Looking Back On Helm(giri.co)
giri.co
Looking Back On Helm
https://giri.co/looking-back-on-helm/
35 comments
That sounds pretty neat. I wonder why they didn't pivot away from hardware to a service?
It sounds like "hardware > service" was not just core to the product's value proposition, but also a core value of the founders.
And if so, I get it. But it seems like 99% of people will choose convenience over privacy, even if they claim that privacy is really really important. So if you're selling something that is more private than convenient, you should accept that you've eliminated 99% of the world from your TAM.
And if so, I get it. But it seems like 99% of people will choose convenience over privacy, even if they claim that privacy is really really important. So if you're selling something that is more private than convenient, you should accept that you've eliminated 99% of the world from your TAM.
Curious how you would do it as a service, interesting idea. It always felt to me like you couldn't do it without the hardware component, because without a box in your home how can you be assured of privacy? The box is where the cert protecting your privacy lives, and it it's in some data center it becomes a "trust us, we won't look at it" situation (and if your threat model involves subpeonas or PRISM type requests you are SOL).
But maybe I'm missing something.
But maybe I'm missing something.
> because without a box in your home how can you be assured of privacy
Right, the idea is to install it on an existing box at your home… your always on desktop, or a raspberry pi, or whatever. Lots of people have home servers, and it would be much easier to install on an existing home server than to get a single function hardware device.
Right, the idea is to install it on an existing box at your home… your always on desktop, or a raspberry pi, or whatever. Lots of people have home servers, and it would be much easier to install on an existing home server than to get a single function hardware device.
That’s a great idea!
if your threat model involves subpeonas or PRISM type requests
Very very few people have that threat model and Helm probably wasn't secure enough to beat the government anyway. The "cloud providers don't look at your data" security model is good enough for people who are just looking for privacy.
Very very few people have that threat model and Helm probably wasn't secure enough to beat the government anyway. The "cloud providers don't look at your data" security model is good enough for people who are just looking for privacy.
I haven't thought hard about this, but maybe sell a little usb dongle or something?
Thanks for the kind words!
I was, and am, sad helm shutdown. That said, the fact that they rug pulled on a device I waited a year to get, then owned for less than two years, all while charging me an annual fee (that I thought was meant to make them sustainable) irks me.
Is it really a rugpull if they simply run out of money?
That’s fair… I think what made it feel like a rug pull for me was that I erroneously thought that ongoing costs were being covered by the subscription fees. So I ended up with this useless box and a need to find a new email provider.
That said, while it worked it was absolutely awesome!
That said, while it worked it was absolutely awesome!
Well, this sounds remarkably similar to our story. We were fortunate that we didn't experience serious manufacturing issues. We had built in some padding for inevitable delays and cost overruns. We ended up shipping all of our units on time (most well in advance, actually!) but our unit costs were about $60 over our initial expectations of $85.
Like Helm, we identified a sizable audience for the product. However, we didn't - and couldn't - anticipate the serious run up in acquisition costs which were largely attributed to Facebook in 2017-2019 (there was another article written about this on HN some time back). This made it impossible to grow the customer base within the slim margins afforded with hardware.
And because hardware is so massively capital intensive, without impressive M/M growth numbers, it was quite difficult to attract Series A investors.
IIRC we had discussed a marketing partnership with the Helm team at one point, though I'm not sure if that ever got off the ground.
Like Helm, we identified a sizable audience for the product. However, we didn't - and couldn't - anticipate the serious run up in acquisition costs which were largely attributed to Facebook in 2017-2019 (there was another article written about this on HN some time back). This made it impossible to grow the customer base within the slim margins afforded with hardware.
And because hardware is so massively capital intensive, without impressive M/M growth numbers, it was quite difficult to attract Series A investors.
IIRC we had discussed a marketing partnership with the Helm team at one point, though I'm not sure if that ever got off the ground.
For those wondering “which Helm?”:
> Helm’s product was a secure personal server combined with a cloud-based service that made it incredibly easy to own your data — starting with online identity and email.
> Helm’s product was a secure personal server combined with a cloud-based service that made it incredibly easy to own your data — starting with online identity and email.
I’d have bought it as a raspberry pi in a cardboard box. Is there a “fail faster” lesson to consider? Would a lesser initial product have helped reduce the scope for manufacturing and maybe helped avoid some of these pitfalls?
Having been involved in many hardware startups, the story reads like they spent WAY to much on industrial design for a unit that was going to mostly sit in a dark corner, and WAY to much on bespoke hardware when COTS stuff would have been fine.
They also seemingly had nobody on the team heavily experienced with OEM/ODM supplier arrangements. There is no reason to wind up as an extortion victim to your suppliers if you go into the arrangement properly.
They also seemingly had nobody on the team heavily experienced with OEM/ODM supplier arrangements. There is no reason to wind up as an extortion victim to your suppliers if you go into the arrangement properly.
Maybe not quite cardboard, but I had similar thoughts reading that. Relatively fancy industrial design, entirely custom board apparently (i.e. not using an SBC or SoM) sounds expensive up front. But it's hard to judge without more background knowledge (estimated volume, covering up-front expenses is what venture funding is kind of for, exact requirements software-side ... if there is a more indepth breakdown I'd love to read it!) and in the end it'd been a good chunk of luck to hit the right path at the right time to avoid the pandemic struggles.
https://medium.com/gethelm/how-helm-works-part-1-4cf68956dd2... is a really interesting setup - a modern DynDNS-reverse-proxy hybrid with no more ability to decrypt traffic than any other part of the routing infrastructure of the Internet.
Does anyone else offer something like this? I'd gladly pay for a cloud service that terminates SSL on a home server but otherwise handles keeping a stable IP for me, and proxies traffic to me in a way that is resilient to connection interruptions and IP address changes. This should be a software startup, though, not one whose market is only those people who would buy hardware from them.
Does anyone else offer something like this? I'd gladly pay for a cloud service that terminates SSL on a home server but otherwise handles keeping a stable IP for me, and proxies traffic to me in a way that is resilient to connection interruptions and IP address changes. This should be a software startup, though, not one whose market is only those people who would buy hardware from them.
I'm a bit confused on what exactly helm was, would it be acceptable to compare it (functionally) to having an email and calendar server on a raspberry pi with a private vpn and a hosted ip address?
The is a good technical overview in this review: https://theintercept.com/2019/04/30/helm-email-server/
This is about the startup that produced a secure personal server, which pulled the plug last year.
It’s not about the kubernetes package manager, for anyone wondering.
It’s not about the kubernetes package manager, for anyone wondering.
afandian(1)
[deleted]
Or the popular Emacs package.
Or the headgear.
Or the standard for encoding nucleotide or protein sequences:
https://www.pistoiaalliance.org/helm-notation/
https://www.pistoiaalliance.org/helm-notation/
Or my axe
[deleted]
I was assuming go-to-market was the main pain point here. I've never even heard of Helm, and now that I read up on it I want one :-(
Did the design and software get released as the company shut down, or is there a hope of resurrecting it?
Did the design and software get released as the company shut down, or is there a hope of resurrecting it?
Interesting. I recall Alexis Ohanian and Giri appearing on Bloomberg talking about this product, but no mention of Alexis in the investor thank you note.
Helm lost on execution. The browser company which makes Arc will also lose similarly unless they drastically change.
They never did ship to Canada, as far as I knew
We did ship internationally, and Canada was one of the top international destinations for our products.
You also (and many people could not wrap their heads around this) didnt give up privacy for your emails - Helm provided you an IP and proxy (via ec2) but assuming TLS protected SMTP connections (most are these days), inbound mail was protected with a cert that lived on your device, and outbound protected by the cert of the server you were sending to.
The home server was configured using a smartphone app but they kept choices to a minimum and made the setup process quite painless - adding my Helm to my iPhone was one click and one authorization IIRC and on my Mac similar (my linux laptop was only slightly more complicated).
You could put N domains and N users on the box - there were probably some upper limits there but I ever hit them. I had multiple domains and accounts though and it worked smoothly.
On the consumer side, I always found the biggest issue was trying to explain to people how it all worked. The people who cared about privacy tended to be skeptical that a pre-boxed home server with an ec2 proxy could be truly private, while everyone else didn't want to give up the convenience of gmail and webmail (oh ya, it offered no webmail - not a problem for me but I think some people definitely went to Protonmail instead because they prefer webmail, even though Protonmail unlike Helm can see all your email that is not Proton<>Proton or GPG encrypted).
But reading this, it seems pretty clear demand was way less of an issue than the supply side - Giri here has multiple stories of getting screwed over by contract manufacturers. Oy. It was a heroic effort at privacy tech and I was pretty bummed to see it fail.
Giri if you're reading this, thank you and your team for trying so hard. I loved the product and the spirit (rare in the Valley) of embracing privacy in a constructive, positive, non defeatist way. This was an extraordinary product on many levels.