from earlier work by Christopher Strachey, inheriting the problem of quoting: deciding which characters in an input are data and which are instructions to be carried out.

Let me repeat that last thought. Data and commands are mixed. Every command injection since that decision has been a failure of that concept. He would have known better, had he studied the history of information security.

So in terms of priors, the webshell was something to make the first two work exactly as designed in the 1960s, using a new protocol thirty years later. Perhaps here’s a way to illustrate it:

To expand on those latter exciting bits, in January 2003 a security bulletin reported a flaw in a web hosting control panel with a feature named Webshell, and a Chinese security site translated that bulletin the same month. In both the word is capitalized and names a product. By May the same site used it lowercase and unexplained, in the middle of technique: upload a webshell, and write the webshell onto the target. By November a writer was explaining the mechanism in the same terms, that calling the file in a browser is what forms a webshell. By 2005 it was a filename, webshellv001.rar, and one item in a list of ways into a server, beside telnet.

Oh, telnet, thank god you’re gone.

The January bulletin and the May usage seem like a collision or the same thread. They are not, and reflect two different words. January gives the H-Sphere product, capitalized. May gives the ordinary term for an attacker’s script. That suggests the use of webshell as an ordinary term can be dated to that spring.

Technically, as one would expect, the Chinese hackers had worked with the remote shell over the web technique well before they adopted the English word. They wrote about 网页木马, web page trojan, on the xfocus forum from 2002. They ran ASP木马 and the 海阳顶端网 trojan, and that tool’s own site lists its versions, 第一版 and 2003版 among them, using the word webshell exactly nowhere. The technique wasn’t being labeled webshell yet.

I did find an interesting exception, on one of my favorite platforms ever. An account named quack described breaking into an IRIX server on xfocus, on a page dated August 2000, and used “web shell” in the attacker’s sense: the way he ran commands through the website before obtaining a proper shell. The saved copy dates from 2003, but I couldn’t find one earlier, so the 2000 timeframe is based on that later capture. Arguably that’s the earliest possible use, while I sit with the first confirmed use of the word in May 2003.

All that is to say Phrack ran seventy issues between 1985 and 2021 and never seemed to adopt the term. I queried nearly 1,000 articles and found webshell zero times. That contrasts with 2,730 lines that mention shell. Thirty-six years and not a drop.

So there’s the history. A commercial admin tool, a web-based file manager sold in 1998, carries the earliest use of the term anyone has found, and years later attackers picked it up to describe the same thing without authorization. The Chinese hackers between 2003 and 2005 are where the word settled into use as an attack method. The tool is in fact a nod to the shell designed in 1965 being reached over the web.

The plantation was the original demonstration that total ownership and total incapacity coexist. If you think that history clue sounds a lot like today’s techbro fascination with AI, then this post is for you.

A new post called “Everything I own, owned” is worth a critical assessment of what drives the author and how it reflects the state of risk management in society.

First, reflect on how the slave plantation owner held absolute legal dominion over land, buildings, people. He could not plant, could not harvest, could not repair, could not cook his own food. Every practical competence lived in the people he kidnapped, raped and held hostage. Travelers’ accounts of the antebellum South repeatedly note decaying great houses, exhausted soil, deferred maintenance everywhere. Dominion without stewardship produces negligence and decay as its normal condition.

Second, reflect on the fear of the Plantation owner. The master feared his own property. Slave revolts, poisoning, arson. The entire apparatus of patrols and pass laws existed because ownership of what you cannot understand and did not build is a permanent state of anxiety. The plantation owner claims mastery, while having nothing to back it up.

When you read the “I own” post, you find a voice of someone who declares himself dominant over the monitor, refusing and denying its “popup” for self-care, yet afraid to touch it himself. He claims he is doing the reverse engineering work, while it really is a prompt for AI and he is entirely dependent on the machine that did it. The fear is structural, produced by the gap between what he insists he commands and what he actually comprehends.

Third, reflect upon the Plantation accounting system. It recorded the estate as the owner’s achievement. Bales produced, acres cleared, all credited to the man who directed. The “I own” post says the GitHub repos fill with “generated-slop docs” credited under his name, where the churn hours are tallied like labor extracted, the usual byline on a false mastery narrative. The system that erases the laborer from the output is what seems to be left intact 160 years after the Slaveholder Rebellion was lost. When you know history of 1800s American “management” practices, here we see only the laborer has changed.

The post’s actual argument, stripped of the framing, is simply this: I told a machine what I wanted, it produced artifacts I mostly validated against real hardware, and now I’m worried other people will do the same thing maliciously.

Ok, so that’s a legitimate observation trying to elevate himself as dangerous by discovery, a form of self-loathing popularized in superhero comics. Who should have the power of Beowulf, strength of 30 men in one hand? However, this is different because the “Everything I own, owned” title transforms directed labor into personal mastery, which is precisely the ideological move that invokes plantation logic and makes it invisible to the person performing it.

The plantation owner doesn’t understand cotton or corn mash at the level the labor does. He understands command. He mistakes the power to direct for the competence to produce. Then he takes ownership of the output and writes about what he accomplished. Therefore the post title belongs to the agent. He specified goals. Claude did the reasoning, the tool use, the cross-validation, the documentation, the patch generation. This guy says he typed “keep going” and such 98 times and then called it his agent-driven research.

Here’s more detail on a specific example. He rejects his monitor manufacturer’s authority, from actual engineers who actually understand OLED degradation, and instead practices unexamined authority over Claude, whose outputs he also won’t fully trust. He’s too afraid to flash the patch. So he rejects the expert, says he commands the labor, and then can’t use his “own” product.

My ASUS ROG Swift PG42UQ monitor was actually where I started, because I got annoyed at the pop-up overlay that comes up every once in a while that tells me to run “pixel cleaning”. I have never intentionally run pixel cleaning on this monitor and I never will, I don’t care, and I would like for that overlay to go away forever. […] The pixel cleaning warning turns out to have no native way to disable it, and it’ll always show up after 8 hours of runtime. Oh well. Claude did find the appropriate area to patch to kill the functionality though. I haven’t actually been brave enough to write a modified firmware to the thing yet – it’s a pretty expensive monitor – but I’ll get there at some point.

I feel like I’m reading an Plantation owners guide to making bourbon, forcing a black man to figure it out and distill faster, where the ignorant Slaver even says he’s afraid to drink his “own” drink.

He believes he has maximized freedom from constraint (no pixel cleaning, no vendor tools, no authority over his hardware) and yet he hasn’t achieved the actual capacity to act effectively. His monitor is now neglected and governed by nobody. Not the manufacturer, not him.

Negative liberty is being mistaken for positive liberty.

There’s a Dunning-Kruger smell to this, where he has enough knowledge to feel confident rejecting expert guidance, and not enough to act on his own alternative. The reverse engineering process gives him procedural knowledge (how the firmware works), which he mistakes for the actual level of institutional knowledge embedded in the pixel cleaning feature. Years of OLED panel engineering and failure-mode data ignored, because of ignorance.

That’s someone craving epistemic autonomy without working to reach epistemic competence. He performs the dance of Enlightenment (reject received authority, reason from first principles) and stops far short, before the discipline that makes his moves legitimate. The Enlightenment actually demanded rigorous self-examination and accountability for conclusions. He substitutes automated, routine technical procedure for the discipline of thinking. Oh, the irony of becoming a useless cog while claiming to own the machine. Running reverse engineering tools is not even close to the same as understanding what the manufacturer knows about long-term OLED degradation, let alone electronics maintenance.

His github repo also shows pinned work with ATF Form 5320.23 generator (NFA firearms transfer paperwork), reverse engineering RH25 thermal weapon optics, and “rof-gui — Quantifies your dakka” (rate-of-fire measurement).

In conclusion, a graduate of North Carolina State University offers danger through a presence that withdraws accountability. He calls himself the “100% snowman” and ends “Everything I own, owned” with a melting face. The snowman melts in cheerful dissolution, like an invisibility privilege: I did something alarming, you should be afraid of it/me, shrug, melt.