Comment by Daviey | Hacker News Reader

Comment by Daviey | Hacker News Reader

I deployed this a month ago and have been pretty happy with it so far. Even in the self-hosted version, there are some built-in upsell features that make this seem open-core. However, these features are trivial to remove in your local version.

Some people are confused about what signing means. To me, there are three different types:

1. The ability to put a visual signature on a document. If you want this, just use MS Paint or similar tools.

2. Cryptographic signature, using Public Key Infrastructure (PKI), etc. This isn't really practical until we have widespread client certificates, or something like EIP-712 in mainstream usage.

3. Digital verification via audit data. This is where eSign platforms really provide their value. It's possible to view when a user opened a document and when they signed it, by logging sufficient audit data about their user client/browser. Think about the unique fingerprint provided by websites like https://coveryourtracks.eff.org/, etc.

Now, DocuSeal seems to only log opening and signature events, along with the user-agent and IP address. For many users, this may be sufficient data, but DocuSign includes a more unique fingerprint. With this data, it's possible to be more confident that a system was used to sign the document than with a wet ink document.

That said, some people also feel that the credibility of having this hosted by a third party adds value, as they are impartial.

Still, for my purposes, it's a great free project, so thank you.

>2. Cryptographic signature, using Public Key Infrastructure (PKI), etc. This isn't really practical until we have widespread client certificates, or something like EIP-712 in mainstream usage.

It's very practical and used in certain jurisdictions, with very high rollout rate of personal certificates. Within EU regulatory framework it's also a thing and has legal meaning, then there is US government with their weird fixation on contact-only smartcards.

That being said, it's globally deployed with an "advanced", rather then "qualified" profile, where provider applies a signature with their own certificate (or ethemeral certificate issued to user on the spot) and embeds it into pdf as a field.

European Commission even has a library [0] in addition to the law for that.

It's kind of a mess, but nobody really cares until somebody tries to challenge validity of their own signature, which is very very rare. As a former industry insider I would say it's all a security theater and you can as well exchange emails to confirm existence of a contract. It's just more convenient to have a document with a signature as a single artifact, even if it's produced in ms pain as you rightly suggest.

[0] https://ec.europa.eu/digital-building-blocks/sites/display/D...

Do you have some statistics on the "very high rollout rate"? I am skeptical of its success.

Here you go: https://diia.gov.ua/news/perereyestraciya-avto-e-pidpriyemec.... 50% of all adults have the app, almost everybody else has a bank account and proper PKI is part of both and is pre-requisite to deal with tax authorities and e-services in general. Since it's also built into most European id cards for the last forever, it's not a certificate rollout problem is "why do I even need this" problem.

In Ukraine PKI finally found the problem it was solving, due to VAT return fraud and repudiation through courts.

In Lithuania and Estonia it's also widely used, but I'm not familiar with their landscape that much.

Anecdotal, but I use it daily in company setting (as does many people in my company) and 90% time when contacting government in personal matters. Honestly it's pretty awesome.

> If you want this, just use MS Paint or similar tools.

Except then you need to have people install those tools and know how to use them correctly. I think eSign platforms can still provide some value here in terms of usability even if that's not the core value proposition.

Last time we bought a house, we did basically everything on our phones, including tapping our way through the closing paperwork on one of these platforms. Easiest time by far—we’d used them for parts of other house purchases, but had never done the whole thing that way before. These sorts of platforms also take care of notifying everyone when stuff’s done, maintaining an todo list for signing, sending reminders, verifying you didn’t miss spots that need a signature or initials, and making sure everyone who needs access to the docs, has it. They’re really nice.

Anyway, if you just want to draw a signature on docs standalone with only local software and none of that other nice stuff, the good solution on a desktop OS isn’t mspaint, but Preview. Works directly on pdfs, can generate a fancy sig or let you draw your own, signatures re-usable and available in a drop down menu next time you need to sign something.

Preview is great on Mac, but does not exist on Windows. If parent uses Windows, perhaps they must resort to MSPaint (which is much worse for this purpose).

On Windows, the best way to draw on PDFs is actually Microsoft Edge. It even handles pressure sensitivity if used on a laptop with a stylus or with a graphics tablet.

And I'm not sure of the value. If an email reply saying "I agree to this" is sufficient then I'm not sure what having a skeuomorth signature adds to the process.

You often need to show the document to some kind of a third party, from a local government to your medical provider. People usually expect to get a nice PDF with that useless skeuomorth signature and put into their archive in case they will then have to show it to somebody else during audit or something. Document+signature is simply a convenient artifact. It's obviously very easy to manipulate, so the government invented this whole PKI stuff which nobody uses, as repudiation happens almost never and nobody provides validation services for the cryptography part of it.

Thank you for supporting our open source company. We really appreciate it.

Reply on news.ycombinator.com