31–40 of 48 posts
Tried to poke a little to see if I can find any name (I could not). Challenge with this domain is the TRUST anchor. As an organization/company you have to establish yourself first (directly or through reference) otherwise its hard for anyone to trust you.
Looks interesting, but in order to actually compete with any e-signing platform you'll at the very least need to have templates with pre-filled information, an API to autofill docs with required information, and more field types. Right now for example, you can only add text, checkbox, and date/signature fields. Checkboxes are required to be checked (no making them optional), so if there are multiple checkbox options,…
It’s a neat proof of concept, but it’s hard to see the organizations that care about certified documents adopting this. Inherently conservative. Let’s Encrypt invested a lot in their early partnerships and used that to sneak up on the conservative buyers and trusters of certs.
In my opinion, all of these open source/free/open document signing tools are neat on paper (and technically fulfill the goal of being able to verify a document's chain-of-custody/signature provenance) - but won't take off in any meaningful way legally because there's no entity behind them taking the responsibility for accuracy and culpability. DocuSign/Adobe/whomever is trust anchor, it's an entity you can sue or sub…
In my opinion, all of these open source/free/open document signing tools are neat on paper (and technically fulfill the goal of being able to verify a document's chain-of-custody/signature provenance) - but won't take off in any meaningful way legally because there's no entity behind them taking the responsibility for accuracy and culpability. DocuSign/Adobe/whomever is trust anchor, it's an entity you can sue or sub…
Each open standard where it's clear the only consultation was between the prompt engineer and Claude is as tedious as the weekly cryptocurrency whitepaper of the mid-2010's.
The only novel factor in the proliferation of lazily prompted open standards is we have a perfect demonstration of the futility of LLLM sycophancy when combined with a mind looking for an easy win.
In my opinion, all of these open source/free/open document signing tools are neat on paper (and technically fulfill the goal of being able to verify a document's chain-of-custody/signature provenance) - but won't take off in any meaningful way legally because there's no entity behind them taking the responsibility for accuracy and culpability. DocuSign/Adobe/whomever is trust anchor, it's an entity you can sue or sub…
Why not use RFC 3161? Due to how the code signing works, timestamping servers are provided by all major CAs with full public access, e.g. timestamp.digicert.com, timestamp.comodoca.com, timestamp.sectigo.com, etc. PS. OP, your comments are auto-killed for some reason. You may want to message mods to get this sorted.
Youre right, I conflated two things in my reply to sscaryterry. B-T needs an RFC 3161 token from any TSA. Its only a qualified timestamp under eIDAS that needs a QTSP. Those are separate claims I ran them together.
Although the code already has the path. The signing service uses pyhanko with an HTTPtimestamper pointed at timestamp.digicert.com, and its switched off at every call site. Reason was availability, an external TSA sits on the signing path, so if its slow or down, sealing fails, whereas the anchor is async and can never fail a seal. That reasoning holds for the default and doesnt justify never offering it.
It should be optional, and on where the caller wears the dependency, which also gets pyhanko to embed validation info and go to LTA rather than just B-T. Only thing I want to check first is the terms on those public TSAs, since a few are scoped to code signing. Opening an issue, and thx agaain.
I know that there are some sites, like proofofexistence.com that acts like a notary service anchored to Bitcoin. Is that similar?
To me, it seems that there are some secret things you might want to hash and sign, and timestamp, like agreements that you can prove that both parties signed them, etc.
In my opinion, all of these open source/free/open document signing tools are neat on paper (and technically fulfill the goal of being able to verify a document's chain-of-custody/signature provenance) - but won't take off in any meaningful way legally because there's no entity behind them taking the responsibility for accuracy and culpability. DocuSign/Adobe/whomever is trust anchor, it's an entity you can sue or sub…
Indeed. It doesn’t meet the requirements of EU qualified signatures or seals, for example.
In USA we only have a few requirements from the E-SIGN act:
Key Legal Requirements
Intent to Sign: Parties must show a clear, provable action to sign the document. Electronic Consent: Parties must agree to use electronic records, with consumer transactions requiring specific advance disclosures.
Signature Association: The system must capture an audit trail or text linking the signature to the specific document.
Record Retention: Contracts must be accurately stored and remain accessible for future reference by all authorized parties.
Consumer Disclosure Rules
Hardware/Software Notice: Tell users what tools they need to access and save the records.
Paper Copy Rights: Inform users how to get paper copies and whether any fees apply.
Withdrawal Details: Explain how consumers can change their mind and cancel their electronic consent.