My Heart Bleeds for SurveyMonkey… Not

SurveyMonkey*, a popular free site for creating online surveys, is playing fast and loose with the truth about their exposure to the Heartbleed vulnerability.

As far as I can put the pieces together, they were indeed running the broken version of OpenSSL before this week’s public disclosure of Heartbleed, and they quickly patched their computers with the fixed version. They also sent e-mail to their user base, advising everyone to change passwords, which, while not an admission, is certainly a strong hint that users’ passwords may have been exposed.

What they won’t admit is that, for who-knows-how-long, their data was also at risk of exposure. By “their” data, I mean your and my and all their other users’ surveys and survey results. Probably not a big deal to many users, but certainly something you would expect a service provider to be honest about.

I tried to get a straight answer from them, but they refused to give one. Posted below is the e-mail conversation I had with them yesterday. While I don’t have a final answer from them yet, it appears unlikely I will get one. The support person, Ian, offers at the end to take my question to the technical team on Monday. But no technical person will be able (permitted) to answer my question any more clearly than Ian.  The decision to fudge their answer came from Marketing/Communications, and the decision to stop fudging will have to come from there too.

I can’t tell you what you should do, dear reader, but you deserve at least to have accurate information when you’re deciding whether to trust a web site with your data.

_______________

* SurveyMonkey link: https://www.surveymonkey.com/



Date: Fri, 11 Apr 2014 17:33:00 -0700
To: (me and all the other SurveyMonkey users)
From: “SurveyMonkey” <surveymonkey@go.surveymonkey.com>
Subject: SurveyMonkey Heartbleed Security Update

Dear SurveyMonkey Customer,

On April 7, 2014, researchers disclosed a vulnerability in a technology called OpenSSL that powers encryption across much of the internet. The vulnerability is commonly known as the “OpenSSL Heartbleed Flaw.”

Our team took immediate action to secure SurveyMonkey’s infrastructure against this flaw. We closed any exposure that might have existed and wanted to let you know that SurveyMonkey is not vulnerable to the Heartbleed flaw.

Although we have no reason to believe that any part of our service has been improperly accessed due to this vulnerability, as a matter of best practice we would like to recommend that all our customers reset their passwords. To reset your password, visit My Account and change your password in the Login Details section of your Account Page.

Thank you for being a great customer. Happy surveying!
The SurveyMonkey Team


 

From: (me)
Sent: 4/11/2014 8:30 PM
To: support@surveymonkey.com
Subject: OpenSSL Heartbleed vuln

Your e-mail to users doesn’t actually say whether you were vulnerable to the Heartbleed exploit in the past — it only says you took immediate action and are not vulnerable now. Were you at any time running a vulnerable version of OpenSSL (1.0.1 through 1.0.1f) on any of your public-facing servers? Please give me a straight answer — I admin servers for a living, and I don’t suffer FUD gladly. Thanks,


 

From: support@surveymonkey.com
Date: 4/12/2014 12:06 AM
To: (me)
Subject: Re: OpenSSL Heartbleed vuln [ ref:_00D301HuKJ._50030Tmot8:ref ]

Hi ,

We promptly did a thorough assessment of our site to resolve any exposure that might have existed and are happy to let you know that SurveyMonkey is no longer at risk to the Heartbleed flaw. We have no reason to believe that any part of our service was improperly accessed due to any exposure that may have existed.

Due to our security policy, we are not able to disclose any specifics on our production infrastructure.  Your confidence is of the highest importance to us and we have taken pains to ensure that customer and survey data remain secure.

You can confirm this via an independent Heartbleed vulnerability test site, such as http://filippo.io/Heartbleed/#surveymonkey.com:443

If you have any additional questions about the SSL encrpytion used on our site, you can learn more about it in the following FAQ:http://help.surveymonkey.com/articles/en_US/kb/What-is-the-enhanced-security-option-SSL-encryption

You can also review our security policy here:https://www.surveymonkey.com/mp/policy/security/

All the best,

Ian
Product Support Specialist


From: (me)
To: support@surveymonkey.com
Date: 4/12/2014 12:37 AM
Subject: Re: OpenSSL Heartbleed vuln [ ref:_00D301HuKJ._50030Tmot8:ref ]

Really, Ian? Really? I understand that you can’t tell me any more than the marketing suits will allow you to tell me. But I think I can read between the lines of “SurveyMonkey is no longer at risk to the Heartbleed flaw.” Yeah, “…no longer…”

In other words, at some point SurveyMonkey was running the vulnerable version of OpenSSL on public facing servers.

I know you’re just doing your job, but would you please pass this up the line: that this customer, who is a 30-year veteran system administrator, thinks it’s absolutely slimy that SurveyMonkey won’t disclose such a major vulnerability to its users. At Georgia Tech, where I’m on a team that admins about 1000 Linux servers, if our department tried to hide something like this from the departments that are our customers, there would be hell to pay. And rightly so.

I’ll post your non-reply, along with this message, on Facebook, so that at least my friends know what kind of company SurveyMonkey is.

I’m sorry, Ian, that you personally are forced to be caught in the middle of this farce.

Kind regards to you, Ian


From: support@surveymonkey.com
To: (me)
Date: 4/12/2014  12:57 AM
Subject: Re: OpenSSL Heartbleed vuln [ ref:_00D301HuKJ._50030Tmot8:ref ]

Hi ,

I can certainly understand that you’re concerned and I will definitely send this over to my technical team for further review. However, since it is late on a Friday, you can most likely expect a response on Monday.

Thanks for your patience on this matter. Have a good rest of your weekend.

Warm regards,

Ian
Product Support Specialist

Haiku to ______

We could still be friends
As far as I am concerned
Or more. But you won’t.

Pope Francis and Teh Gay: So What?

In the name of all rational, clear, critical thinking, WHY are so many of my liberal friends all ga-ga over the Pope’s recent comments about gay people?*

The Catholic Church, including this Pope, still holds that homosexual acts are always serious sins. “Hate the sin, love the sinner” infuriates us when it comes from the evangelical side; why does the Roman church get a pass?

Moreover, Catholic doctrine still holds that a homosexual orientation, while not a sin, is “disordered.” This from the 1986 official statement of doctrine:**

“Although the particular inclination of the homosexual person is not a sin, it is a more or less strong tendency ordered toward an intrinsic moral evil; and thus the inclination itself must be seen as an objective disorder.”

Some say that, even though Pope Francis’ comments are in line with decades of church teaching, at least they represent progress compared to his predecessor. But to say that Francis is not as bad as Benedict is to damn him with faint praise indeed.

Add to all this the fact that the Catholic church has given no indication that they plan to stop fighting against marriage equality in the civil sphere, and you are left with a nice man fronting a well-executed PR campaign on behalf of an institution that continues its centuries long tradition of preaching the good news of love, while practicing the the ancient evil of hate.

————————————————————————————

*  For example: http://believe-out-loud.tumblr.com/post/56787003555/as-reported-by-huffington-post-pope-francis

** http://www.vatican.va/roman_curia/congregations/cfaith/documents/rc_con_cfaith_doc_19861001_homosexual-persons_en.html

Two Nights

This is a reflection paper that I wrote in the fall of 2009 for my New Testament survey class in seminary. I’m posting it now because it came up in a conversation.

Luke is the only canonical Gospel that includes the birth narrative. What are we to make of that?

Psalm 23 declares, “Thou art with me.” An individual woman or man is speaking directly to God about God’s presence with her or him personally. It is, as far as I know, unique in all of Scripture in stating this truth in this way. What are we to make of that?

My own contemplative prayer practice has evolved while I’ve been at seminary. Adapting Thich Nhat Hanh’s breath prayer, I found that I could center myself for worship by repeating silently, “Breathing in, Your spirit enters and fills me. Breathing out, I love.” I began to use it in other settings. When I was walking the labyrinth this summer, it helped me to focus on the spiritual, as it soothed and quieted the mental. Seeking to detach from the physical as well, I switched to something even simpler, with no reference to breath. As I walked, I repeated, and contemplated, a pair of four-word selections from Scripture: “Thou art with me. Thy will be done.”

“Lovely,” I hear the reader ask, “but what has this to do with Luke’s birth narrative?”

The birth narrative in Chapter 2 is one of only two scenes in Luke that takes place at night. The other is Jesus’ last night in this life, on the Mount of Olives, in the Garden of Gethsemane.

These two night scenes frame Jesus’ life. Their literary function is that they help to unify a long, meandering story: reading about the last night reminds us of, and carries us back to, the first night. But what is their gospel function?

Let’s return for a moment to my contemplative prayer. Its two parts together summarize, for me, the essentials of my faith. The deceptive simplicity of “Thou art with me” actually encompasses complex wisdom about the nature of God and the nature of my relationship with God. Ours is a personal God, addressed directly, and addressed with familiar, rather than formal, pronouns. While this God may be in Heaven, as many gods are said to be, our God is also as immanent as can be – right here with me. Similarly, “Thy will be done” is a nugget whose small size belies the magnitude of its meaning. It is not only an acknowledgement that our God indeed has a will for us, inviting us to learn what it might be; it is also our promise of commitment to serving that will.

Moreover, the two parts of the prayer are interrelated.  To apprehend God’s will can be terrifying – awe-full. Sureness of God’s presence with me is the only thing that can comfort me enough to feel safe in the face of this awe. Going through the prayer in the other direction, it says that, while God’s presence with me may be comforting, it is not enough to give the relationship its full meaning. The second half is the necessary further development – my reciprocation of God’s presence is my acceptance of God’s will and its implications for how I am to live.

The two nighttime scenes in Luke teach lessons similar to those of the prayer. The Nativity, especially with the intimate detail of Luke’s story, is a narrative way of expressing “Thou art with me,” God’s presence is now here, in our human world. On the Mount of Olives, the very last prayer we hear from Jesus’ lips, even as he is fully cognizant of the gravity of the moment, is “Thy will be done.” Ultimately, a relationship with God calls us to whatever is necessary to fulfill God’s intention for humanity.

Just as most of the rest of Luke’s Gospel narrative tells the story that links those two scenes, the rest of his Gospel message explores the implications of the two principles that the scenes represent. It fills in the spaces to help us understand the connections between love and service, between comfort and call, between birth and death, between “with me” and “Thy will.”

Choice and Queerness

A friend of mine wrote a thought-provoking blog post about the issue of whether being gay is a choice, and whether it matters if it’s a choice or not. Part of what makes her essay so good is that it’s intentionally not from a theoretical viewpoint; it’s based on her own personal experience. When I told her it connected with some thoughts I’d been having recently, she encouraged (urged? demanded?) that I write my own post on the topic. I can’t improve on what she said in her essay, but I can bring my own story to it, a story that’s both similar to and different from hers.

I’m queer. I’m not a lesbian, but rather a bisexual transsexual (which is fun to say out loud, if nothing else). Both my gender transition and my sexual orientation have raised questions of choice for me.

This post will look at my gender transition, which took place during the period mid-’05 to mid-’06. It was in the time preceding that transition that questions of choice came to the fore. One obvious question: did I have a choice about my inner feeling of femaleness? To that I would say no. In the course of counseling, I went back all the way to age 4 in my memories, and that feeling of femaleness, along with the desire to act on it, had been there all along. I won’t hold any 4-year-old accountable for making bad life choices, myself included. So it wasn’t a choice then. As I grew up, and on into adulthood, I tried to make the feelings go away by force of will; that is, I tried to choose not to feel female inside. When I had still not succeeded by the age of 53, I had to admit that it looked a lot more like part of who I was, than a feeling I chose to have; and if that’s what it looked like over the course of half a century, it very likely really was what it looked like.

That was lesson one about choice: sometimes you just are who you are, and you don’t have a choice.

Certainly that realization of powerlessness over something so big contributed to the unprecedented wave of depression that then enveloped me at that time. As sort of a Plan B, since I couldn’t make the feeling just go away, I did my best to research what could cause something that was so resistant to will power. Fortunately, I was working at the University of Michigan at the time, where the graduate library has excellent collections on gender, both from the feminist and from the transgender points of view; there’s also a medical library for the university’s med school. Surely, in all that, I should be able to find an answer to this problem of having no choice about feeling like the wrong sex – maybe a hormonal imbalance, or childhood abuse, or a traumatic brain injury in my past.

Six months, dozens of books, and hundreds of articles later, I surrendered. The answer was simply this: some people just feel like the opposite sex inside, in their hearts, minds, and spirits. Nobody knows why. And when the feeling is strong and persistent, the only relief is found in transitioning to the sex that a person feels like inside.

Having now accepted that I had no choice about feeling this way, I saw that I did have a choice about what to do about it. Neither alternative appealed to me, though: continue to struggle for the rest of my life as I had for the preceding 50 years; or turn my life completely upside down and live the rest of my life as a woman. Choosing gender transition carried the risk of losing relationships with family and friends, and possibly losing my job as well. Choosing not to transition carried the risk of never escaping the clutches of deep depression, and the certainty of never escaping the feeling of being a different sex inside myself than I was on the outside.

Lesson two: having a choice doesn’t necessarily mean that any of the options looks really desirable.

I couldn’t decide. I went for long walks. I got drunk a lot. I prayed. I cursed God. I considered suicide. I joined a gender group, then switched to another. I talked endlessly with my counselor, my wife, my gender groups, and anyone else who would listen. None of those things made the choice for me. At the time, I thought I was deferring making the choice, but I see now that to defer was itself to choose – to make a choice for the status quo.

Let’s call that lesson three: having a choice can free you from one of the alternatives. But it does not free you from having to choose; in fact, it obligates you to choose.

As I said at the beginning, I did end up choosing transition. I felt that I could no longer stand feeling as bleak and as sad as I had for the preceding year. If transition could relieve that depression, I just didn’t have the will to fight it any longer. I took my chances on the consequences of that choice. As it turned out, I lost my marriage and with it, the ability to live in the same house with my then-5-year-old daughter as I watched her grow up. There were also some collateral material losses. By and large, though, none of the other feared consequences came to pass.

But it still didn’t feel like a choice really, not a free choice. You may say that I could’ve chosen to wait one more day; since I’d waited so many days already, what difference would one more make? And the same argument would apply the next day, and the next. Why should I ever have to choose transition? The analogy I’ll use here is holding your breath. If you can hold your breath for 10 seconds, surely you can choose to hold it for 11 seconds; what’s one more second? And if you do hold it for 11, then we know you can choose to wait one more second, so it’s your choice whether to hold your breath for 12 seconds. And on and on. But of course, eventually you have to breathe again; at some point, you can’t choose even that one more second. And as I continued to choose not to transition — by deferring making the choice — that one more day and one more day finally reached a point where I could not defer it one more day.

So I guess lesson four is something like this: sometimes logic tries to tell you that you have a choice, while nature is saying that you don’t have a choice. When that happens, nature eventually beats logic, every time.

In wrapping up, I want to touch on one more thing: this is my story, about my struggle with choice and queerness. It doesn’t prove or disprove anything about anyone else’s story. And nobody else’s story can prove or disprove mine. And that brings us to

Lesson five: Your mileage may vary.

An Old Prayer in New Words

Divine Spirit who fills the universe,
Sacred are all your names.
Your Way will be consummated on Earth,
As it already is in your heart,
When we all love one another
As you love all of us.
Please provide for our everyday needs;
Call us to no more than we can do,
And help us to do no less than you call us to.
This we ask, knowing that the beauty of your power
Will surely lead us to your Way.
Amen.

Death and Privilege

Quick! How many kids have been shot to death this year in Newtown, Connecticut?

That’s right, 20. That number is seared on our brains. How sad, how frightening.

“If it happened here it could happen anywhere,” said Danielle Collins, who attended a candlelight vigil in Newtown last night.

No, Ms. Collins, it could not happen anywhere. That’s the voice of privilege. You’re right, though, in this sense: We don’t expect kids to get shot in Newtown or places like it. That only happens in places like…

Quick! How many kids have been shot to death this year in Detroit, Michigan?

The answer is 21, but you didn’t know that, dear reader. Honestly, the only reason I know is because I spent a couple of hours researching it just now. And about that many kids were shot to death in Detroit in 2011, and 2010, and 2009, etc. How many child homicides were there in Newtown in those years? You know the answer without having to look it up.

Newtown is a bastion of privilege: 95% white and less than 2% black, median household income $111,000/year, 9 out of 10 people live in single family homes that they own. Unemployment is 6.1% and the poverty rate is 1.2%.

The comparable numbers for Detroit are: 11% white, 83% black, income $31,000, owner-occupied housing 49%, unemployment 15%, and poverty rate 35%.

Twenty dead kids in Newtown are national banner headline news; the same number of dead kids in Detroit… well, you can find the information if you look hard enough.

This is so unfair. Our white privilege is supposed to protect us from bad things. Our affluent enclaves are supposed to be safe for kids. As Ms. Collins said, if we can’t protect our privilege behind the barricades of Newtown, where can we?

And by the way, this is not about gun control. Oh sure, now we’re all screaming for gun control, but when the twentieth kid was killed in Detroit, the silence was deafening. And really, give me a break – nothing short of a national ban on handguns would have made a difference in Newtown. Remember, the guns belonged to the killer’s mom. Realistically, a retired white kindergarten teacher in an affluent white suburb will never be denied a gun.

No, the gun control reaction is just part of the overall emotional reaction of sadness and fear. We affluent and middle-class white people are afraid, because we never expected that violence would find us. Sure, we expect violence in Detroit; that’s just the way it is, right? We are sad because children are dead, but we are especially sad because the dead children in Newtown look like our own children. The poor, black little faces in Detroit don’t touch our hearts in quite the same way, and so they don’t make the national headlines.

It chills me and it sickens me to say it: our extreme emotional reaction, and the resultant screaming headlines, are about nothing but privilege.

References and credits:

http://factfinder2.census.gov/faces/tableservices/jsf/pages/productview.xhtml?pid=DEC_10_DP_DPDP1

http://www.newtown.org/pdf/NewtownFactSheet.pdf

http://chamspage.blogspot.com/2012/05/2012-detroit-homicidesmurders-partial.html

http://chamspage.blogspot.com/2011/12/detroit-homicide-statistics-age-ranges.html

http://en.wikipedia.org/wiki/Detroit

http://www.movin1077fm.com/cc-common/news/sections/newsarticle.html?feed=104668&article=10643188

http://www.areavibes.com/newtown-ct/employment/

http://zipatlas.com/us/mi/city-comparison/percentage-housing-units-occupied-by-owner.7.htm

http://www.mlive.com/news/detroit/index.ssf/2012/09/detroit_has_half_the_median_in.html

Follow

Get every new post delivered to your Inbox.