Introducing OpenSign™: The free & Open Source self-hosted alternative to DocuSign for Digital Signatures reddit / selfhosted ---------------------------------------------------------------------- Emaltonator · 2023-11-11 00:42 SSO shouldn't be a premium feature, as it's a core security requirement. https://sso.tax/ ---------------------------------------------------------------------- [deleted] · 2023-11-11 02:18 [deleted] ---------------------------------------------------------------------- improbablynothim · 2023-11-11 02:19 Preach ---------------------------------------------------------------------- AccountSuspicious621 · 2023-11-11 02:23 That. Or at least LDAP integration. Looking at the doc quickly it seems that their is no external user management possibility at all on the open source project. ---------------------------------------------------------------------- tankerkiller125real · 2023-11-11 03:27 The first thing I do when I run into projects like this that have SSO taxes is I check the repo to see if there is any code related to license checks and/or if the SSO is in the code itself. The next thing I do is pull the project down, remove the licensing requirements, and then use it in my personal environment. I'd never deploy it like that to a business, but in my personal lab? Absolutely, I'm not paying SSO taxes for my personal lab. ---------------------------------------------------------------------- [deleted] · 2023-11-11 04:18 [deleted] ---------------------------------------------------------------------- AlanC-137 · 2023-11-11 04:18 Here, take my upvote ---------------------------------------------------------------------- Psychology_Ninja · 2023-11-11 06:28 External user management features are in the roadmap. The project was just launched last week on github. You can expect a lot of new features in coming weeks/months. ---------------------------------------------------------------------- Psychology_Ninja · 2023-11-11 06:47 SAML & OIDC features are currently under development. It’s not available for anybody right now. ---------------------------------------------------------------------- AccountSuspicious621 · 2023-11-11 08:48 That is good to know thanks for your feedback. It's in my "to try" list anyway :) ---------------------------------------------------------------------- user01401 · 2023-11-11 13:36 My use case requires mobile apps as well but I will definitely be following this project ---------------------------------------------------------------------- Psychology_Ninja · 2023-11-11 13:37 We do have React native based mobile apps in our roadmap. ---------------------------------------------------------------------- user01401 · 2023-11-11 15:56 Great to hear and congratulations on the project! ---------------------------------------------------------------------- Psychology_Ninja · 2023-11-11 17:24 Thanks! ---------------------------------------------------------------------- kmisterk · 2023-11-11 19:29 Not saying you should front load the effort, but it would be a sweet add on resource for sso.tax or as a standalone source of information to aggregate how to implement delicensed personal instances for home use. ---------------------------------------------------------------------- tankerkiller125real · 2023-11-11 19:33 The problem there is legal liability, and the fact that there are absolutely people out there that will deploy the the delicensed version in a business. That's why I never publish any details for the apps I've done it too. But at the end of the day it's pretty simple, search for license, oauth, OIDC, SAML in the code on GitHub, and then reverse engineer the code to see what it's checking for. Sometimes developers are nice enough to leave a unit test in the code that tells you exactly how you can take a license. ---------------------------------------------------------------------- kmisterk · 2023-11-11 19:38 Hey, u/Psychology_Ninja! thank you for sharing your product announcement. For future reference, we ask that product announcements and similar external links be shared via a self text post with a brief description of the product or blog link and a link to the page that you’re wanting to direct people to in the body of the self text post. We look forward to future content, thank you again! ---------------------------------------------------------------------- kmisterk · 2023-11-11 19:41 Oh I totally get it. But it might make companies re-think their pricing model. But you’re right. It’s not legal but man, what they’re doing shouldn’t be either. ---------------------------------------------------------------------- Psychology_Ninja · 2023-11-11 21:38 I will keep that in mind. Thanks for the information. ---------------------------------------------------------------------- SubRoot · 2023-11-11 22:52 This looks really interesting, its amazing how this has been dominated by only commercial options. ---------------------------------------------------------------------- iavael · 2023-11-12 00:40 If project is libre software or has OSI-approved license, then there's no legal liability. You can modify source code any way you want for any purposes, and rightholder gave you rights for this themselves. They cannot sue you for following terms of their license. ---------------------------------------------------------------------- iavael · 2023-11-12 01:01 What kinds of certificates does it support? Can I use certificate I already have that is legally recognized in my country? And what signing algorithms does opensign support? ---------------------------------------------------------------------- tankerkiller125real · 2023-11-12 01:20 The thing is, a lot of these projects/companies license most of the code as OSI, and then have all their "premium" features that require payment licensed under something else. It's just not worth the nightmare of trying to figure that out, and blah, blah, blah. ---------------------------------------------------------------------- anotherucfstudent · 2023-11-12 02:11 This is cool and I’ll be testing it out, but I should note that a big portion of why DocuSign and other platforms are legally binding is because of the chain of custody and a third party being willing to certify signing ---------------------------------------------------------------------- iavael · 2023-11-12 02:14 If source code is under FOSS license, then you don't have to figure anything out to modify it in any way. It's irrelevant, whether there's a proprietary version with premium features, you are free reimplement those features in FOSS code base. And if payment-checking code locking "premium" features is in FOSS version, then you absolutely can modify or delete it. Rightholder already gave you permission to do this when they licensed that code under FOSS terms. If rightholder doesn't understand what rights they give to user in license that they chose themselves, then it's rightholders own problem. ---------------------------------------------------------------------- meonkeys · 2023-11-12 02:55 [https://www.docuseal.co](https://www.docuseal.co) is another FOSS docusign/hellosign replacement. Also AGPL licensed, and they also charge an SSO tax. OpenSign seems to have a lot more activity lately based on GitHub stats. See [https://github.com/OpenSignLabs/OpenSign/pulse/monthly](ht tps://github.com/OpenSignLabs/OpenSign/pulse/monthly) vs. [https://git hub.com/docusealco/docuseal/pulse/monthly](https://github.com/docuseal co/docuseal/pulse/monthly) ---------------------------------------------------------------------- tankerkiller125real · 2023-11-12 04:33 That's now how copyright works... Fun fact, if you publish code on GitHub with no license at all, legally speaking, it's "All Rights Reserved". Meaning that if someone took that code and used it on a product, even if you made the code available online for everyone to see, you can still sue them for using your code without your permission. ---------------------------------------------------------------------- iavael · 2023-11-13 14:31 That's exactly how licensing or any contracts work. Nobody cares what parties implied, the only thing that matters is what's written in the document. If rightsholder gave you rights to modify source code any way you want, then you have then, even if he expects you not to do something. It's his job to choose a license that aligns with his expectations. As for code without any license, you are absolutely right. Implications do not matter, only contracts. If you don't have a license, then you don't have permission for anything regarding the code. ---------------------------------------------------------------------- rrrmmmrrrmmm · 2023-11-13 15:33 Nice, like [signdocs](https://github.com/philgresh/signdocs), [contract](https://github.com/nonsalant/contract) or [LibreSign](https://libresign.github.io/)? ---------------------------------------------------------------------- Psychology_Ninja · 2023-11-13 22:04 The first one is archived, looks like 2nd one does not digitally(cryptographically) sign the files & the 3rd one is not standalone app as its a nextcloud app. ---------------------------------------------------------------------- Psychology_Ninja · 2023-11-13 22:05 You can use any PFX/p12 certificate that you have. Either self signed or issued by a CA recognised in your country. ---------------------------------------------------------------------- Psychology_Ninja · 2023-11-13 22:08 Would appreciate your feedback once you test it. We are also generating completion certificates that include IP addresses from where the document was accessed, time stamps, email ids of signers. In a way a complete audit trail is maintained. If you check the terms of DocuSign they dont take any responsibility themselves. Rather the integrity of the signed documents is guaranteed cryptographically using digital signatures. ---------------------------------------------------------------------- iavael · 2023-11-14 04:14 And how key material is stored? Is it possible to use PKCS11 tokens? And are there any limitations for algorithms?