Cassandra Today

Another short reflection paper I wrote for my New Testament survey class in seminary, in the Fall of ’09.
This one is about Paul’s Letter to the Romans.

---

Romans and I have a wonderful relationship. It hasn’t always been easy – we’ve had our share of differences. To be honest, we still do sometimes. But it’s truly a long-term, loving relationship. I’d like to talk a little bit about what makes it work, or at least, what makes it work for me. If you want to know how he feels, you’ll have to ask him, although good luck with that – he’s not always comfortable with touchy-feely language.

Any good relationship has to be based on honesty. If you’re holding something back from each other, trust breaks down, and you lose faith in each other. Whenever I’m with Romans, I try to be present with a completely open heart. He’s the same way. He tells me what he thinks, what he believes, what he thinks is and isn’t important, and so on. I never have to play “guess what I’m thinking” with him. Sometimes he tells me more than I need to know at the moment, but that’s OK, better to say too much than too little.

Another really important thing is always showing how much you care about each other – not just caring, but showing it too. Part of that is making sure that you spend quality time together. It’s not enough just to be in the same room, you have to engage each other, have real conversations. I know I always feel better when I’ve been spending time with him regularly.

Of course, sometimes those conversations are easier than others. I don’t mean in a bad way… for instance, I’m a pretty emotional person, and he can be kind of intellectual and analytical sometimes. But if you care about each other, you make the effort. I try to listen really carefully, and he’s really patient about having to explain things more than once.

I don’t want to make it sound like he’s the one with all the answers. See, he hasn’t changed much over the years, and it seems like I’m starting something new all the time. So I can bring that to our time together, and help him understand and adapt to the way the world is now. He appreciates that, because a lot of people bring their questions to him, and he wants to be able to answer them in language they understand.

And speaking of being with someone else – that’s another thing that makes our relationship work – it goes back to that trust that I mentioned a few minutes ago. We’re completely loyal to each other. If somebody else needs him, I’m OK with that, because I know he’ll be there for me when I need him. And if I spend some time with Jude or Mark or even old Isaiah, he trusts me to come back to him. And I always do.

There’s something comforting about him, even though he can be so mental at times. Like even though he has a very clear sense of right and wrong, he’s still very accepting. He doesn’t judge people by surface things, like whether they’re male or female, or workers or bosses. He’s funny – he always says that he doesn’t even care if someone’s Jewish or Greek or whatever! It makes me feel safe around him, because I know he’s accepting of me too.

Another thing – he’s not one of those who are afraid to talk about love. When he says, “Owe no one anything, except to love,” or “Love is the fulfilling of the law”, I get all mushy inside – I never get tired of hearing things like that.

I guess that’s the bottom line – he’s all about love and faithfulness, and so am I. That’s really what’s at the heart of our wonderful relationship. And that’s what will keep us together for the rest of our lives.

I wrote this shortly after I had completed a major research project on the Gospel of Mark; and between my reading of the Letter to the Hebrews and our group discussion of it. Also, I listen to rock’n’roll when I’m staying up late writing and reading. Now you know how Mark, Hebrews, and the Go-Go’s ended up in the same essay.

 

 

You’re unforgiven

so go on living

knowing that I’ve unforgiven you

and my thanksgiving

came the day

I saw it was OK

to unforgive you

– The Go-Go’s

 

Maybe I’m oversensitive, having just spent 36 straight hours with the shadowy Gospel, Mark the Dark. But there’s something that really bothers me about Hebrews. It’s something that also used to bother me about Mark until yesterday, when I finally came up with a satisfactory understanding of it. It’s the same ambivalent feeling that I have about that song “Unforgiven” from the Go-Go’s 2004 CD God Bless the Go-Go’s (snippet above). It’s hard-driving rock’n’roll, and with lyrics like that, it’s a great break-up song if you’re the one who’s been dumped.

But now that I’m over my latest break-up (pretty much), I’m not as comfortable with the song. It’s clever, making “unforgive” a transitive verb, and part of going on after love lost is reclaiming your ego. But the sentiment seems so… un-Christian. Forgiving is good, not forgiving is not so good, but unforgiving someone? It seems too cold-hearted and permanent.

The troublesome Mark passage that I’m referring to is 3.29, when Jesus says, “…whoever blasphemes against the Holy Spirit can never have forgiveness, but is guilty of an eternal sin.” Same problem – it seems so cold-hearted and permanent, very un-Christ-like. I rescued this passage for myself in the context of the surrounding story. The religious authorities have just accused Jesus of knowing how to cast out demons because he is a demon himself, in league with the Devil; this passage is part of his response. He knows that really, he is God, so he is warning the priests and scribes that it’s dangerous to say God and the Devil are the same thing, because then you cut yourself off from access to salvation. It all comes from a misunderstanding of Jesus’ identity.

That rationalization doesn’t work with some of the Epistle to the Hebrews, though, like 6.4-6: “…It is impossible for those who have once been enlightened, who have tasted the heavenly gift, who have shared in the Holy Spirit, who have tasted the goodness of the word of God and the powers of the coming age, if they fall away, to be brought back to repentance.” (NIV) What?!? After I’ve repented and been baptized and forgiven, I’m still at risk of losing it? To be sure, “fall away” here means more than missing Sunday service – it carries the connotation of treachery or betrayal. But if a Christian converts to Judaism or Islam for a time – faiths that deny the truth of the Christian gospel – before realizing the error of their ways, is Hebrews saying they can’t ever come back?

Everything I understand about our Christian view of God says that God loves us so much that God acts with grace when faced with human sin. But this and similar passages in Hebrews seem to be saying that even grace has its limits. I’m not one to cherry-pick the parts of the Bible that I like, and pretend that the rest don’t exist. But I don’t know how to reconcile this passage with the Gospels or Paul. I suppose it’s a project that I’ll have to take on later. I’ll add it to my Biblical theology to-do list.

SurveyMonkey*, a popular free site for creating online surveys, is playing fast and loose with the truth about their exposure to the Heartbleed vulnerability.

As far as I can put the pieces together, they were indeed running the broken version of OpenSSL before this week’s public disclosure of Heartbleed, and they quickly patched their computers with the fixed version. They also sent e-mail to their user base, advising everyone to change passwords, which, while not an admission, is certainly a strong hint that users’ passwords may have been exposed.

What they won’t admit is that, for who-knows-how-long, their data was also at risk of exposure. By “their” data, I mean your and my and all their other users’ surveys and survey results. Probably not a big deal to many users, but certainly something you would expect a service provider to be honest about.

I tried to get a straight answer from them, but they refused to give one. Posted below is the e-mail conversation I had with them yesterday. While I don’t have a final answer from them yet, it appears unlikely I will get one. The support person, Ian, offers at the end to take my question to the technical team on Monday. But no technical person will be able (permitted) to answer my question any more clearly than Ian.  The decision to fudge their answer came from Marketing/Communications, and the decision to stop fudging will have to come from there too.

I can’t tell you what you should do, dear reader, but you deserve at least to have accurate information when you’re deciding whether to trust a web site with your data.

_______________

* SurveyMonkey link: https://www.surveymonkey.com/

---

---

Date: Fri, 11 Apr 2014 17:33:00 -0700
To: (me and all the other SurveyMonkey users)
From: “SurveyMonkey” <surveymonkey@go.surveymonkey.com>
Subject: SurveyMonkey Heartbleed Security Update

Dear SurveyMonkey Customer,

On April 7, 2014, researchers disclosed a vulnerability in a technology called OpenSSL that powers encryption across much of the internet. The vulnerability is commonly known as the “OpenSSL Heartbleed Flaw.”

Our team took immediate action to secure SurveyMonkey’s infrastructure against this flaw. We closed any exposure that might have existed and wanted to let you know that SurveyMonkey is not vulnerable to the Heartbleed flaw.

Although we have no reason to believe that any part of our service has been improperly accessed due to this vulnerability, as a matter of best practice we would like to recommend that all our customers reset their passwords. To reset your password, visit My Account and change your password in the Login Details section of your Account Page.

Thank you for being a great customer. Happy surveying!
The SurveyMonkey Team

---

 

From: (me)
Sent: 4/11/2014 8:30 PM
To: support@surveymonkey.com
Subject: OpenSSL Heartbleed vuln

Your e-mail to users doesn’t actually say whether you were vulnerable to the Heartbleed exploit in the past — it only says you took immediate action and are not vulnerable now. Were you at any time running a vulnerable version of OpenSSL (1.0.1 through 1.0.1f) on any of your public-facing servers? Please give me a straight answer — I admin servers for a living, and I don’t suffer FUD gladly. Thanks,

---

 

From: support@surveymonkey.com
Date: 4/12/2014 12:06 AM
To: (me)
Subject: Re: OpenSSL Heartbleed vuln [ ref:_00D301HuKJ._50030Tmot8:ref ]

Hi ,

We promptly did a thorough assessment of our site to resolve any exposure that might have existed and are happy to let you know that SurveyMonkey is no longer at risk to the Heartbleed flaw. We have no reason to believe that any part of our service was improperly accessed due to any exposure that may have existed.

Due to our security policy, we are not able to disclose any specifics on our production infrastructure.  Your confidence is of the highest importance to us and we have taken pains to ensure that customer and survey data remain secure.

You can confirm this via an independent Heartbleed vulnerability test site, such as http://filippo.io/Heartbleed/#surveymonkey.com:443

If you have any additional questions about the SSL encrpytion used on our site, you can learn more about it in the following FAQ:http://help.surveymonkey.com/articles/en_US/kb/What-is-the-enhanced-security-option-SSL-encryption

You can also review our security policy here:https://www.surveymonkey.com/mp/policy/security/

All the best,

Ian
Product Support Specialist

---

From: (me)
To: support@surveymonkey.com
Date: 4/12/2014 12:37 AM
Subject: Re: OpenSSL Heartbleed vuln [ ref:_00D301HuKJ._50030Tmot8:ref ]

Really, Ian? Really? I understand that you can’t tell me any more than the marketing suits will allow you to tell me. But I think I can read between the lines of “SurveyMonkey is no longer at risk to the Heartbleed flaw.” Yeah, “…no longer…”

In other words, at some point SurveyMonkey was running the vulnerable version of OpenSSL on public facing servers.

I know you’re just doing your job, but would you please pass this up the line: that this customer, who is a 30-year veteran system administrator, thinks it’s absolutely slimy that SurveyMonkey won’t disclose such a major vulnerability to its users. At Georgia Tech, where I’m on a team that admins about 1000 Linux servers, if our department tried to hide something like this from the departments that are our customers, there would be hell to pay. And rightly so.

I’ll post your non-reply, along with this message, on Facebook, so that at least my friends know what kind of company SurveyMonkey is.

I’m sorry, Ian, that you personally are forced to be caught in the middle of this farce.

Kind regards to you, Ian

---

From: support@surveymonkey.com
To: (me)
Date: 4/12/2014  12:57 AM
Subject: Re: OpenSSL Heartbleed vuln [ ref:_00D301HuKJ._50030Tmot8:ref ]

Hi ,

I can certainly understand that you’re concerned and I will definitely send this over to my technical team for further review. However, since it is late on a Friday, you can most likely expect a response on Monday.

Thanks for your patience on this matter. Have a good rest of your weekend.

Warm regards,

Ian
Product Support Specialist