Hacker News Reader

Comment by apo | Hacker News Reader

Helm just works with your home network—no configuration needed. Helm connects securely to a unique gateway, which is assigned a static IP address so Helm is reachable by other mail servers and secure TLS sessions can be established.

This sounds like Helm becomes the email gateway. Sure, an email server might be running on the device, but emails will be routed through Helm the company. Am I missing something?

View on HN

Hi apo - Giri Sreenivas, co-founder and CEO of Helm here. The gateway funnels packets to and from the Helm servers in people's homes. These are packets of encrypted TLS sessions so we can't do anything with this traffic. Happy to answer any further questions or concerns.

That is not entirely true. Perhaps in the stated configuration it is, but since the domain points to the EC2 instance, you could always register a new LetsEncrypt certificate for it, and do a silent MITM.

Perhaps the architecture you describe is the best, however I would hope for two things to be supported: 1) The ability to run your own gateway server instead of having to trust one managed by your company. 2) The ability to disable the gateway entirely if you happen to have a business connection already.

It's possible but not something we would ever do. We are looking at STARTTLS Everywhere from EFF as means to help ensure that any cert changes would be tracked transparently.

#1 is something we will support via open source.

If running our own gateway server on a cloud provider of our choosing will really be an option, that might sell this for me. Would that remove the yearly $99 requirement? I understand we wouldn’t get support for a lot of the things you handle transparently behind the scenes blacklist/DNS-wise.

Reply on news.ycombinator.com