8 ms·

My understanding (possibly incorrect) is that competing with DocuSign is hard because of the need to follow obscure state and National laws (many of which are d

• wrs 3y ago
  DocuSign itself just refers you to your own counsel for legal advice, but does publish and update a handy multi-country legal reference. For the US one, at least, they give examples of where electronic signatures are pretty common and straightforward, and where you need to be careful. Software-wise, they have features to help you show evidence of who signed, where, and when in multiple ways. Nothing magical, though. If there were secret sauce, you would think they’d mention it prominently, but they don’t. https://www.docusign.com/products/electronic-signature/legality/united-states https://www.docusign.com/products/electronic-signature/legal...
  • alexopensource 3y ago
    We also generate a completion certificate that has the time & ip addresses of everyone who accessed and modified a doc during the entire signing process, plus we are open source which means more transparent. We plan to publish a lot of content in that space but with limited resources currently we plan to build the product features first. Also, we are soon going to start our fund raise efforts which will ultimately speed up things.
    • szundi 3y ago
      And soon after suddenly the Pricing page appears, after 3 months of disappointment convenient features turn paying ones. In some more years it is just as expensive as Docusign. Eh sorry, I’m just sad about Rocket Chat.
      • alexopensource 3y ago
        The self hosted version will always be free :)
        • josephcsible 3y ago
          Your CONTRIBUTING.md file says "By contributing, you agree that your contributions will be licensed under its MIT License." Since OpenSign is AGPLv3, why don't you allow contributions under the same license, if the self hosted version will always be free? I'm worried that the purpose of that might be to let you make it proprietary later.
          • deleted 3y ago
            [deleted]
          • tormeh 3y ago
            AGPL for thee but not for me, for I require MIT. To be fair, this is an entirely reasonable way to do business, but it's also a bit funny.
          • anonymous_sorry 3y ago
            I guess this allows them integrate with proprietary code on their back end if necessary, whilst making it hard for a competitor to take their code and undercut them, since most corps with proprietary software to protect won't touch AGPLv3 with a barge pole. Nothing prevents an AGPLv3 fork if OpenSign goes proprietary in future. I'd rather this approach than yet another non-standard Amazon-proof licence.
            • josephcsible 3y ago
              > I guess this allows them integrate with proprietary code on their back end if necessary Couldn't they have accomplished that just by asking for GPLv3 instead of AGPLv3? That would let them do so without letting them make the self-hosted version non-free, unlike asking for MIT. > Nothing prevents an AGPLv3 fork if OpenSign goes proprietary in future. Yes, but this would be true for almost any FOSS license offered and regardless of what they ask of contributors. > I'd rather this approach than yet another non-standard Amazon-proof licence. I very much agree with this.
    • djbusby 3y ago
      Those certs integrated with with any Timestamp Authority?
• alexopensource 3y ago
  Thanks for asking the right question. We are taking legal help to be compliant with various jurisdictions. Our solution is currently able to safely sign a document with a digital signature that will make it tamper-proof and show a geen tick in Adobe PDF while keeping track of incremental annotations added by multiple signers. We envision to add support for eIDAS and AADHAAR e-sign(widely accepted in India) very soon.
  • petertodd 3y ago
    > Our solution is currently able to safely sign a document with a digital signature that will make it tamper-proof Who holds the secret key that actually signs the document? If this is in fact a self-hosted, open-source, project then clearly the user does, and they could sign a different, tampered, version of the document after the fact. I would hesitate to use the term "tamper-proof" in that situation. Right now your documentation doesn't make it clear how this actually works. I'll also point out, that even if you were using my OpenTimestamps scheme or some other secure timestamping system, I would still hesitate to call the solution "tamper-proof". The problem is that even with timestamps someone can in many situations pre-generate alternate versions of a document in advance. Calling this type of system "tamper-resistant" is better IMO.
    • alexopensource 3y ago
      In the hosted version, we sign the document on behalf of the user using our own private key. Our roadmap also has the feature to bring your own cert(not relevant here). As soon as a user signs a document, a copy of the signed document is instantly sent to all the parties involved. This ensures that the signer cannot revoke the documents already signed. If the receiving party tries to modify the document, the signature becomes invalid. This is how we make sure that the docs are "tamper-proof" after signing.
      • petertodd 3y ago
        That's a reasonable, and pragmatic, way to implement this. But I'd still call it "tamper-resistant". One reason why is in situations where senders or recipients have modified something, proving that the _keys_ used to sign the documents were the correct ones can itself be a difficult problem.
• jjeaff 3y ago
  Are there really any laws requiring special types of signatures? Because I've never had a legal doc sent to me that they weren't fine with just stamping my signature on the line or even printing it out, signing it, and scanning it back in.
  • alexopensource 3y ago
    It depends on jurisdiction you are located in and the level of legal safety and acceptance you need. Our solution is already able to digitally sign the document which kind of makes it tamper proof and electronically sign(draw annotations) which will have you covered in most regions. Some regions have specific laws for example India has IT Act 2000, UETA & ESIGN Act while Europe has eIDAS.
  • baz00 3y ago
    Depends where you are but contracts and other legal documents are only ultimately enforceable in court usually. Electronic signatures tend to shorten that process somewhat as they provide signatory verification, contract integrity and ID verification so it's seen as a legal risk and cost mitigation rather than an actual hard contractual requirement.
  • p_l 3y ago
    European Union (and some states connecting with the same infrastructure, like Switzerland), have standardized formats as well as defined CAs that provide certificates for "qualified" signatures, which have the same legal weight as if you had a printed document with physical signature. DocuSign supports those mainly through some interop connections where, for example, a qualified signature vendor provides an API that DocuSign can use to sign the document.
    • alexopensource 3y ago
      You are right, that is precisely the route we will also have to take for certain regions. For example in India, there are only 3 entities that are authorized by the government to enable Aadhaar based e-signature. We will have to integrate with any of those in order to be compliant. We have already started working in this direction.
• deleted 3y ago
  [deleted]
• candiddevmike 3y ago
  AFAIK DocuSign acts as a trusted third party and protects/prove chain of custody. Think of them like a digital notary public.
  • alexopensource 3y ago
    Our understanding is that DocuSign does not have any legal authority, they prove the chain of custody/modifications using digital traces which our solution can also do, arguably in a more open way.
    • toomuchtodo 3y ago
      Electronic signatures legally recognized in the United States are provided for in the Electronic Signatures in Global and National Commerce Act (“ESIGN”) and state and territory versions of the Uniform Electronic Transactions Act (“UETA”). These are the regulations you’ll want to adhere to in order to provide parity with digital signature authority of traditional commercial providers (in the US at least). Great work btw! (Not an attorney, not your attorney, but happy to chip in fiat so you can consult with counsel and obtain an opinion letter from one in support of your project)
      • alexopensource 3y ago
        Saved the info in my notes. Will discuss it with our counsel in the next meeting. Thanks :)
      • ncallaway 3y ago
        UETA has been substantially adopted by 49 states. The state of New York has their own statute. So, if you look at e-sign, UETA, and NY’s Electronic Signatures and Records Act, then you have fairly comprehensive coverage across the US. Also not an attorney, and this is also definitely not definitive legal advice!
    • benatkin 3y ago
      Yes, making a mill for supposedly trusted third parties, over having an actual trusted third party, is a more open way. Edit: I suppose in all except the free self hosted one, OpenSign would be the trusted third party, which I guess is more plausible. Unless the paid customers are given something close to root to administrate them. Still, a trusted third party is generally based on recognition. Even if I really dislike a company I eventually acknowledge they're trusted if it lasts long enough, like with ID.me. I didn't use ID.me until it was required for logging into the IRS and now I grudgingly admit that I think it's an extra security check on logging in. So until you're big like DocuSign I wouldn't view you in quite the same way as a trusted third party. That does bring a question, are your paid customers prevented from going under the hood in such a way that they would also have to be trusted at such a level along with OpenSign? -- This to say I'm open to using OpenSign, because there are plenty of uses where I would be open to using something that doesn't have this "trusted third party at the level of DocuSign" feature. The "digital notary public" analogy is apt. I sometimes sign documents with a notary, and other times without.
• figassis 3y ago
  Wouldn’t it be amazing, since e signatures have been around for ages, that governments just published the requirements for legally binding digital signatures rather than ask each maker to go talk to them and get some obscure license or blessing?
  • amolshejole 3y ago
    Yeh, its already happening in a lot of regions across the world. We see a future that will have more open standards, it is precisely the reason we are working on this solution now.
  • jeron 3y ago
    How else will DocuSign have a moat??
  • eKIK 3y ago
    In the EU this is actually the case since 2016. There's this regulation called eIDAS (electronic IDentification, Authentication and trust Services). Article 26 (linked below) describes the requirements for an electronic signature to be legally binding. https://www.eid.as/#article26 https://www.eid.as/#article26 https://en.m.wikipedia.org/wiki/EIDAS https://en.m.wikipedia.org/wiki/EIDAS
• saled 3y ago
  You know that there's nothing stopping an open source project funded as a not for profit from doing the same thing right? If something is hard, that's an argument for making a standard not for profit version of it, so it becomes a common good instead of platform rent seekers keeping out competition by saying it's "too hard".
  • nonethewiser 3y ago
    How do you personally differentiate between “rent seeking” and running a business?
    • paulryanrogers 3y ago
      When it's 'done' and you keep collecting money, without adding additional value? Like a slumlord who collects rent and does nothing to even maintain the property. Except perhaps vote down YIMBY reforms.
      • deleted 3y ago
        [deleted]
    • kurthr 3y ago
      Not the OP, and this isn't something I'm dramatically invested in, but... Rent seeking would be designing a product for collecting rent (not a one time payment) for a product (e.g. SaS) that doesn't wear out or has separate maintenance costs. Like a house that is rented the value comes from the income stream and it likely is adjusted by something like inflation. Not renting would be selling a product for a one time fee, perhaps even if there are many customers (you still get to play ticket pricing games like the airlines so different people pay different amounts at different times, but not as variable as rent). Making the product non-transferable blurs the rent line a bit. Also not rental is the maintenance or improvement on the product (or the house) since that is new work that is being done. It used to be that only physical objects were rented and services were inherently work and required new effort/ingenuity to be solved each time. However, with the introduction of art reproduction (visual, audio, physical) and copyright/patent, as well as, non-perpetual licensing of software this is no longer the case. It's possible to hold a piece of intellectual property and collect perpetual rent with little or no future investment. It does create a different incentive structure that can be quite customer hostile.
• tiahura 3y ago
  You are incorrect. I'm not familiar with any law that requires Docusign in any jurisdiction in which I practice. The Federal Esign Act provides: 15 USC 7006(5): The term “electronic signature” means an electronic sound, symbol, or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record.
  • Sebguer 3y ago
    You're misreading OP, they're not saying anything about law requiring Docusign, they're saying that Docusign has invested in meeting the law.
  • SoftTalker 3y ago
    AFAIK, anything that is intended to be a signature, is a signature. This can be a hand-drawn "X", a signed name, a typed name, a fingerprint, a rubber stamp, clicking "I Agree" checkboxes, etc.
• kemitchell 3y ago
  I haven't researched the law here in a while, but my general impression the last time I did was that there isn't much in the way of legal requirements for signing things digitally beyond the federal ESIGN Act, general principles of state contract law, and the smattering of very particular kinds of transactions that require processes like notarization or recording. For everyday deals between the vast majority of people and companies, it really comes down to whether what the e-sign collects and saves will be available and convincing down the line, when there's a dispute. When dealing with government entities, you may run into policies of those entities that require use of a pre-approved service. For example: https://www.sos.ca.gov/administration/regulations/current-regulations/technology/digital-signatures/frequently-asked-questions#provider https://www.sos.ca.gov/administration/regulations/current-re... All that said, I have both implemented electronic signature in my own software and reliably recommended clients running sales ops just buy DocuSign. Familiarity and credibility can matter way more than legal or technical details...or not at all.
  • Projectiboga 3y ago
    Supreme Court said you can agree to things online awhile ago.
    • jacurtis 3y ago
      Nothing in the American legal system is that straightforward and simple, even less so among our Supreme Court. Things got even more confusing now that this year the Supreme Court has set a new precedent that they can now overturn their own rulings from decades earlier. While I think that’s generally true that online signatures are acceptable in most circumstances, I’d be careful to blindly believe it as a blanket statement.
      • vitus 3y ago
        > this year the Supreme Court has set a new precedent that they can now overturn their own rulings from decades earlier What happened this year specifically? Dobbs was in June 2022, but that isn't even close to the first time that the Supreme Court overturned precedent from 50+ years prior -- Brown v Board largely overturned Plessy v Ferguson ("separate but equal") from nearly 60 years prior. And, we've had plenty of Supreme Court precedents overruled since the 19th century. According to Congress: https://constitution.congress.gov/resources/decisions-overruled/ https://constitution.congress.gov/resources/decisions-overru... (Most of those never rose to the level of landmark decisions, but Plessy certainly did.)
• calvinmorrison 3y ago
  Close, the whole point of docusign is to avoid all of that by, one, paying docusign to solve those problems, and two because docusign is a "neutral" 3rd party who has good housekeeping records compared to "Opensign" where a self hosted sleazy hacker may decide he wants to fudge the datestamps on the signatures etc.
• thathndude 3y ago
  Lawyer here. Not legal advice. Really not that much by way of law to consider. If everyone agrees that an E-signature is good, then, generally speaking, an e-signature is good. I’d suggest it’s more on the people actually drafting the documents being signed than the software layer facilitating.
  • alexopensource 3y ago
    True. Even if one party from the signers dont trust e-sign, it wont work. But the number of people thinking an E-signature is good is only increasing day by day.
    • menzoic 3y ago
      I think by everyone they meant everyone involved in the contract being signed
  • ildon 3y ago
    Lawyer here as well, but from Europe. Here the same is true, unless the government is involved. Documents from/to any agency, including anything that has any tax relevance, - generally speaking (there are many caveats) - shall be signed with services compliant with the e-signature standards provided by Regulation 2014/910/EU (in short: PADES, CADES, XADES). Out of curiosity: is there a similar requirement in terms of e-signature in the US when documents need to be sent to some agency, such as the IRS?
  • graemep 3y ago
    Not a lawyer, but I know the position in the UK is pretty simple and much the same. The purpose of someone like Docusign is to provide a trusted third party to provide evidence. For most purposes GPG signed email (or anything else with a similar signature) would work perfectly well provided you could prove who the keys belong to. In fact it would be better than DOcusign who can (from the few documents I have signed) ultimately only really show they sent an email with a signing link to your email address. The last one from them has a warning: "Do Not Share This Email This e-mail contains a secure link to DocuSign. Please do not share this e-mail, link or access code with others."
• rubberband 3y ago
  Your overall understanding is correct. People pay DocuSign to "think" of everything for them (which is not at all bad, it just comes at a cost). Depending on the space, you have to deal with crazy laws that no one in their right mind would know about (nor think to even consider). Essentially, "no one ever got fired for signing with DocuSign" (play on IBM). I'm late to the party here, but if the authors want real world examples, please reach out.
  • alexopensource 3y ago
    You are right. But there are many Individuals/companies who cannot benefit from DocuSign's trust because of the price tag. We want to provide them the free/ open source option and during the process build a brand that is equally trusted if not more than DocuSign.
  • cucho 3y ago
    Not OP, but would love to see those real world examples.
• fulafel 3y ago
  Depends on the jurisdiction and your definition of "hard" - in the EU there's some kind of qualification process by the regulators but the system is supposedly design to encourage competition and be open to new providers, and it's enough to be approved by one country's regulators I think.
• NoboruWataya 3y ago
  You're getting a lot of responses to the effect that there aren't really any laws that require particular formalities to sign contracts, and while this is true in the "normal case" in many jurisdiction, there certainly are some categories of document that have more specific signing requirements. In most common law jurisdictions, for example, certain agreements must be signed as deeds which require certain formalities to be observed, and without enabling legislation it's not always easy to square these formalities with electronic signatures. https://en.wikipedia.org/wiki/Deed https://en.wikipedia.org/wiki/Deed
• tiansu_yu 3y ago
  Note that DocuSign does not automatically provide this as well in Europe. For example, in Germany, digital signature is not legal at all. So for every occasion, DocuSign is mainly used as a binding in a nonlegal way (for example, employee and employer agreed on paper that there will be a contract). But until both of you signed a physical copy, this is not legally binding at all.