Comments
Hacker News
Any benefits over DocuSeal?
by jkahrs595
Looks interesting, but in order to actually compete with any e-signing platform you'll at the very least need to have templates with pre-filled information, an API to autofill docs with required information, and more field types. Right now for example, you can only add text, checkbox, and date/signature fields. Checkboxes are required to be checked (no making them optional), so if there are multiple checkbox options, they have to check them all to continue. Not very useful for actual e-signing flows.
by mfkp
Tried to poke a little to see if I can find any name (I could not). Challenge with this domain is the TRUST anchor. As an organization/company you have to establish yourself first (directly or through reference) otherwise its hard for anyone to trust you.
by sandeepkd
Loved it until I saw its using Bitcoin.
With proof of work doesn’t it tie this project to a bit of an environmental nitemare? Bitcoin isn’t the best place for this, no?
I would have imagined Ethereum or some other ledger would have been better no?
Anyone with more crypto ledger knowledge be able to say what I’m trying to say more precisely.
by evolve2k
Why not use RFC 3161?
Due to how the code signing works, timestamping servers are provided by all major CAs with full public access, e.g. timestamp.digicert.com, timestamp.comodoca.com, timestamp.sectigo.com, etc.
PS. OP, your comments are auto-killed for some reason. You may want to message mods to get this sorted.
by eps
Nice idea but with all related things the ultimate question remains whether courts will actually recognize it.
Currently courts will still consider paper-signed and scanned PDFs as legally binding, so any verification on top of that is superfluous to them.
More realistically, you take an oauth when you take the stand at the court, and if a signed document was altered by the counterparty you'd say so truthfully, if it weren't, you'd say so truthfully, and the penalty of that oauth purjury is high enough that most people wouldn't do it. Cryptography not needed.
by qurren
You can't be the "Let's Encrypt of" anything if it's self-hosted. The entire point of Let's Encrypt is that there is a centralized reputable entity of note signing everyone's keys. Without that, it's entirely worthless. It's no better than a self-signed SSL cert or putting your own PGP key on a document manually. There's no point in a layer of abstraction atop that.
by vitally3643
In my opinion, all of these open source/free/open document signing tools are neat on paper (and technically fulfill the goal of being able to verify a document's chain-of-custody/signature provenance) - but won't take off in any meaningful way legally because there's no entity behind them taking the responsibility for accuracy and culpability.
DocuSign/Adobe/whomever is trust anchor, it's an entity you can sue or subpoena if something goes wrong. Someone who's actually on the hook for making sure whatever's signed is accurate and truthful (outside of the reputational risk of fraud completely obliterating any trust in your platform)...
No amount of cryptographic verification substitutes for having a legal person on the other end who can be held accountable for actually verifying the document was signed accurately/process was followed.
by JCBird1012
Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- Any benefits over DocuSeal?by jkahrs595
- Looks interesting, but in order to actually compete with any e-signing platform you'll at the very least need to have templates with pre-filled information, an API to autofill docs with required information, and more field types. Right now for example, you can only add text, checkbox, and date/signature fields. Checkboxes are required to be checked (no making them optional), so if there are multiple checkbox options, they have to check them all to continue. Not very useful for actual e-signing flows.by mfkp
- Tried to poke a little to see if I can find any name (I could not). Challenge with this domain is the TRUST anchor. As an organization/company you have to establish yourself first (directly or through reference) otherwise its hard for anyone to trust you.by sandeepkd
- Loved it until I saw its using Bitcoin. With proof of work doesn’t it tie this project to a bit of an environmental nitemare? Bitcoin isn’t the best place for this, no?
I would have imagined Ethereum or some other ledger would have been better no?
Anyone with more crypto ledger knowledge be able to say what I’m trying to say more precisely.
by evolve2k - Why not use RFC 3161?
Due to how the code signing works, timestamping servers are provided by all major CAs with full public access, e.g. timestamp.digicert.com, timestamp.comodoca.com, timestamp.sectigo.com, etc.
PS. OP, your comments are auto-killed for some reason. You may want to message mods to get this sorted.
by eps - Nice idea but with all related things the ultimate question remains whether courts will actually recognize it.
Currently courts will still consider paper-signed and scanned PDFs as legally binding, so any verification on top of that is superfluous to them.
More realistically, you take an oauth when you take the stand at the court, and if a signed document was altered by the counterparty you'd say so truthfully, if it weren't, you'd say so truthfully, and the penalty of that oauth purjury is high enough that most people wouldn't do it. Cryptography not needed.
by qurren - You can't be the "Let's Encrypt of" anything if it's self-hosted. The entire point of Let's Encrypt is that there is a centralized reputable entity of note signing everyone's keys. Without that, it's entirely worthless. It's no better than a self-signed SSL cert or putting your own PGP key on a document manually. There's no point in a layer of abstraction atop that.by vitally3643
- In my opinion, all of these open source/free/open document signing tools are neat on paper (and technically fulfill the goal of being able to verify a document's chain-of-custody/signature provenance) - but won't take off in any meaningful way legally because there's no entity behind them taking the responsibility for accuracy and culpability.
DocuSign/Adobe/whomever is trust anchor, it's an entity you can sue or subpoena if something goes wrong. Someone who's actually on the hook for making sure whatever's signed is accurate and truthful (outside of the reputational risk of fraud completely obliterating any trust in your platform)...
No amount of cryptographic verification substitutes for having a legal person on the other end who can be held accountable for actually verifying the document was signed accurately/process was followed.
by JCBird1012