gsreenivas

This is a key reason for why I started Helm - thehelm.com. There's a lot of talk here about the hassle of self-hosting and while many HN folks are perfectly capable of running their own servers/services, it can be very time consuming. We take away the hassle and provide the benefits of self-hosting at home.

check out Helm - thehelm.com

check out Helm - https://thehelm.com

would have loved to see a secure element in this iteration/design to enhance the security of the hardware platform

yep - co-founder of Helm here

here's another review from Micah Lee at The Intercept for anyone who's interested: https://theintercept.com/2019/04/30/helm-email-server/

You may want to check out Helm - https://thehelm.com (I'm a co-founder)

This public review isn't be accident. For several years, an advocacy group that I was involved with briefly helped with achieving important milestones like a getting a chief privacy officer and a privacy advisory committee.

Fastmail users should be on notice with this legislation if they chose this service for privacy/security purposes.

Hey everyone, co-founder and CEO of Helm here. This post is a follow up to the thread keehun posted here: https://news.ycombinator.com/item?id=18238581

Looking forward to feedback and questions, thanks!

You missed some other ports including 25.

1.) it is globally accessible through the gateway it connects to 2.) for email services, you don't need much in the way of bandwidth for this to work very well.

There is no cable for stacking. The expansion units expose a USB-C male connector and plug into the base unit's USB-C female connector.

there is no remote administrative access from the EC2 instance or anywhere

There's an easy way to make Helm entirely uninteresting to spammers and that is for the server to limit the number of outbound emails that can be sent at a number that normal people would never exceed but that doesn't allow enough volume to be interesting to a spammer. There are much easier/cheaper alternatives for spammers today too.

Thanks for the question and your support!

Yes - these ports are forwarded so customers can reach the server in their home from anywhere in the world.

Good question - tightly integrated hardware based security. To support secure boot, full disk encryption and ensure keys are well protected, we utilize a security chip in the SoC. This protects your data in the event of theft.

Quite a bit more transparency is coming - we will be publishing a series of posts going into more detail of how this works. In addition, we will be open sourcing quite a bit.

Because traffic to and from the server will be over TLS, there won't be plaintext messages in memory on the gateway. We specifically designed to avoid the problems you have outlined.

gotcha - thanks for clarifying

Hey mrgalaxy - thanks for your note. We will take a look at how we can support this more efficiently. Right now we don't because we support reverse DNS for all our customers.

Thanks for the feedback stevehawk. We'll look to support multiple domains - right now costs scale with the number of domains due to the simple fact of supporting reverse DNS.

It's possible but not something we would ever do. We are looking at STARTTLS Everywhere from EFF as means to help ensure that any cert changes would be tracked transparently.

#1 is something we will support via open source.

Not to mention having to wake up in the middle of the night when the VPS provider decides to reboot your VM so you can decrypt the volume on boot. Been there, done that for years.

The last bullet isn't intended to be a catch-all but to reflect the fact that we can't control what customers provide us via customer support.

I'm curious about how you arrived at the conclusion that we are capable of dragnet surveillance. Connections to/from the Helm server use TLS end to end.

Good guess and we looked at the i.MX but did not select that line of SoCs. We are using the Layerscape line of SoCs from NXP

Thanks!

Thanks for the feedback - we will take this into consideration.

because it's forwarding packets to/from the Helm server in the home

Hi there - co-founder and CEO of Helm here. It covers domain registrations, DNS records, the security gateway with a static IP that works around residential ISP limitations and storage for offsite encrypted backups. None of these would be able to run on the device itself.