Cory Doctorow, a great story teller, has written an essay arguing that there was a single “they” spending forty years killing the VCR, and that in 1998 “they” succeeded. It reminded me of Greek mythology, not least of all because I lived through the time and technology he speaks of and easily can check dates.

They disinvented the VCR. You might think that the reason we don’t have VCRs anymore is because VCRs were supplanted by DVDs, PVRs and streaming, but that’s not the case. They had it in for the VCR from the very start, and they never stopped trying to kill it. Eventually, they succeeded.

When I raised chronology concerns with him on Mastodon, his answer was that he was there. He attended the meetings, he reported the broadcast flag first, he worked on Grokster at EFF.

Just to be clear: I was at EFF when we argued Grokster. I worked on the case with Fred, who argued it on appeal, and helped strategize our SCOTUS appeal.

I suppose all of that is true, which makes him a valuable source with a particular perspective. It means he was a participant. And the participant’s account is where a historian differs, because a source is a source: it records, for the position it was written from, to be compared against dated artifacts.

Doctorow’s position is even a well-known one. The EFF loudly litigated the topic for two decades. It has an activist style of libertarian counsel with a particular settled view of 1201. Their view is actually their argument, as a lobby, and a fair one. But the fair EFF argument he is making is a fairly different thing from someone giving a fair history of what happened. His whole essay presents one argument as if it is the same thing as everyone’s shared history. However, from my view, his telling diverges from history at most of the points where his essay is trying to sound the most confident about what happened.

Consider how a historian’s discipline works. Fix the chronology before trying to dig into analysis, let alone cause. Name the actors and check any shift, whether they stayed the course. Read the primary source rather than the (always suspect) summary of it. Test the story against the counterfactual the author dismisses.

I will tell you straight up, for example, his essay cites Wikipedia for a Supreme Court opinion that the Library of Congress hosts as a PDF. I mean, WTF. Wikipedia? As source? Everybody must know by now that Wikipedia is a disgrace to data integrity, with more breaches than there are ships on the floor of the ocean.

I said on Mastodon I’d post what I found, so here’s a quick list of where I found myself choking the most on his essay.

Although it’s a table, for my own edification really, the sum of its parts reveals something bigger than the individual corrections. In every row the essay takes one actor only and says they are headed in one direction only. That’s suspicious on its own. Actual history is far, far more complex and interesting than this binary “good guy bad guy” perspective, with many actors moving around in many directions.

Betamax itself was decided by a Court that then flipped, they reversed on their own first vote. The DVD Forum that is said to have banned recording is who published the recordable standard. Record scratch? The broadcast flag was proposed by one arm of the government and then it was vacated by another arm of that same government. Cable was forced open by statute in 1996, and then it was held open by the FCC in 2003 and 2007, and then the D.C. Circuit vacated those FCC rules in 2013, with Congress ending the integration ban in 2014. That’s real history. Writing about the world you wish existed instead of the one we’re in is a different sort of skill.

None of the history lands as a simple and single will (bad guy) because the political landscape is a human contest. Imagine a soccer field with five teams on it and three goals. His essay writes team EFF’s view of the contest as being the whole thing, because it’s method to generate followers (e.g. subscribers, patrons).

This is where the participant versus observer framing problem returns. Doctorow is fighting for a side in the contest, calling people to adopt his view, by profession and by conviction. When a witness who fought the fight writes the history of the fight, the temptation is to record intent and defeats how it would serve one side. It’s natural to lobbyists, as that’s how they lobby. The historian is trained to watch for this exact thing, to seek a sense of balance.

What would mean balance here? It seems there’s a matter of dates. A mandate that was attempted in 2003 and vacated in 2005 reads obviously as the defeat of that mandate. There was a statute that preserved fair use in subsection (c)(1) and wrote a 1985 copy-protection scheme into subsection (k). Both of those belong in the account of VCR history.

Note what this simple observation gives the reader that a one-sided account did not. The essay tells us we are being pushed into a locked room. However, reading the artifacts tells us there were a whole bunch of big doors being opened: Carterfone in 1968 (hooray!), Section 629 in 1996, the CableCARD order and its encoding caps in 2003, the flag vacated in 2005, the integration ban in 2007. Each one of those is evidence of a regulator or a court forcing a device open over the objection of the incumbent. That’s not in the essay from the lobbyist who wants a world where the VCR can be built again. The archive already contains what we’re being told was taken away. But it’s still there.

His essay had a better place to go. Anti-circumvention law constrained formats that came after the VCR, and the industry drove us into that shit world within months of losing in court. That loss of freedom is well documented, and it is maddening, and should point us all at the remedy. While a forty-year grudge makes for excited mythology-telling to rabble-rouse (fund the EFF?) it’s not really what happened. I get the temptation to invent a battle of the gods with monsters and heroes and all that, but to be a historian is to dispense with the myths and tell the human story.

Doctorow’s memory of these years is a source for an archive, especially to show how the EFF thinks and operates. Historians are trained for a specific reason, to test the integrity of information, if not also respond and remediate the breaches. The archive as a whole usually shows something duller and more durable than any single source does: a licensing office, a standards body, a treaty annex, and similar giving us some options to work with, as boring as they are. The discipline of a historian treats Doctorow’s writing as just one source, and works to restore the whole picture based on facts, starting with a date.

Way back when, once upon a time, webshell meant a product. It was like having a shell for the web, one that you could buy.

Positive Software sold WebShell 2.2 in November 1998, as a browser application to manage files on your website. The oldest saved copy of the company site advertises it as a finished commercial release. Version 2.2 wasn’t the first, meaning that product name was already in use before the archive captured it the first time.

Today that word never seems to mean ordinary commercial software sold to people running web servers. We now speak of the almost complete opposite. It assumes unauthorized attackers have left scripts on servers they have cracked into. And yet, a harmless product name was in use for at least four years before anyone started calling it an attack method.

To be fair, the history of the web and shell both run a long time before webshell. So we should pay tribute to the roots.

First, however, look at the tools often cited as webshell origins, related to the rise of PHP in the early 2000s. c99 and r57 are the attack scripts of the mid-2000s. Each carries a date in its own code. r57 came from the Russian group RST, which was publishing by 2003, and the tool is attributed to 2004. c99 gives its author as tristram of the Captain Crunch Security Team, and carries a version history running back to November 2004, eight months before its download page was archived on ccteam.ru in July 2005. These groups were naming their tools with a technique that wasn’t new.

To put it another way, attackers wanted admin-level authorization. They wanted the same tools that admins already had, without the authentication step. Martin Geisler released PHP Shell by 2000, the year in its own copyright header, which ran commands on a web server through a browser. His own notes call it a stand-in for a telnet login, for maintaining your own site. Ugh, telnet should give you a clue about the level of security awareness back then. Rohitab Batra released CGI-Telnet, the same thing in Perl, and it was on his site by April 2001. Both were written and described as administrative software. You know, the thing telnet was terrible for because it was cleartext.

The capability for a webshell actually goes all the way back to the NCSA web server of 1993, which introduced the Common Gateway Interface, which let a web page run an outside program, and Server-Side Includes, which ran a shell command and placed its output into the page. Running commands on a server through a web request was possible in the first year the web had servers. The phf flaw, usually dated to its loud 1996 warning, was the widespread abuse of something the web was known to be doing to itself three years earlier.

And that brings us back to the roots, that running commands on someone else’s machine is old. The tool known as rsh (remote shell) shipped with Unix in 1983 and, as the name suggests, ran commands on another computer across a network. A webshell is just that, a shell running over the web, and really should have been named wsh, or at least websh.

The shell itself? It goes all the way back to 1965. Louis Pouzin coined the word at MIT for the command language of Multics, at the turn of that year. It’s worth looking at three things he came up with. He built the shell as an ordinary program rather than part of the operating system, which means anything able to reach it can hand it commands. He deliberately made a typed command and a stored program interchangeable, each able to stand in for the other. And he took his handling of commands and their arguments from earlier work by Christopher Strachey, inheriting the problem of quoting: deciding which characters in an input are data and which are instructions to be carried out.

Let me repeat that last thought. Data and commands are mixed. Every command injection since that decision has been a failure of that concept. He would have known better, had he studied the history of information security.

So in terms of priors, the webshell was something to make the first two work exactly as designed in the 1960s, using a new protocol thirty years later. Perhaps here’s a way to illustrate it:

To expand on those latter exciting bits, in January 2003 a security bulletin reported a flaw in a web hosting control panel with a feature named Webshell, and a Chinese security site translated that bulletin the same month. In both the word is capitalized and names a product. By May the same site used it lowercase and unexplained, in the middle of technique: upload a webshell, and write the webshell onto the target. By November a writer was explaining the mechanism in the same terms, that calling the file in a browser is what forms a webshell. By 2005 it was a filename, webshellv001.rar, and one item in a list of ways into a server, beside telnet.

Oh, telnet, thank god you’re gone.

The January bulletin and the May usage seem like a collision or the same thread. They are not, and reflect two different words. January gives the H-Sphere product, capitalized. May gives the ordinary term for an attacker’s script. That suggests the use of webshell as an ordinary term can be dated to that spring.

Technically, as one would expect, the Chinese hackers had worked with the remote shell over the web technique well before they adopted the English word. They wrote about 网页木马, web page trojan, on the xfocus forum from 2002. They ran ASP木马 and the 海阳顶端网 trojan, and that tool’s own site lists its versions, 第一版 and 2003版 among them, using the word webshell exactly nowhere. The technique wasn’t being labeled webshell yet.

I did find an interesting exception, on one of my favorite platforms ever. An account named quack described breaking into an IRIX server on xfocus, on a page dated August 2000, and used “web shell” in the attacker’s sense: the way he ran commands through the website before obtaining a proper shell. The saved copy dates from 2003, but I couldn’t find one earlier, so the 2000 timeframe is based on that later capture. Arguably that’s the earliest possible use, while I sit with the first confirmed use of the word in May 2003.

All that is to say Phrack ran seventy issues between 1985 and 2021 and never seemed to adopt the term. I queried nearly 1,000 articles and found webshell zero times. That contrasts with 2,730 lines that mention shell. Thirty-six years and not a drop.

So there’s the history. A commercial admin tool, a web-based file manager sold in 1998, carries the earliest use of the term anyone has found, and years later attackers picked it up to describe the same thing without authorization. The Chinese hackers between 2003 and 2005 are where the word settled into use as an attack method. The tool is in fact a nod to the shell designed in 1965 being reached over the web.