Helm: Personal Email Server • Hacker News Board

Re: Helm: Personal Email Server

#221

Post by ryan-c » Wed, Oct 17, 2018, 3:23 PM UTC

pmoriarty wrote: post #153

gsreenivas wrote: post #43

Earlier quoted context omitted.

hey jawns, great question. I'm Giri Sreenivas, co-founder and CEO of Helm. To answer your question, ISPs block port 25 and email service providers typically reject emails coming from residential IP blocks. To build a plug and play solution, we knew that our server could not require listening for inbound connections on a residential internet connection. So we set about looking into how we could route traffic to and fr…

Since most email's not encrypted, how is having each Helm user's email hop through your server any better for them in terms of privacy than just hosting their email on a remote mail provider in the first place? You could still record every incoming and outgoing email as it goes through your server, couldn't you? I really don't see the advantage of Helm.

Most (gmail claims ~90%) email is encrypted with opportunistic TLS in transit and can't be passively monitored.

https://transparencyreport.google.com/safer-email/overview?h...

Further, "the provider could intercept email" and "the provider stores all email" are very very different.

Re: Helm: Personal Email Server

#222

Post by gsreenivas » Wed, Oct 17, 2018, 3:23 PM UTC

ThePhysicist wrote: post #212

gsreenivas wrote: post #195

Earlier quoted context omitted.

We spin our own build of Linux using Yocto. We are using an ARM-based SoC from NXP. We chose this to ensure that the device can only run signed, trusted code by implementing secure boot and signature verification of software updates. We will make a developer program available in the future. I didn't use Protonet so I shouldn't speculate about what's similar or different about the products. I think we are in a time ri…

Cool, thanks for sharing that info! While I think your approach is a bit extreme I hope you'll succeed, we need more solutions that put privacy, security and transparency first. It would be awesome if one could run your software on regular hardware though, as I really prefer a securely hosted server at a local data center to a computer sitting in my living room. Also, one year of limited warranty seems rather short f…

Thanks for your encouragement! I appreciate the feedback and keep tabs on our GitHub for what we open source down the road.

Re: Helm: Personal Email Server

#223

Post by lvh » Wed, Oct 17, 2018, 3:23 PM UTC

icedchai wrote: post #207

lvh wrote: post #157

Earlier quoted context omitted.

If I understand correctly, incoming e-mail actually goes to some EC2 host.

With this service, yes. That is because not every internet connection can actually successfully run an email server, which proves my point...

I wasn't debating your point; I was pointing out how this service accomplishes it without tripping over that problem. FWIW: I'm not sure that's actually how it works.

Re: Helm: Personal Email Server

#224

Post by pacuna » Wed, Oct 17, 2018, 3:23 PM UTC

Even if you dislike the idea or the price, you should be happy there are companies trying to change what has become a real privacy problem these days. At least for me, it gives me hope to think people out there are working on these issues and trying new approaches with new technology.

Re: Helm: Personal Email Server

#225

Post by TrueDuality » Wed, Oct 17, 2018, 3:23 PM UTC

You mention that you use a hardened Linux OS, but you don't discuss any of the other opensource software that you use. While you technically only have to distribute the sources to the people that receive your hardware, it would be nice to know these kinds of things before purchasing. This is a niche market you're marketing to that has a history of researching these kinds of things.

Are you using a custom distro or one of the off the shelf ones? What webserver (presumably there is one) is running on this? MTA? What're you using for backups? Is this just a ownCloud running under the hood with a tunnel to AWS and small proprietary layer on top?

Along different lines, how to do the backups work? Are they just stored on the device (what happens when its drive dies)? If not where are they stored and how much manual intervention is required. If your company goes under can I use any opensource software to decrypt the backups and access my emails?

Edit: With the list of sources in hand I can answer a lot of the questions I posited. So for others interested:

Distro: Still unknown, but see additional interesting tidbits.

Webserver: Neither nginx or apache are present. If I had to guess its using golang's net code to run any webserver / API that is present

MTA: postfix, dovecot, opendkim, opendmarc, spamassassin (might be more components I missed)

ownCloud: Doesn't appear so

backup software: Duplicity

backup location / process: Unknown

Interesting other tidbits:

OpenVPN is present, and so is ipsec-tools/strongswan. So they might be using either IPSec, OpenVPN or a combination of both for the tunnels. They could just be distribution defaults.

It's running docker, I'm guessing they're using some form of container image sync update system rather than a proper package manager.

It contains a fully developer toolchain, so presumably this is a full distribution rather than a minimized / custom one.

Based on the versions it appears the ARM processor is a QorIQ variant which is an ARM evolution of the PowerPC architecture.

Contains the libatomic libraries, so perhaps this is running on Fedora Atomic as an underlying OS? Would explain the presence of docker and give an idea how they're providing updates.

Appears to have a wifi chip (I couldn't find any information about connectivity on their site). Specifically it seems to be using a Qualcomm ath10k chip.

Re: Helm: Personal Email Server

#226

Post by hawski » Wed, Oct 17, 2018, 3:23 PM UTC

gsreenivas wrote: post #51

stevehawk wrote: post #36

I feel like I'm the target market for this as I pay for Fastmail .. 1 - how many domains can I use? I currently use ~6 with my Fastmail account 2 - can I have multiple users? I recognize that fastmail doesn't let me but at this price point I would want it. It looks like you support that but I'm unsure. 3 - How do you convince my ISP to let me receive traffic on the ports required to run a mail server? (most firewall…

hey stevehawk - thanks for your questions. I'm the co-founder and CEO of Helm. Let me take them one by one: 1 - how many domains can I use? Each Helm Personal Server currently supports 1 domain 2 - Can I have multiple users? Yes, we have no limits on the number of users. 3 - Please see my response above about how we navigate around ISPs blocking ports. We route traffic through an EC2 instance with an iptables configu…

Your setup with Let's encrypt certificates is exactly what I was thinking about. I was thinking however about a one step further. Put the server on a smartphone. This way you're pretty much covered most of the time. Also one could be notified as soon as email is incoming. I thought also about a home server that would be used as a secondary.

It would be best to give ability to create random subdomains, so a user can have a separate addresses for everyone. Then it would be easy to filter out spam on the proxy level. Which is crucial for a server on a mobile phone.

Re: Helm: Personal Email Server

#227

Post by monocasa » Wed, Oct 17, 2018, 3:24 PM UTC

stevehawk wrote: post #40

_verandaguy wrote: post #24

Earlier quoted context omitted.

Holy crap, US ISPs are completely absurd. This definitely isn't a thing (or at least not enforced in any way) in Canada; most of my friends run on-prem web services out of their basements or closets.

In the US it's standard that residential accounts don't get to do that, but business accounts (which are usually double the price for the same speed but come with better/quicker support, particularly when physical lines are down, and an open connection) are allowed to run on-prem. And usually with a residential account you don't get a static IP as an option, but if you're lucky you can pay extra for one.

I tried to get a business account once at Comcast, and they wouldn't give me one that terminated at an apartment. : /

Re: Helm: Personal Email Server

#228

Post by otterpro » Wed, Oct 17, 2018, 3:24 PM UTC

Helm, also known as "Hillary Clinton" v1.0 (just joking, no politics intended). Anyway, while it is kind of awkward having a physical server at home or office, there's a sense of peace knowing i control my own privacy, especially when I can see the server with my own eyes. While people argue about using SaaS email service like Fastmail, nothing can be truly secure, with exception to true end-to-end encrypted email service like ProtonMail. Most email providers, even the privacy-centered email service like Mailfence, are still required to turn over their data in case of local (Belgian) court order.

The only thing I'd really want is to have option to not pay for annual $99 fee, and instead have everything configurable so that I can point tunnel it to my own VPS/VPN or I can use it at the office, where the business ISP account allows me to host my own email server.

Re: Helm: Personal Email Server

#229

Post by zrail » Wed, Oct 17, 2018, 3:25 PM UTC

microtonal wrote: post #49

prophesi wrote: post #22

Earlier quoted context omitted.

Meanwhile, my ISP's customer service gave me a few pointers on how to get my self-hosted website to work with a dynamic IP address.

My Dutch ISP gives me a static IPv4 address (besides an IPv6 netblock) and allows me to purchase additional IPv4 addresses. They also offer various levels of port filtering, from no filtering to filtering port 53, etc. (Combined with fiber, it's ideal for a small home server.)

Comcast in the US doesn't give residential accounts a static IP, nor do they give you the option to purchase one. You have to sign up for a business account with a 2 year contract term and a pretty draconian cancellation policy (basically the entire rest of the term is due when you cancel).

Re: Helm: Personal Email Server

#230

Post by gsreenivas » Wed, Oct 17, 2018, 3:26 PM UTC

sjs382 wrote: post #150

cwyers wrote: post #114

Earlier quoted context omitted.

But that's completely orthogonal to owning a piece of hardware. You could run a managed cloud e-mail service where only the users hold the encryption keys, too. How is this a hardware problem?

> You could run a managed cloud e-mail service where only the users hold the encryption keys, too. How is this a hardware problem? This is the key question, in my mind. There's only one reason I'd want to own the hardware—to manage/add/create my own services and handle my own backups because I don't trust a company's involvement in these[0]. If this is so tightly controlled that I can't add my own services and I can'…

We use duplicity for backups so there's nothing proprietary in our approach. There will be more transparency coming in a series of technical posts about how the product works, what open source software we use, etc. Appreciate the feedback - we'll keep this in mind as we move forward.