Docuseal: Open-source DocuSign alternative • Hacker News Board

Re: Docuseal: Open-source DocuSign alternative

#51

Post by Canada » Thu, Jul 20, 2023, 1:28 PM UTC

haswell wrote: post #43

hellcow wrote: post #8

Earlier quoted context omitted.

Docusign makes it easy to collect lots of signatures from lots of people. That’s the use-case from my POV. 1 signature on 1 doc, use any PDF tool—no problem. When a board needs to approve 4 docs and you need 5 signatures on each, it needs to be easy. Whether that’s worth Docusign’s pricing or if there’s better alternatives, up to you. But it’s objectively a helpful tool.

> Docusign makes it easy to collect lots of signatures from lots of people. That’s the use-case from my POV. 1 signature on 1 doc, use any PDF tool—no problem. Collecting lots of signatures isn’t Docusign’s value prop. The value is signature certification, and a proven track record in court. A single signature on a PDF is not technically difficult. The machinery to reasonably guarantee (edit: verify is a better word…

DocuSign doesn't really do anything to reasonably guarantee that it was any particular person who signed the PDF. Not that it really matters. If there was something worth suing over then usually there will be plenty of other evidence as to who signed the agreement.

Really the only thing that DocuSign does is timestamp the actions on the document. In order to get that a self hosted implementation would need some kind of third party system to act as a witness.

Re: Docuseal: Open-source DocuSign alternative

#52

Post by tyingq » Thu, Jul 20, 2023, 1:30 PM UTC

somery wrote: post #38

tyingq wrote: post #15

Earlier quoted context omitted.

It does seem on somewhat dangerous ground for "trademark similarity testing", "consumer perception", etc...with "docu- ". I'd have gone with "DocSeal" or something that was a harder break from the "DocuSxxx" pattern.

Thanks for pointing this out - it actually didn't expect that because of GitHub and GitLab and i haven't hears any trademark dispures between them. When Gitlab differs from Github by only 2 letters - DocuSeal vs DocuSign is already 3 letters. But i think that's a valid concern and i need to better investigate this - changing the name shouldn't be a problem when the project is still very new.

Yeah, it's one of those things where there's no definitive guidance, just loose tests. It's possible, for example, that DocuSign wouldn't care.

But, it seems different from GitLab/GitHub since the second word starts differently. GitHut, GitHow, GitHot, etc, vs GitHub would be more similar here.

Re: Docuseal: Open-source DocuSign alternative

#53

Post by _ea1k » Thu, Jul 20, 2023, 1:31 PM UTC

dtx1 wrote: post #45

somery wrote: post #39

Earlier quoted context omitted.

IP addresses and browser User Agent strings are stored for each signature/submission - those are the only measures for 'non-repudiation' currently available. but i think it doens't differ from other mainstream SaaS solutions - if you read through their terms of services - they put 'non-repudiation' liability on users of their services

Those are both unfortunatly trivially faked

Signatures are pretty easy to fake too, because basically noone verifies them.

In practice, the security involved only has to reach the "good enough" threshold and not a 100% hack proof level.

Re: Docuseal: Open-source DocuSign alternative

#54

Post by doliveira » Thu, Jul 20, 2023, 1:32 PM UTC

jazzyjackson wrote: post #9

reisr3 wrote: post #5

What is the bar for a "legally binding digital signature"? Is this a very complicated topic - or is it quite simple? I can sign a PDF with OSX Preview for free. I can pay a bunch of money to sign with Docusign. Both produce a PDF with a digital image of my signature. I assume both documents constitute a legally binding agreement, so long as I actually preformed the digital signature. What justification do the e-signa…

> What justification do the e-signature SaaS companies have for their exorbitant prices? They will defend their digital signature in court. I was shocked to find these "click here to sign" contracts manage to do it all without an ounce of cryptography, but the fact is lawyers don't need cold hard math, they need a warm body to be a subject matter expert to explain to a jury that unless you're claiming someone else ha…

Yeah, I find it funny to see technologists being surprised that in most cases judges won't mind that the signature wasn't done with quantum-resistent cryptography stored in a blockchain or whatever. Technical solutions to political problems...

Re: Docuseal: Open-source DocuSign alternative

#55

Post by Nextgrid » Thu, Jul 20, 2023, 1:32 PM UTC

dtx1 wrote: post #44

supermatt wrote: post #33

The way a system like docusign works is that it is a (trusted) independent third party that will verify that the owner of email address X is the one that "signed" the specific version of an agreement. By self-hosting, you have access to the infrastructure and can manipulate it to your will. There is no proof that the counterparty signed anything - you could just manipulate it to say they did. This potential for misus…

Not entirely true, cryptographic signatures exist. For example the EU eIDAS Law allows Advanced Cryptographic Signatures to basically just be PGP Signed Emails

Which unfortunately nobody uses because non-cryptographic signatures (such as Docusign or this but hosted by an independent third-party) are considered good enough in practice.

Hell, nobody even has a smartcard reader, and as far as I know none of the eID cards have contactless capability that phones (who all have NFC readers nowadays) can use.

I wish smartcards took off and computers included readers as standard. This would not only solve strong authentication but also payments (just insert your bank card and do EMV-style payments with comparable levels of security).

Re: Docuseal: Open-source DocuSign alternative

#56

Post by _ea1k » Thu, Jul 20, 2023, 1:32 PM UTC

supermatt wrote: post #33

The way a system like docusign works is that it is a (trusted) independent third party that will verify that the owner of email address X is the one that "signed" the specific version of an agreement. By self-hosting, you have access to the infrastructure and can manipulate it to your will. There is no proof that the counterparty signed anything - you could just manipulate it to say they did. This potential for misus…

I do wonder about that for self-hosting a service like this. But how often do actual disputes arise between parties as to whether a document was actually signed or fraudulently altered?

TBH, even a contract rests on a certain amount of trust between the involved parties.

Re: Docuseal: Open-source DocuSign alternative

#57

Post by rodolphoarruda » Thu, Jul 20, 2023, 1:35 PM UTC

somery wrote: post #11

Hi everyone, my name is Alex and I'm the creator of DocuSeal. I was not happy with the existing mainstream document signing solutions so I decided to create an open-source alternative. I've been working on this project since the middle of May and here is what the tool can do so far: - PDF form fields builder - 10 field types available (Signature/Date/File/Checkbox etc) - Multiple submitters per document - Automated e…

Hi Alex. First of all, congratulations. The product looks great for a 1.5 month worth of dev work. Impressive.

Is it possible at the moment to send signature requests via WhatsApp? (even at a cost per send)

Re: Docuseal: Open-source DocuSign alternative

#58

Post by pohuing » Thu, Jul 20, 2023, 1:39 PM UTC

Nextgrid wrote: post #55

dtx1 wrote: post #44

Earlier quoted context omitted.

Not entirely true, cryptographic signatures exist. For example the EU eIDAS Law allows Advanced Cryptographic Signatures to basically just be PGP Signed Emails

Which unfortunately nobody uses because non-cryptographic signatures (such as Docusign or this but hosted by an independent third-party) are considered good enough in practice. Hell, nobody even has a smartcard reader, and as far as I know none of the eID cards have contactless capability that phones (who all have NFC readers nowadays) can use. I wish smartcards took off and computers included readers as standard. Th…

The German eID has had that for years now. And it works pretty well. Only problem is that nobody uses it because our processes aren't adapted to it.

The first time I used it for anything, apart from signing pgp keys, was to collect 200€ rent assistance and it worked flawlessly in 4 minutes.

Re: Docuseal: Open-source DocuSign alternative

#59

Post by haswell » Thu, Jul 20, 2023, 1:40 PM UTC

Canada wrote: post #51

haswell wrote: post #43

Earlier quoted context omitted.

> Docusign makes it easy to collect lots of signatures from lots of people. That’s the use-case from my POV. 1 signature on 1 doc, use any PDF tool—no problem. Collecting lots of signatures isn’t Docusign’s value prop. The value is signature certification, and a proven track record in court. A single signature on a PDF is not technically difficult. The machinery to reasonably guarantee (edit: verify is a better word…

DocuSign doesn't really do anything to reasonably guarantee that it was any particular person who signed the PDF. Not that it really matters. If there was something worth suing over then usually there will be plenty of other evidence as to who signed the agreement. Really the only thing that DocuSign does is timestamp the actions on the document. In order to get that a self hosted implementation would need some kind…

They’re capturing more than just timestamps. If possible, they’ll associate a signature with a DocuSign profile, which itself has a history of interactions with DocuSign servers. They also capture associated emails, IP/browser info, drop cookies, location data if enabled, etc.

None of this guarantees Person A signed the doc, but the point is to systematically collect as much info as possible to be used if someone does sue, and to check the boxes that customers need checked in a consistent manner that they can sell as an effective solution that stands up in court.

I’m not saying they’re doing anything unique here, but customers - especially enterprise customers - buy it for all of these things, not just because it makes coordinating many signatures easier.

The typical “no one gets fired for buying DocuSign” adage applies here.

Re: Docuseal: Open-source DocuSign alternative

#60

Post by michaelmior » Thu, Jul 20, 2023, 1:41 PM UTC

somery wrote: post #11

Hi everyone, my name is Alex and I'm the creator of DocuSeal. I was not happy with the existing mainstream document signing solutions so I decided to create an open-source alternative. I've been working on this project since the middle of May and here is what the tool can do so far: - PDF form fields builder - 10 field types available (Signature/Date/File/Checkbox etc) - Multiple submitters per document - Automated e…

I tested it out briefly and it looks very cool for something put together within a couple months. One thing that doesn't seem to work at the moment is automatically recognizing existing PDF form fields (although perhaps there was a problem with the specific PDF I tested).

Being able to quickly import existing forms and then just add some labels would make things move a lot quicker.

One other thing that would be helpful is to handle variable numbers of signatures required. Some documents I have to deal with have space for many signatures but for any given instance, only one or two might be needed. Perhaps I've missed this, but I'm not sure existing templates would handle this case. I think that ideally a template would contain all the signature fields but then I can specify which ones are actually required when I send out the document for signature.