[HN Gopher] Show HN: OpenSign - Open source alternative to DocuSign
___________________________________________________________________
Show HN: OpenSign - Open source alternative to DocuSign
Author : alexopensource
Score : 461 points
Date : 2023-10-28 18:47 UTC (1 days ago)
(HTM) web link (github.com)
(TXT) w3m dump (github.com)
| yodon wrote:
| My understanding (possibly incorrect) is that competing with
| DocuSign is hard because of the need to follow obscure state and
| National laws (many of which are defined by case law rather than
| published law) in order for the signatures to be legally binding.
|
| Is that the case? And if so, is there evidence OpenSign has done
| this kind of SME research to make sure the electronic signatures
| are legally binding, or is this more "we brought in some devs and
| UI designers and built something" without actual legal review and
| guidance?
| wrs wrote:
| DocuSign itself just refers you to your own counsel for legal
| advice, but does publish and update a handy multi-country legal
| reference.
|
| For the US one, at least, they give examples of where
| electronic signatures are pretty common and straightforward,
| and where you need to be careful.
|
| Software-wise, they have features to help you show evidence of
| who signed, where, and when in multiple ways. Nothing magical,
| though.
|
| If there were secret sauce, you would think they'd mention it
| prominently, but they don't.
|
| https://www.docusign.com/products/electronic-signature/legal...
| alexopensource wrote:
| We also generate a completion certificate that has the time &
| ip addresses of everyone who accessed and modified a doc
| during the entire signing process, plus we are open source
| which means more transparent. We plan to publish a lot of
| content in that space but with limited resources currently we
| plan to build the product features first. Also, we are soon
| going to start our fund raise efforts which will ultimately
| speed up things.
| szundi wrote:
| And soon after suddenly the Pricing page appears, after 3
| months of disappointment convenient features turn paying
| ones. In some more years it is just as expensive as
| Docusign.
|
| Eh sorry, I'm just sad about Rocket Chat.
| alexopensource wrote:
| The self hosted version will always be free :)
| josephcsible wrote:
| Your CONTRIBUTING.md file says "By contributing, you
| agree that your contributions will be licensed under its
| MIT License." Since OpenSign is AGPLv3, why don't you
| allow contributions under the same license, if the self
| hosted version will always be free? I'm worried that the
| purpose of that might be to let you make it proprietary
| later.
| tormeh wrote:
| AGPL for thee but not for me, for I require MIT.
|
| To be fair, this is an entirely reasonable way to do
| business, but it's also a bit funny.
| anonymous_sorry wrote:
| I guess this allows them integrate with proprietary code
| on their back end if necessary, whilst making it hard for
| a competitor to take their code and undercut them, since
| most corps with proprietary software to protect won't
| touch AGPLv3 with a barge pole.
|
| Nothing prevents an AGPLv3 fork if OpenSign goes
| proprietary in future.
|
| I'd rather this approach than yet another non-standard
| Amazon-proof licence.
| josephcsible wrote:
| > I guess this allows them integrate with proprietary
| code on their back end if necessary
|
| Couldn't they have accomplished that just by asking for
| GPLv3 instead of AGPLv3? That would let them do so
| without letting them make the self-hosted version non-
| free, unlike asking for MIT.
|
| > Nothing prevents an AGPLv3 fork if OpenSign goes
| proprietary in future.
|
| Yes, but this would be true for almost any FOSS license
| offered and regardless of what they ask of contributors.
|
| > I'd rather this approach than yet another non-standard
| Amazon-proof licence.
|
| I very much agree with this.
| blurr123 wrote:
| Ive been using rabbitsign since 2021 to get signatures on
| legal docs for work.
|
| Covid made this acceptable.
|
| https://www.rabbitsign.com/
| djbusby wrote:
| Those certs integrated with with any Timestamp Authority?
| alexopensource wrote:
| Thanks for asking the right question. We are taking legal help
| to be compliant with various jurisdictions. Our solution is
| currently able to safely sign a document with a digital
| signature that will make it tamper-proof and show a geen tick
| in Adobe PDF while keeping track of incremental annotations
| added by multiple signers. We envision to add support for eIDAS
| and AADHAAR e-sign(widely accepted in India) very soon.
| petertodd wrote:
| > Our solution is currently able to safely sign a document
| with a digital signature that will make it tamper-proof
|
| Who holds the secret key that actually signs the document? If
| this is in fact a self-hosted, open-source, project then
| clearly the user does, and they could sign a different,
| tampered, version of the document after the fact. I would
| hesitate to use the term "tamper-proof" in that situation.
| Right now your documentation doesn't make it clear how this
| actually works.
|
| I'll also point out, that even if you were using my
| OpenTimestamps scheme or some other secure timestamping
| system, I would _still_ hesitate to call the solution
| "tamper-proof". The problem is that even with timestamps
| someone can in many situations pre-generate alternate
| versions of a document in advance. Calling this type of
| system "tamper-resistant" is better IMO.
| alexopensource wrote:
| In the hosted version, we sign the document on behalf of
| the user using our own private key. Our roadmap also has
| the feature to bring your own cert(not relevant here). As
| soon as a user signs a document, a copy of the signed
| document is instantly sent to all the parties involved.
| This ensures that the signer cannot revoke the documents
| already signed. If the receiving party tries to modify the
| document, the signature becomes invalid. This is how we
| make sure that the docs are "tamper-proof" after signing.
| petertodd wrote:
| That's a reasonable, and pragmatic, way to implement
| this. But I'd still call it "tamper-resistant". One
| reason why is in situations where senders or recipients
| have modified something, proving that the _keys_ used to
| sign the documents were the correct ones can itself be a
| difficult problem.
| johnfonesca wrote:
| >This ensures that the signer cannot revoke the documents
| already signed. If the receiving party tries to modify
| the document, the signature becomes invalid
|
| This,fortunately, is a feature of the PDF digital
| signatures standard.
| jjeaff wrote:
| Are there really any laws requiring special types of
| signatures? Because I've never had a legal doc sent to me that
| they weren't fine with just stamping my signature on the line
| or even printing it out, signing it, and scanning it back in.
| alexopensource wrote:
| It depends on jurisdiction you are located in and the level
| of legal safety and acceptance you need. Our solution is
| already able to digitally sign the document which kind of
| makes it tamper proof and electronically sign(draw
| annotations) which will have you covered in most regions.
| Some regions have specific laws for example India has IT Act
| 2000, UETA & ESIGN Act while Europe has eIDAS.
| baz00 wrote:
| Depends where you are but contracts and other legal documents
| are only ultimately enforceable in court usually. Electronic
| signatures tend to shorten that process somewhat as they
| provide signatory verification, contract integrity and ID
| verification so it's seen as a legal risk and cost mitigation
| rather than an actual hard contractual requirement.
| p_l wrote:
| European Union (and some states connecting with the same
| infrastructure, like Switzerland), have standardized formats
| as well as defined CAs that provide certificates for
| "qualified" signatures, which have the same legal weight as
| if you had a printed document with physical signature.
|
| DocuSign supports those mainly through some interop
| connections where, for example, a qualified signature vendor
| provides an API that DocuSign can use to sign the document.
| alexopensource wrote:
| You are right, that is precisely the route we will also
| have to take for certain regions. For example in India,
| there are only 3 entities that are authorized by the
| government to enable Aadhaar based e-signature. We will
| have to integrate with any of those in order to be
| compliant. We have already started working in this
| direction.
| xvilka wrote:
| Similar approach would be for signing documents in China.
| 2Gkashmiri wrote:
| More than aadhar enabled signatures, India has pfx based
| digital signature system in place which is legally
| acceptable as good as a physical hand signature.
| Isthatablackgsd wrote:
| There is one state agency in USA that requires wet black ink
| for contracts. I forgot which state it is, this happened two
| years ago. They said no expectations, it have to be wet black
| signature, period. They will inspect the PDF to check the
| signature that it is not e-signed.
|
| It was odd because I handled federal and state contracts in
| previous job, they don't have a problem with e-signature.
| candiddevmike wrote:
| AFAIK DocuSign acts as a trusted third party and protects/prove
| chain of custody. Think of them like a digital notary public.
| alexopensource wrote:
| Our understanding is that DocuSign does not have any legal
| authority, they prove the chain of custody/modifications
| using digital traces which our solution can also do, arguably
| in a more open way.
| toomuchtodo wrote:
| Electronic signatures legally recognized in the United
| States are provided for in the Electronic Signatures in
| Global and National Commerce Act ("ESIGN") and state and
| territory versions of the Uniform Electronic Transactions
| Act ("UETA").
|
| These are the regulations you'll want to adhere to in order
| to provide parity with digital signature authority of
| traditional commercial providers (in the US at least).
|
| Great work btw!
|
| (Not an attorney, not your attorney, but happy to chip in
| fiat so you can consult with counsel and obtain an opinion
| letter from one in support of your project)
| alexopensource wrote:
| Saved the info in my notes. Will discuss it with our
| counsel in the next meeting. Thanks :)
| ncallaway wrote:
| UETA has been substantially adopted by 49 states. The
| state of New York has their own statute.
|
| So, if you look at e-sign, UETA, and NY's Electronic
| Signatures and Records Act, then you have fairly
| comprehensive coverage across the US.
|
| Also not an attorney, and this is also definitely not
| definitive legal advice!
| benatkin wrote:
| Yes, making a mill for supposedly trusted third parties,
| over having an actual trusted third party, is a more open
| way.
|
| Edit: I suppose in all except the free self hosted one,
| OpenSign would be the trusted third party, which I guess is
| more plausible. Unless the paid customers are given
| something close to root to administrate them. Still, a
| trusted third party is generally based on recognition. Even
| if I really dislike a company I eventually acknowledge
| they're trusted if it lasts long enough, like with ID.me. I
| didn't use ID.me until it was required for logging into the
| IRS and now I grudgingly admit that I think it's an extra
| security check on logging in. So until you're big like
| DocuSign I wouldn't view you in quite the same way as a
| trusted third party.
|
| That does bring a question, are your paid customers
| prevented from going under the hood in such a way that they
| would also have to be trusted at such a level along with
| OpenSign?
|
| --
|
| This to say I'm open to using OpenSign, because there are
| plenty of uses where I would be open to using something
| that doesn't have this "trusted third party at the level of
| DocuSign" feature. The "digital notary public" analogy is
| apt. I sometimes sign documents with a notary, and other
| times without.
| alexopensource wrote:
| Great insights. The hosted version functions in a more or
| less same way as DocuSign with an added advantage of
| knowing what the code is doing under the hood. We dont
| intend to provide root/admin privileges as its going to
| be a multi-tenant system at the end of the day.
| benatkin wrote:
| Ah, I see. A multi-tenant system makes sense, I was
| thinking it might be closer to managed hosting. With
| managed often people have root or close to it. Just make
| sure people understand that it's a multi-tenant system
| where the customers don't have access to do anything
| which would make it less secure, unless they're using the
| self-hosted version. And when you grow, maybe there will
| be an enterprise self-hosted and/or managed hosting
| version where the customer needs to be trusted to provide
| security. That would be appropriate with some potential
| customers.
|
| So that leaves the challenge of becoming a well known
| trusted third party, which is a challenge but doable.
| ncallaway wrote:
| One think that I think they provide (as opposed to the self
| hosted version) is just the fact of being a relatively
| neutral third party.
|
| If there's a dispute over the veracity of a signature, it's
| probably helpful to have a third party say "according to
| our server logs and software stack, this was signed by
| johndoe@example.com at 12:41pm on August 3rd, from the IP
| address XX.XXX.XXX.XX, and they authenticated with their
| email and password". If I'm self-hosting, it's marginally
| less convincing when I'm before a court if I say *my*
| software stack says that, since I have more direct control
| over it.
|
| So, I agree DocuSign doesn't have a special status, other
| than being a relatively neutral third party to that
| dispute. But if a signature's validity is being questioned,
| that third party status is probably somewhat helpful.
| rubberband wrote:
| Late to the party here, but I deal in this space all day.
| You are 100% correct.
|
| Disputes over eSignatures come up allllll the time. And
| if you mention that it was "DocuSigned"... although you
| have done nothing aside from name-dropping... it will
| essentially end the dispute. Not saying that it should.
| Just saying that it does.
| alexopensource wrote:
| Hopefully people will say "OpenSigned" one day and it
| will have the same impact.
| ncallaway wrote:
| I think that could totally be possible for your hosted
| offering, but my point is largely that I don't see how
| the self-hosted offering could ever get there, unless
| there was some technical measure that could prevent the
| operator of the system from tampering with the
| logs/database/etc
|
| Edited to add: mild disclosure, I'm working on a product
| that has e-sign as a feature. It's not really the main
| thrust of the application, but probably worth mentioning
| here.
| figassis wrote:
| Wouldn't it be amazing, since e signatures have been around for
| ages, that governments just published the requirements for
| legally binding digital signatures rather than ask each maker
| to go talk to them and get some obscure license or blessing?
| amolshejole wrote:
| Yeh, its already happening in a lot of regions across the
| world. We see a future that will have more open standards, it
| is precisely the reason we are working on this solution now.
| jeron wrote:
| How else will DocuSign have a moat??
| eKIK wrote:
| In the EU this is actually the case since 2016. There's this
| regulation called eIDAS (electronic IDentification,
| Authentication and trust Services).
|
| Article 26 (linked below) describes the requirements for an
| electronic signature to be legally binding.
|
| https://www.eid.as/#article26
| https://en.m.wikipedia.org/wiki/EIDAS
| saled wrote:
| You know that there's nothing stopping an open source project
| funded as a not for profit from doing the same thing right?
|
| If something is hard, that's an argument _for_ making a
| standard not for profit version of it, so it becomes a common
| good instead of platform rent seekers keeping out competition
| by saying it 's "too hard".
| nonethewiser wrote:
| How do you personally differentiate between "rent seeking"
| and running a business?
| paulryanrogers wrote:
| When it's 'done' and you keep collecting money, without
| adding additional value?
|
| Like a slumlord who collects rent and does nothing to even
| maintain the property. Except perhaps vote down YIMBY
| reforms.
| kurthr wrote:
| Not the OP, and this isn't something I'm dramatically
| invested in, but...
|
| Rent seeking would be designing a product for collecting
| rent (not a one time payment) for a product (e.g. SaS) that
| doesn't wear out or has separate maintenance costs. Like a
| house that is rented the value comes from the income stream
| and it likely is adjusted by something like inflation.
|
| Not renting would be selling a product for a one time fee,
| perhaps even if there are many customers (you still get to
| play ticket pricing games like the airlines so different
| people pay different amounts at different times, but not as
| variable as rent). Making the product non-transferable
| blurs the rent line a bit. Also not rental is the
| maintenance or improvement on the product (or the house)
| since that is new work that is being done.
|
| It used to be that only physical objects were rented and
| services were inherently work and required new
| effort/ingenuity to be solved each time. However, with the
| introduction of art reproduction (visual, audio, physical)
| and copyright/patent, as well as, non-perpetual licensing
| of software this is no longer the case. It's possible to
| hold a piece of intellectual property and collect perpetual
| rent with little or no future investment.
|
| It does create a different incentive structure that can be
| quite customer hostile.
| nonethewiser wrote:
| You mean a SAS? The monthly payment goes towards support,
| maintenance, and further development. Or you could rebuy
| essentially the same thing every couple years.
| kurthr wrote:
| I meant a SaaS, but mistyped it.
| robertlagrant wrote:
| Rent seeking is trying to create a legal/regulatory
| structure that means you can farm people. E.g. coming to
| the UK from some countries you need to prove you can
| speak English. Assuming you can, and you need a waiver on
| the test, there is a sole organisation you can pay
| hundreds of pounds to to send them your degree
| certificate, and for them to say in some government UI
| "yes, this probably means they can speak English".
|
| It's not just general and optional recurring payments.
| kurthr wrote:
| Regulatory lock-in is certainly one method of
| guaranteeing rent. I'd argue copyrights and patents are
| as well. Microsoft and Google get accused of rent seeking
| because of their near monopolies, but I don't think most
| of their income is particularly based on regulation. You
| find other forms of lock-in can come from network effects
| in social media (Facebook), or B2B lock-in due to
| outsourcing of basic business operations (IBM, Oracle,
| Salesforce).
| robertlagrant wrote:
| I think the accusations can be divided into several
| categories:
|
| - actual rent-seeking (as you say, not really true for
| companies such as Microsoft and Google, except where you
| see e.g. government documents needing to be submitted in
| Word. But that's very likely incompetence on behalf of
| the bureaucracy rather than Microsoft)
|
| - having a dominant market position due to having a very
| high quality product, or set of products that work
| together well
|
| - a random grudge phrased as rent-seeking, because the
| Twitter user in question doesn't know what rent-seeking
| is, but has seen their friends accuse companies of it
|
| I don't know what the proportions are, but I suspect the
| former is minimal to nonexistent for e.g. Google.
| hotnfresh wrote:
| https://en.m.wikipedia.org/wiki/Rent-seeking
| tiahura wrote:
| You are incorrect. I'm not familiar with any law that requires
| Docusign in any jurisdiction in which I practice.
|
| The Federal Esign Act provides: 15 USC 7006(5):
|
| _The term "electronic signature" means an electronic sound,
| symbol, or process, attached to or logically associated with a
| contract or other record and executed or adopted by a person
| with the intent to sign the record._
| Sebguer wrote:
| You're misreading OP, they're not saying anything about law
| requiring Docusign, they're saying that Docusign has invested
| in meeting the law.
| SoftTalker wrote:
| AFAIK, anything that is intended to be a signature, is a
| signature. This can be a hand-drawn "X", a signed name, a
| typed name, a fingerprint, a rubber stamp, clicking "I Agree"
| checkboxes, etc.
| kemitchell wrote:
| I haven't researched the law here in a while, but my general
| impression the last time I did was that there isn't much in the
| way of legal requirements for signing things digitally beyond
| the federal ESIGN Act, general principles of state contract
| law, and the smattering of very particular kinds of
| transactions that require processes like notarization or
| recording. For everyday deals between the vast majority of
| people and companies, it really comes down to whether what the
| e-sign collects and saves will be available and convincing down
| the line, when there's a dispute.
|
| When dealing with government entities, you may run into
| policies of those entities that require use of a pre-approved
| service. For example:
| https://www.sos.ca.gov/administration/regulations/current-re...
|
| All that said, I have both implemented electronic signature in
| my own software and reliably recommended clients running sales
| ops just buy DocuSign. Familiarity and credibility can matter
| way more than legal or technical details...or not at all.
| Projectiboga wrote:
| Supreme Court said you can agree to things online awhile ago.
| jacurtis wrote:
| Nothing in the American legal system is that
| straightforward and simple, even less so among our Supreme
| Court. Things got even more confusing now that this year
| the Supreme Court has set a new precedent that they can now
| overturn their own rulings from decades earlier.
|
| While I think that's generally true that online signatures
| are acceptable in most circumstances, I'd be careful to
| blindly believe it as a blanket statement.
| vitus wrote:
| > this year the Supreme Court has set a new precedent
| that they can now overturn their own rulings from decades
| earlier
|
| What happened this year specifically?
|
| Dobbs was in June 2022, but that isn't even close to the
| first time that the Supreme Court overturned precedent
| from 50+ years prior -- Brown v Board largely overturned
| Plessy v Ferguson ("separate but equal") from nearly 60
| years prior.
|
| And, we've had plenty of Supreme Court precedents
| overruled since the 19th century. According to Congress:
| https://constitution.congress.gov/resources/decisions-
| overru...
|
| (Most of those never rose to the level of landmark
| decisions, but Plessy certainly did.)
| otteromkram wrote:
| Roe v. Wade
| quickthrower2 wrote:
| That is covered by the comment you replied to
| rs999gti wrote:
| I would blame the congress more than the supreme court
| for Roe being overturned.
|
| The legal precedent was made in the initial supreme court
| ruling, all someone needed to do in the legislature is
| codify it into law.
|
| But no, laziness and re-electabilty on both sides, led to
| the ruling being overturned in the second examination of
| Roe.
| Guvante wrote:
| Eliminating separate but equal was based on the evidence
| of how that statue was used.
|
| Eliminating abortion protections was based on "we don't
| think the founders meant that" which is a form of
| consideration never before used.
|
| This kind of test is effectively in the eye of the
| beholder. You can say whatever you want and disproving it
| requires Goldilocks evidence.
|
| You can't talk about the case law the American system was
| based on even if it was adopted wholesale and unchanged.
| You can't talk about the intervening decades and how the
| legal system handled things.
|
| You need to basically quote the founding fathers talking
| about a specific topic or the Supreme Court can say "no I
| disagree" and overrule you.
| dataviz1000 wrote:
| Click wrap is binding.
| anonymous_sorry wrote:
| Does this hold true in the rest of the world?
| 3c6bYDXLMj wrote:
| I am in Australia and the situation is largely the same.
| dubcanada wrote:
| Canada you can use what ever you want, and it also includes
| things like "doing activities". Like if you click an
| "approve" button that can be considered a signature.
| FuriouslyAdrift wrote:
| Remote online notary services (DocuSign is one) has a TON of
| legal and regulatory requirements, for obvious reasons.
|
| https://www.nationalnotary.org/knowledge-center/remote-
| onlin...
| calvinmorrison wrote:
| Close, the whole point of docusign is to avoid all of that by,
| one, paying docusign to solve those problems, and two because
| docusign is a "neutral" 3rd party who has good housekeeping
| records compared to "Opensign" where a self hosted sleazy
| hacker may decide he wants to fudge the datestamps on the
| signatures etc.
| rubberband wrote:
| Your overall understanding is correct. People pay DocuSign to
| "think" of everything for them (which is not at all bad, it
| just comes at a cost). Depending on the space, you have to deal
| with crazy laws that no one in their right mind would know
| about (nor think to even consider).
|
| Essentially, "no one ever got fired for signing with DocuSign"
| (play on IBM).
|
| I'm late to the party here, but if the authors want real world
| examples, please reach out.
| alexopensource wrote:
| You are right. But there are many Individuals/companies who
| cannot benefit from DocuSign's trust because of the price
| tag. We want to provide them the free/ open source option and
| during the process build a brand that is equally trusted if
| not more than DocuSign.
| victop wrote:
| Not OP, but would love to see those real world examples.
| thathndude wrote:
| Lawyer here. Not legal advice. Really not that much by way of
| law to consider. If everyone agrees that an E-signature is
| good, then, generally speaking, an e-signature is good. I'd
| suggest it's more on the people actually drafting the documents
| being signed than the software layer facilitating.
| alexopensource wrote:
| True. Even if one party from the signers dont trust e-sign,
| it wont work. But the number of people thinking an
| E-signature is good is only increasing day by day.
| menzoic wrote:
| I think by everyone they meant everyone involved in the
| contract being signed
| ildon wrote:
| Lawyer here as well, but from Europe. Here the same is true,
| unless the government is involved.
|
| Documents from/to any agency, including anything that has any
| tax relevance, - generally speaking (there are many caveats)
| - shall be signed with services compliant with the
| e-signature standards provided by Regulation 2014/910/EU (in
| short: PADES, CADES, XADES).
|
| Out of curiosity: is there a similar requirement in terms of
| e-signature in the US when documents need to be sent to some
| agency, such as the IRS?
| graemep wrote:
| Not a lawyer, but I know the position in the UK is pretty
| simple and much the same.
|
| The purpose of someone like Docusign is to provide a trusted
| third party to provide evidence.
|
| For most purposes GPG signed email (or anything else with a
| similar signature) would work perfectly well provided you
| could prove who the keys belong to. In fact it would be
| better than DOcusign who can (from the few documents I have
| signed) ultimately only really show they sent an email with a
| signing link to your email address.
|
| The last one from them has a warning:
|
| "Do Not Share This Email This e-mail contains a secure link
| to DocuSign. Please do not share this e-mail, link or access
| code with others."
| dlandau wrote:
| For most purposes a normal email with no signatures is fine
| too.
| tomatocracy wrote:
| Not a lawyer but I do deal with contracts under English law
| day in day out for my day job.
|
| Docusign always saves the IP addresses and timestamps for
| any signatures. In addition it can be set up to require 2FA
| prior to accepting a signature - eg our lawyers will set it
| up to require an SMS 2FA confirmation and I've heard them
| say that this is a hard requirement for deeds as opposed to
| simple contracts (tho whether that's down to law firm
| policy, Docusign policy or court precedent I don't know).
| fulafel wrote:
| Depends on the jurisdiction and your definition of "hard" - in
| the EU there's some kind of qualification process by the
| regulators but the system is supposedly design to encourage
| competition and be open to new providers, and it's enough to be
| approved by one country's regulators I think.
| NoboruWataya wrote:
| You're getting a lot of responses to the effect that there
| aren't really any laws that require particular formalities to
| sign contracts, and while this is true in the "normal case" in
| many jurisdiction, there certainly are some categories of
| document that have more specific signing requirements. In most
| common law jurisdictions, for example, certain agreements must
| be signed as deeds which require certain formalities to be
| observed, and without enabling legislation it's not always easy
| to square these formalities with electronic signatures.
|
| https://en.wikipedia.org/wiki/Deed
| latchkey wrote:
| It is interesting to me how they (tm) on OpenSign, but don't do
| it in all their references to their competitors...
| wizzwizz4 wrote:
| That's because they're staking a claim to a trademark. They're
| not staking a claim to the trademarks of their competitors.
| baz00 wrote:
| This is naive. DocuSign's main sell from a commercial perspective
| is it separates the parties into the signer, the signee and the
| authority. If the authority is the signee or the signer then it
| could be considered unfair. And really no one wants to end up
| having to hire lawyers to unfuck that mess.
|
| Not only that DocuSign does ID verification if you pay them which
| is required for a bunch of contract types. This does definitely
| not!
| alexopensource wrote:
| We are working on all these features, even an optional webcam
| capture during signing. This is just the beginning. Even with
| current features we are arguably the most complete solution in
| this space in open-source world.
| baz00 wrote:
| I appreciate what you're doing but we buy DocuSign so the
| problem is far far away from us. This turns it into a problem
| we have to manage ourselves or a problem of finding a vendor
| stable enough to host your stuff that will make it not our
| problem long enough for the longest contract retention to
| expire. Which is difficult.
| yborg wrote:
| I'm sure these problems were also difficult for DocuSign in
| the beginning.
| baz00 wrote:
| Not really. They actually ran mock trials with legal
| professionals as test cases. That was an _instant_ win
| for anyone wanting assurance of admissibility.
|
| No open source startup is going to win there because it's
| about entities and process, supported by technology not
| technology on its own. The technology is absolutely
| worthless without the framework and legal entities
| surrounding it. It's a unique position no one really
| understands that well.
| alexopensource wrote:
| They began when Digital signatures were not understood
| well even by legal professionals. Somewhere fear might
| have came in picture. Today, its easier to digest the
| fact that digital signatures are just cryptographic
| functions that guarantee the authenticity and integrity
| of documents and various actions on those docs. Plus the
| legal framework around it is better defined now. I am
| confident that we will be able to change the perception
| and make this the de-facto digital signing solution. The
| movement has just began, there is a long way ahead.
| throwaway237289 wrote:
| This answer is incredibly technocratic, and misses the
| mark on what a digital signature is.
|
| A digital signature is a legal construct that stands up
| in court.
|
| The movement might have begun, but you need to change
| your perception. You have to stop talking like a
| technocrat and address the business problem that
| signatures solve.
| alexopensource wrote:
| I agree. This is the result of being surrounded by
| developers all day long lol. Will try to focus more on
| the business problem.
| alexopensource wrote:
| That is a great input, we need to put efforts into ensuring
| that we are seen as a long term player, in-fact we envision
| to be one, assuming some contracts might be really long
| term. I hope a day comes when you trust us enough :)
| nonrandomstring wrote:
| Gaining trust is one thing, I wish you the very best of
| luck with that.
|
| Not losing it is another.
|
| The people to preserve trust with are all potential
| signatories (ie. the public), not the initiating
| counterparties. Because there are many more of them.
|
| Of course this reputation problem is one you'll share
| with banks, PayPal and every other "official" type entity
| that phishers want to jump on.
|
| Now most "Docusign" communications go straight to my spam
| folder or /dev/null if arriving by email and not from
| (forwarded) a whitelisted business I already have a
| relation with. Those that come directly from Docusign (as
| sender even if DKIM passes) are ignored unless I think
| there's a reason to be contacted.
|
| Docusign is one of the juiciest spoofing targets for
| phishing attacks because people act rashly to what they
| think is something requiring a signature. They also have
| no timeout on repeat sends, relentlessly spamming users
| to sign something, which makes them look exactly like,
| well.... phish-spammers.
|
| Try not to make these same mistakes as Docusign.
| d3w4s9 wrote:
| No business cares about whether it is open-source or not.
| They care about when things somehow end up in the court,
| there is clear understanding of a signed document and nobody
| has any question about it. More or less a guarantee --
| probably not really a guarantee but good enough to hold in
| court. If your selling point is open source or "free" you
| have already lost.
| alexopensource wrote:
| We take pride in being open source as we are sure being
| open source brings a lot more transparency in the entire
| process. When it comes to the authenticity of a signed
| document, the cryptographic proofs generated by our
| solution and digital traces are no different than those
| generated by DocuSign. It will hold equally true in any
| court. We understand that we might need some time to be
| universally acceptable in terms of the perception of the
| people, but we are confident that we will reach there.
| tiahura wrote:
| DocuSign doesn't provide anything other than convenience.
| Generally, in the law, either a signature must be notarized or
| it doesn't. Docusign isn't a notary, it's really just an
| electronic document courier. If the legitimacy of a signature
| is challenged, Docusign isn't going to hire a forensic expert
| to testify that John Smith was actually the person who logged
| in and clicked the link. All they can say is that someone with
| access to the link from IP address 1.1.1.1 clicked Agree.
| baz00 wrote:
| Um, no. They do full ID verification as well. If you pay for
| it.
| judge2020 wrote:
| Where is that required? Maybe POAs? At least Florida and
| Georgia real estate law (the only ones I'm familiar with)
| don't require anything of the sort for any of the paperwork
| (before closing).
| baz00 wrote:
| They certainly don't require it but it tends to be used
| in other transactions where SEC is going to hang you for
| example.
| jkepler wrote:
| And my memory of Florida law (when I was signing an
| apartment rental contract 4 years ago) was that any
| electronic signature agreed to by the contracting parties
| was valid. So I simply typed my name in the contract,
| emailed it to my landlord, and we were done.
|
| Of course, I also used https:/.opentimestamps.org to
| store the hash of our contract on bitcoin's block chain,
| because that way we both had proof that the contract
| existed in a certain form on that date. (I never needed
| that proof, because he was a good landlord, and I paid
| rent on time.)
| judge2020 wrote:
| While probably enough to prove it existed, you'd probably
| need to pay a lot for an expert witness to testify to
| "hash of file on blockchain means it existed" if you did
| have to go to court over the existence of the contract.
| tiahura wrote:
| Interesting, my mom just sold her house and there was no
| verification.
|
| My point stands, legally either a signature has to be
| notarized or it doesn't. If it doesn't, any signature can
| be effective. I'll agree that 3rd party hosting provides an
| element of independence, however, legally it's not
| required, and could be done by anyone. E.g., a self-hosting
| a solution that required the signer to upload a video of
| them clicking I AGREE would provide just as much certainty
| as anything Docusign can.
| ian0 wrote:
| An optional paid feature that not many people seem to use
| isnt a deal breaker really.
| petertodd wrote:
| > For comprehensive guidelines on how to use OpenSign, please
| consult our User Manual.
|
| FYI, USAGE.md seems to be missing.
|
| Also, a suggestion: while I agree with other posters that this
| isn't a replacement for the third-party trust model DocuSign
| provides, you might as well use my OpenTimestamps project to
| timestamp the documents OpenSign produces. Being able to prove
| that a document was in fact created in the past, before a dispute
| existed about the document, is significantly better than not
| being able to prove that. OpenTimestamps is free and open source,
| using Bitcoin so that you don't have a trusted third party.
| Timestamps made with OpenTimestamps are free, as merkle trees are
| used to allow the whole world's documents to be timestamped with
| a single Bitcoin transaction.
|
| https://opentimestamps.org/
|
| A good example of how it's been used recently is by the official
| election authority in Guatemala to timestamp polling documents in
| their recent presidential election:
| https://www.youtube.com/watch?v=g0nnM5_Z90E
| alexopensource wrote:
| Thanks for the suggestion. We will definitely consider this. We
| have just released v1 48hrs before. We are working hard to put
| together a usage guide with docusaurus. You will see huge
| updates to documentation soon.
| Animats wrote:
| If you get something to sign, can you modify it and send it back
| to the other party so they can sign the modified version? Or is
| this a "take it or leave it" system?
| alexopensource wrote:
| Its really important to preserve the integrity of the document
| during the signing process because of which modifications other
| than annotations are currently not allowed. We are building
| this to support an open architecture(micro frontend based add-
| ons). The two add-ons currently under development are - - A
| document organizer for signed/in-progress documents as we
| believe organizing legal documents is very different from
| organizing regular files as the user should be able to visually
| identify the status of the document and just hover on a
| document to see the current status of signers, etc. - An AI
| based assistant that will allow you to get any clause of a
| contract re-worded, explained, analysed for risks, etc.(we dont
| intend to replace lawyers here) Once we have these plugins
| ready. You will be able to create/modify docs before signing.
| 29athrowaway wrote:
| This is similar to creating an open source nuclear waste
| management solution.
|
| Why would you want to store nuclear waste? Think about it. Even
| if you can, is that really what you want? Forever?
|
| There are probably more incentives and less legal liability
| storing nuclear waste than sensitive documents.
|
| It's not that other companies cannot do it, it's that nobody
| wants to do it.
| dboreham wrote:
| Neutron star of risk.
| sirsinsalot wrote:
| Until my signing a contract means signing it and a checksum with
| my private key ... this whole space is flawed.
| zeta0134 wrote:
| Why not make that your signature? Could you like, sign the
| current date with a private key, and write the result into the
| signature box?
| remram wrote:
| That only works if the other party is capable of verifying
| it. Also how do you tie people to keys? Have the government
| issue them?
| RedShift1 wrote:
| In Belgium you can digitally sign documents with your e-ID
| (mandatory ID card issued by the government) and it has the
| same value as "classic" hand signed documents. I use it myself
| for everything, whenever I get a PDF I just sign it with my
| e-ID and send it along its way.
| johnfonesca wrote:
| At bulksign.com we have this feature, it's called "Local
| Certificate" signature.
| icelancer wrote:
| I went to the installation instructions:
|
| https://github.com/OpenSignLabs/OpenSign/blob/main/INSTALLAT...
|
| And it says you can auto-deploy to DigitalOcean (neat) and to a
| local server, and instructions are included for both.
|
| There's the bit on AWS S3 which makes sense but then no
| build/install instructions for local deployment. are those
| somewhere else?
| hardwaresofton wrote:
| The future of open source continues to be AGPL.
|
| [EDIT]: referring to (my own) article:
| https://vadosware.io/post/the-future-of-free-and-open-source...
| webmobdev wrote:
| Shouldn't be surprising as it is the only OSS license that
| protects your right to repair by guaranteeing source code
| availability. FSF doesn't get enough credit for their
| foresight.
| hardwaresofton wrote:
| Yeah, and a while ago there seemed to be people who didn't
| think it was F/OSS, and wanted to avoid it because it might
| reduce the likelihood of someone contributing.
|
| One thing I do think that people misunderstand is that a
| company can absolutely take your project and run it as a
| service -- they just have to contribute code back if/when
| they modify it.
|
| The real canary is requiring signed CLAs.
| webmobdev wrote:
| True. Someone here in another comment has already pointed
| out that this project's CLA demands that all submissions
| have to be under the MIT license! This seems shady and can
| be perceived as an attempt to "steal" code in the future
| (MIT licensed code can be incorporated into xGPL license
| code, but it doesn't prevent the original license holder of
| the xGPL product to close source the product in the future.
| If the contributed code was also AGPL, the project managers
| would have to get permission from all submitters to close
| source a project or would be forced to remove their code
| from the product).
| hardwaresofton wrote:
| I don't see that they have a CLA -- I can only find their
| note about the license contributors must take[0].
|
| I guess that's one way _around_ the CLA -- they don 't
| need one if they force all contributions to be MIT in a
| file most people wouldn't read.
|
| In the end people the actual likelihood of someone making
| a credible legal threat is low so it all seems somewhat
| spurious but great way to go around the overt beacon that
| requiring CLA signing is.
|
| [0]: https://github.com/OpenSignLabs/OpenSign/blob/bb8464
| 42ecbaa3...
| riedel wrote:
| For a project that deals with signatures it should be
| pretty obvious that this does not quite work in a legally
| sound way. At least in the PR they will need some prove
| that I acknowledge to have read this Contributing.md.
| They is a reason why people go through the hassle of CLA
| signing flows. Wonder why they do not dog food their own
| system.
| remram wrote:
| AGPL still allows somebody else to offer your software as a
| paid service. This is dangerous for a lot of business models.
| j45 wrote:
| This looks great.
|
| If there's anyone familiar with this or from the product team
| would sincerely appreciate any insights on this scenario.
|
| Looking at the AGPL license, where would the licensing prevent or
| impact building an independent source code plug-in to integrate n
| to a piece of software that calls the hosted service via API, or
| an unmodified self-hosted copy?
|
| For me it helps spread awareness and use of a well made open
| source signature tool.
| alexopensource wrote:
| Can you please clarify or provide more context regarding your
| question?
| gnarlouse wrote:
| How does something like this avoid IP theft/infringement cases?
| By all accounts it's functionally the same thing as DocuSign?
|
| I ask because I am genuinely curious and hoping to learn a bit
| about IP law.
| jcoder wrote:
| What kind of issue do you have in mind? By all accounts, the
| functionality or OpenOffice, LibreOffice, and Google's suite
| are the same as Microsoft Office. There's no theft unless they
| _actually stole intellectual property_
| hatsix wrote:
| The commenter is confused, they mean infringing, not theft.
|
| Theft is theft, no reason to get IP law involved.
|
| Infringement can happen without intent. I don't know who
| would be liable, the open source company with little revenue,
| or the customers who are just using the software.
| xyst wrote:
| Very cool. Thanks for sharing.
| coldtrait wrote:
| I heard of this a while ago too -
| https://github.com/documenso/documenso
| Helmut10001 wrote:
| I wish there was a free alternative to the German/Europe QES
| ("Qualified Signature"). The cheapest currently is about 20 EUR/
| Month and allows you to make 3 Signatures. Others ask for 50 EUR
| for each QES. I hate to pay for my own Signature! We need
| something like Let's Encrypt for signatures.
| high_5 wrote:
| > We need something like Let's Encrypt for signatures.
|
| It's not the technical infrastructure, it's about trust. LE
| only solved the problem of safe transport, but not verification
| of authenticity of the endpoints. That's what incurs such cost.
| Helmut10001 wrote:
| The endpoint (my ID) is free - it can be used to verify
| myself digitally. And that is what all QES services do,
| initially (once). What other costs if not hardware/bandwidth
| apply?
| grst wrote:
| Other EU countries offer this for free, e.g.
| https://www.a-trust.at/pdfsign
|
| What's even worse is that in Germany most companies and
| authorities refuse to accept those digitally signed PDFs.
| johnchristopher wrote:
| > You will need to create an AWS S3 bucket or digital ocean space
| in order to store your uploaded documents
|
| The org I work for would love to self-host on-premise a digital
| signing solution so they definitely won't use external
| dependencies like AWS. Theoretically they could swap with minio
| but last time we used it it was not a drop-in replacement yet.
| alexopensource wrote:
| We will be supporting more storage providers including self
| hosting soon.
| johnchristopher wrote:
| Good to hear !
|
| It's not a problem if Minio is bundled into the self hosted
| stack as long as it's officially supported (paying for
| support is also okay).
| Clustered1441 wrote:
| Thank you so much for your great work
| KronisLV wrote:
| > Theoretically they could swap with minio but last time we
| used it it was not a drop-in replacement yet.
|
| Depends on whether AGPLv3 works for you or not (or whether you
| decide to pay them), I guess: https://min.io/pricing
|
| I've actually been looking for more open alternatives, but
| haven't found much.
|
| Zenko CloudServer seemed to be somewhat promising, but doesn't
| seem to be managed very actively:
| https://github.com/scality/cloudserver/issues/4986 (their
| Docker images on DockerHub were last updated 10 months ago,
| which is what the homepage links to; blog doesn't seem active
| since 2019, forums don't have much going on, despite some
| action on GitHub still)
|
| There was also Garage, but that one is also AGPLv3:
| https://garagehq.deuxfleurs.fr/
|
| The closest I got was discovering that SeaweedFS has an S3
| compatible mode: https://github.com/seaweedfs/seaweedfs
| mgrandl wrote:
| Ceph is definitely the biggest open-source option.
| ChrisCinelli wrote:
| I suppose there is a need of a trusted 3rd entity that runs the
| service.
|
| Otherwise anybody could run the service and pretend that anybody
| else signed any documents they want at any time they wanted.
|
| I am not familiar with DocuSign internal but it looks like people
| are identified by their email. So only if you can click the link
| received in their email, it can be them.
|
| I guess a problem with DocuSign is still that anybody can sign up
| for a new email and pretend to be anybody they want.
| wscourge wrote:
| This is absolutely brilliant, thank you for creating it.
| upofadown wrote:
| Doesn't contemporary PDF (for example) have something like a
| built in interpreter? How do you stop someone from, say, making a
| document that changes the wording after a certain date and then
| signing it?
| remram wrote:
| I don't think PDF can do that.
| exhil wrote:
| How is this different from docuseal.co?
| pandemicsoul wrote:
| It's not - it's just a "competing" product.
| lpellegr wrote:
| It has "open" in the name! and an ugly UI :)
| alexopensource wrote:
| What UI looks ugly to you? The website or the app itself or
| the github readme linked above? We would appreciate any
| precise feedback.
| lokesh1729 wrote:
| As others pointed out, update documentation for self-host setup
| without the need of AWS.
|
| Since the project is open-source, update the documentation with
| local setup, architecture, design decisions made
| tz18 wrote:
| Is this different from https://opensignapp.com/ ?
| Clustered1441 wrote:
| i think so
| tz18 wrote:
| I think it needs a way to review the contacts (other than the
| request signatures form), and to edit them (in case I put the
| wrong e-mail originally), or at least delete and re-create them.
___________________________________________________________________
(page generated 2023-10-29 23:02 UTC)