The category of antisemitism that Republican State Sen. Peter Oberacker practices has a name in German scholarship: Schuldabwehr-Antisemitismus or “guilt defense”,

Adorno’s 1959 lecture and Schönbach’s 1961 study made this clear, so it’s no surprise to anyone. The defining move is the defense of the perpetrators’ memory at the expense of the victims’. Oberacker posted a photo of Hitler’s soldier on Veterans Day 2015 with the caption “gave his life for his country,” and when the post resurfaced in August 2026 he added “war sucks,” “veterans of all conflicts,” and “didn’t have a choice.” Each sentence exists

Wehrmacht criminality was in evidence at Nuremberg in 1946 and tried separately in the High Command case in 1947 and 1948. The Hamburg Institute’s exhibition ran from 1995 and again from 2001. Germany’s own national Veteranentag, approved by the Bundestag in 2024 and first observed June 15, 2025, covers Bundeswehr veterans only. The Federal Republic declines to salute its predecessor army. An American congressional candidate applies a far weaker standard to the Wehrmacht than the German defense ministry does. And think about it in American terms. Memorial Day was created to honor the Union soldiers who died defending America against the Slaveholder Rebellion. To say an enemy of the state, the Wehrmacht or the Confederacy, should be memorialized the same as the people killed trying to stop them, is nonsense.

The Bundeswehr’s 2018 Traditionserlass states that for the armed forces of a democratic constitutional state the Wehrmacht as an institution cannot found tradition; individual Wehrmacht members may be included only after case-by-case examination that weighs personal guilt and requires an exemplary act, such as participation in the military resistance.

That is antisemitism as the scholarship defines it, met in the 2015 caption and three more times in just one interview about it. The IHRA examples include denying the mechanisms of the genocide. The Wehrmacht was a mechanism, and a defense of the Wehrmacht that never names what it did erases that mechanism and harms the victims. So the claim is exact: he committed an easily recognized form of antisemitism, in public, and then he defended it, which is itself another level of antisemitism.

How did he defend it? By falsely accusing others of antisemitism. Take a look at his methods of disinformation.

For Mamdani, an elected official, and Piker, a streamer who holds no office, the record consists of positions on Israel and Zionism; neither has a documented statement expressing hostility to Jews as Jews, and the IHRA definition itself states that criticism of Israel like that leveled at any other country cannot be regarded as antisemitic. He undermines the definition, as he fails to understand that his accusations only make himself look more antisemitic. It is antisemitic to make every Jew answerable for an Israeli government, which is what Oberacker’s accusations do when they treat criticism of Israel as an offense. Jews can live outside of Israel, and Jews everywhere criticize Israel. Zionism itself is of Christian political lineage that predates Jewish political campaigns by half a century. Restorationism, from Shaftesbury’s 1840 memorandum to Palmerston through Balfour, wanted Jews settled in Palestine partly to remove them from Europe, an aim it shared with the antisemites of the period. A political idea with that ancestry can and should be criticized, especially given the foundational hostility to Jews (treating them as disposable tools for political purposes).

Or look at his accusations against politician Platner. It’s almost too stupid to believe. The evidence is a tattoo Platner says he got it as a Marine without knowing and has since covered it. A skull resembling the Totenkopf circulates in military settings because of a culture that reads Wehrmacht and SS insignia as period detail rather than as antisemitism. That culture is the exact same one Oberacker practices when he reads an actual Hoheitsadler on his grandfather’s chest as circumstance. The accusation of Oberacker should be pointed at himself, because the standard he applied to Platner convicts himself first in 2015.

The antisemitism of Oberacker has no content about Jews, and that’s his whole game. He erases the people who are meant to be protected, because he uses it to enable himself instead.

It is a designation he assigns to his opponents and withholds from allies and ancestors. Look at how he hired as campaign manager Bobby Walker, a Young Republican officer who took part in a leadership group chat that praised Hitler, and removed him only after Politico published the messages in October 2025. A man who very clearly and openly practices antisemitism while prosecuting others on evidence he would never accept against himself is not a flawed opponent of antisemitism. He is an active participant, where he doesn’t need to help living or dead Jews at all, because his use is only for his own political benefit.

Cory Doctorow, a great story teller, has written an essay arguing that there was a single “they” spending forty years killing the VCR, and that in 1998 “they” succeeded. It reminded me of Greek mythology, not least of all because I lived through the time and technology he speaks of and easily can check dates.

They disinvented the VCR. You might think that the reason we don’t have VCRs anymore is because VCRs were supplanted by DVDs, PVRs and streaming, but that’s not the case. They had it in for the VCR from the very start, and they never stopped trying to kill it. Eventually, they succeeded.

When I raised chronology concerns with him on Mastodon, his answer was that he was there. He attended the meetings, he reported the broadcast flag first, he worked on Grokster at EFF.

Just to be clear: I was at EFF when we argued Grokster. I worked on the case with Fred, who argued it on appeal, and helped strategize our SCOTUS appeal.

I suppose all of that is true, which makes him a valuable source with a particular perspective. It means he was a participant. And the participant’s account is where a historian differs, because a source is a source: it records, for the position it was written from, to be compared against dated artifacts.

Doctorow’s position is even a well-known one. The EFF loudly litigated the topic for two decades. It has an activist style of libertarian counsel with a particular settled view of 1201. Their view is actually their argument, as a lobby, and a fair one. But the fair EFF argument he is making is a fairly different thing from someone giving a fair history of what happened. His whole essay presents one argument as if it is the same thing as everyone’s shared history. However, from my view, his telling diverges from history at most of the points where his essay is trying to sound the most confident about what happened.

Consider how a historian’s discipline works. Fix the chronology before trying to dig into analysis, let alone cause. Name the actors and check any shift, whether they stayed the course. Read the primary source rather than the (always suspect) summary of it. Test the story against the counterfactual the author dismisses.

I will tell you straight up, for example, his essay cites Wikipedia for a Supreme Court opinion that the Library of Congress hosts as a PDF. I mean, WTF. Wikipedia? As source? Everybody must know by now that Wikipedia is a disgrace to data integrity, with more breaches than there are ships on the floor of the ocean.

I said on Mastodon I’d post what I found, so here’s a quick list of where I found myself choking the most on his essay.

Although it’s a table, for my own edification really, the sum of its parts reveals something bigger than the individual corrections. In every row the essay takes one actor only and says they are headed in one direction only. That’s suspicious on its own. Actual history is far, far more complex and interesting than this binary “good guy bad guy” perspective, with many actors moving around in many directions.

Betamax itself was decided by a Court that then flipped, they reversed on their own first vote. The DVD Forum that is said to have banned recording is who published the recordable standard. Record scratch? The broadcast flag was proposed by one arm of the government and then it was vacated by another arm of that same government. Cable was forced open by statute in 1996, and then it was held open by the FCC in 2003 and 2007, and then the D.C. Circuit vacated those FCC rules in 2013, with Congress ending the integration ban in 2014. That’s real history. Writing about the world you wish existed instead of the one we’re in is a different sort of skill.

None of the history lands as a simple and single will (bad guy) because the political landscape is a human contest. Imagine a soccer field with five teams on it and three goals. His essay writes team EFF’s view of the contest as being the whole thing, because it’s method to generate followers (e.g. subscribers, patrons).

This is where the participant versus observer framing problem returns. Doctorow is fighting for a side in the contest, calling people to adopt his view, by profession and by conviction. When a witness who fought the fight writes the history of the fight, the temptation is to record intent and defeats how it would serve one side. It’s natural to lobbyists, as that’s how they lobby. The historian is trained to watch for this exact thing, to seek a sense of balance.

What would mean balance here? It seems there’s a matter of dates. A mandate that was attempted in 2003 and vacated in 2005 reads obviously as the defeat of that mandate. There was a statute that preserved fair use in subsection (c)(1) and wrote a 1985 copy-protection scheme into subsection (k). Both of those belong in the account of VCR history.

Note what this simple observation gives the reader that a one-sided account did not. The essay tells us we are being pushed into a locked room. However, reading the artifacts tells us there were a whole bunch of big doors being opened: Carterfone in 1968 (hooray!), Section 629 in 1996, the CableCARD order and its encoding caps in 2003, the flag vacated in 2005, the integration ban in 2007. Each one of those is evidence of a regulator or a court forcing a device open over the objection of the incumbent. That’s not in the essay from the lobbyist who wants a world where the VCR can be built again. The archive already contains what we’re being told was taken away. But it’s still there.

His essay had a better place to go. Anti-circumvention law constrained formats that came after the VCR, and the industry drove us into that shit world within months of losing in court. That loss of freedom is well documented, and it is maddening, and should point us all at the remedy. While a forty-year grudge makes for excited mythology-telling to rabble-rouse (fund the EFF?) it’s not really what happened. I get the temptation to invent a battle of the gods with monsters and heroes and all that, but to be a historian is to dispense with the myths and tell the human story.

Doctorow’s memory of these years is a source for an archive, especially to show how the EFF thinks and operates. Historians are trained for a specific reason, to test the integrity of information, if not also respond and remediate the breaches. The archive as a whole usually shows something duller and more durable than any single source does: a licensing office, a standards body, a treaty annex, and similar giving us some options to work with, as boring as they are. The discipline of a historian treats Doctorow’s writing as just one source, and works to restore the whole picture based on facts, starting with a date.

Way back when, once upon a time, webshell meant a product. It was like having a shell for the web, one that you could buy.

Positive Software sold WebShell 2.2 in November 1998, as a browser application to manage files on your website. The oldest saved copy of the company site advertises it as a finished commercial release. Version 2.2 wasn’t the first, meaning that product name was already in use before the archive captured it the first time.

Today that word never seems to mean ordinary commercial software sold to people running web servers. We now speak of the almost complete opposite. It assumes unauthorized attackers have left scripts on servers they have cracked into. And yet, a harmless product name was in use for at least four years before anyone started calling it an attack method.

To be fair, the history of the web and shell both run a long time before webshell. So we should pay tribute to the roots.

First, however, look at the tools often cited as webshell origins, related to the rise of PHP in the early 2000s. c99 and r57 are the attack scripts of the mid-2000s. Each carries a date in its own code. r57 came from the Russian group RST, which was publishing by 2003, and the tool is attributed to 2004. c99 gives its author as tristram of the Captain Crunch Security Team, and carries a version history running back to November 2004, eight months before its download page was archived on ccteam.ru in July 2005. These groups were naming their tools with a technique that wasn’t new.

To put it another way, attackers wanted admin-level authorization. They wanted the same tools that admins already had, without the authentication step. Martin Geisler released PHP Shell by 2000, the year in its own copyright header, which ran commands on a web server through a browser. His own notes call it a stand-in for a telnet login, for maintaining your own site. Ugh, telnet should give you a clue about the level of security awareness back then. Rohitab Batra released CGI-Telnet, the same thing in Perl, and it was on his site by April 2001. Both were written and described as administrative software. You know, the thing telnet was terrible for because it was cleartext.

The capability for a webshell actually goes all the way back to the NCSA web server of 1993, which introduced the Common Gateway Interface, which let a web page run an outside program, and Server-Side Includes, which ran a shell command and placed its output into the page. Running commands on a server through a web request was possible in the first year the web had servers. The phf flaw, usually dated to its loud 1996 warning, was the widespread abuse of something the web was known to be doing to itself three years earlier.

And that brings us back to the roots, that running commands on someone else’s machine is old. The tool known as rsh (remote shell) shipped with Unix in 1983 and, as the name suggests, ran commands on another computer across a network. A webshell is just that, a shell running over the web, and really should have been named wsh, or at least websh.

The shell itself? It goes all the way back to 1965. Louis Pouzin coined the word at MIT for the command language of Multics, at the turn of that year. It’s worth looking at three things he came up with. He built the shell as an ordinary program rather than part of the operating system, which means anything able to reach it can hand it commands. He deliberately made a typed command and a stored program interchangeable, each able to stand in for the other. And he took his handling of commands and their arguments from earlier work by Christopher Strachey, inheriting the problem of quoting: deciding which characters in an input are data and which are instructions to be carried out.

Let me repeat that last thought. Data and commands are mixed. Every command injection since that decision has been a failure of that concept. He would have known better, had he studied the history of information security.

So in terms of priors, the webshell was something to make the first two work exactly as designed in the 1960s, using a new protocol thirty years later. Perhaps here’s a way to illustrate it:

To expand on those latter exciting bits, in January 2003 a security bulletin reported a flaw in a web hosting control panel with a feature named Webshell, and a Chinese security site translated that bulletin the same month. In both the word is capitalized and names a product. By May the same site used it lowercase and unexplained, in the middle of technique: upload a webshell, and write the webshell onto the target. By November a writer was explaining the mechanism in the same terms, that calling the file in a browser is what forms a webshell. By 2005 it was a filename, webshellv001.rar, and one item in a list of ways into a server, beside telnet.

Oh, telnet, thank god you’re gone.

The January bulletin and the May usage seem like a collision or the same thread. They are not, and reflect two different words. January gives the H-Sphere product, capitalized. May gives the ordinary term for an attacker’s script. That suggests the use of webshell as an ordinary term can be dated to that spring.

Technically, as one would expect, the Chinese hackers had worked with the remote shell over the web technique well before they adopted the English word. They wrote about 网页木马, web page trojan, on the xfocus forum from 2002. They ran ASP木马 and the 海阳顶端网 trojan, and that tool’s own site lists its versions, 第一版 and 2003版 among them, using the word webshell exactly nowhere. The technique wasn’t being labeled webshell yet.

I did find an interesting exception, on one of my favorite platforms ever. An account named quack described breaking into an IRIX server on xfocus, on a page dated August 2000, and used “web shell” in the attacker’s sense: the way he ran commands through the website before obtaining a proper shell. The saved copy dates from 2003, but I couldn’t find one earlier, so the 2000 timeframe is based on that later capture. Arguably that’s the earliest possible use, while I sit with the first confirmed use of the word in May 2003.

All that is to say Phrack ran seventy issues between 1985 and 2021 and never seemed to adopt the term. I queried nearly 1,000 articles and found webshell zero times. That contrasts with 2,730 lines that mention shell. Thirty-six years and not a drop.

So there’s the history. A commercial admin tool, a web-based file manager sold in 1998, carries the earliest use of the term anyone has found, and years later attackers picked it up to describe the same thing without authorization. The Chinese hackers between 2003 and 2005 are where the word settled into use as an attack method. The tool is in fact a nod to the shell designed in 1965 being reached over the web.