DocuSeal - a Docusign-like opensource tool

The problem

    I'm not really big on endorsing services, but I found DocuSeal over the last weekend and thought I'd share some experiences with it. I've been discussing a lot lately about how people should have some basic sign before work performed stuff, even for contractors and individually owned companies so they aren't getting screwed over (there's a lot of ways to do this to someone). Personally I'm using obsidian and it's print to pdf thing to create and edit (if needed) templates for various forms and reporting situations. Platforms like google forms is nice for just generic information filled out, but doesn't do any digital signatures or provide any proofs that the data wasn't tampered/altered/or faked. So I've been trying to find a solution to suggest to others that doesn't completely suck or cost an arm and a leg.

    But before I get to how DocuSeal seems to work for me on that, lets discuss this for a second so you understand the realm of problems I'm talking about. Lets say you start your own home business of doing something simple like mowing a lawn, cleaning gutters, or building fences. Seems pretty straight forward until we live in a day where everyone wants to screw each other over for the final say, the cheapest work, the least effort, whatever reasonings. Here's a small list of the ways someone can turn not having a signed document against you:

  • The actual owner didn't request it or claims they didn't
    • They claim you broke their sprinkler head, or their gutter drain, while performing unapproved work
    • They claim no one gave you permission to build that fence and sue for thousands in damages
    • They stop you half way through, claim no permission, then sue you for incomplete work AND damages
  • They don't want to pay for supplies after agreeing to, or refuses to pay for any upfront costs to later say they paid for the work and not those costs
  • They go an break the fence during building and claim you never repaired/built anything
  • Randos charge you a fee and claim a contractor's lean against you on the basis of work they claim they did on your behalf
    Okay, that last one is a bit far off, but still very relevant to protecting your ASSets due to the chances of at any time someone doing this, having a documentation process makes the scope of the claim need more evidence from the nonsensical argument. The rest are things I've readily seen happen to people and without a normalized document people sign before work begins, these sorts of scams become popular/common place. In my line of business it's become extremely necessarily, especially for ethical hacking engagements or otherwise potentially illegal if not protected by contract disclosing permission appropriately. It's critical in the cybersecurity world and to a lot of points even simple IT work world, to have these signed documents protecting any work performed.

Solution search

    When I first went to find a solution to this, I figured it made sense to just use a word document that I could change as needed. Which I feel like this works fine for most people but relies heavily on your word processor (like ms-word or libreoffice writer), and there isn't really a direct path to get people to sign outside of printing it off. 

    Dug into this further and started using obsidian. Which works great for the templating side and the ease of customization, but still not really anything in terms of signing for it without a lot of work and some unstable rigging. 

    So, went to the most popular choice for signing stuff, which I could take the output from obsidian (via export pdf) then import that pdf into platforms like docusign. Except I don't have the money to use anything more than a trial with them, and I image most people don't have the capital to start this journey doing that either. 

Enter DocuSeal

    When searching for alternatives to docusign, I found docuseal. Which, wouldn't have really been on my radar if it wasn't for it being both open source and compatible with self hosting versions. So I spun up a self hosted version and for my uses, it's exactly what I needed. Sign it into my external facing mailing account for billing, and setup webhook to enable interactions from other services, and I'm in business. But that's a lot of effort still for most people, so lets go through the other route they have. 

    FREE! Okay, it's not completely free to use their hosted version, as there is technically limitations. But their basic ("Free forever") version isn't just some nerfed/kneecapped version either. Features list shows this selection:

  • Indefinite document retention
  • Users management
  • 10 field types
  • Multiple signers
  • Automatic eSignature
  • 10 signature request emails per month <-- this one may be a concern.
    Maybe it's too good to be true. The biggest limitation is the signature emails limits, which if you self-host wont need to go through their email providers. If you're going to need more than this, there is paid tiers of course, but there's also the option of opening up the signing link on a tablet or phone instead of sending emails for it. Which, once saved, can be printed off or emailed after the fact. 

Testing time

    So first off, lets not forget for the technical folks, there is an api to integrate into your IT systems if you're like me and need some automation in your life.


    Creating templates is basically uploading the template file your want, from word, from obsidian, from notion, whatever. 


    In the editor page you can change the recipient:



    From there, you can add and edit fields, which can be signed during creation for standard business side signatures, or leave the field to be edited by the signer such as a signature field. 




Results, commentary, and suggestions

    With things being this easy to cover so much of your small or local business' assets for free, with something as simple as a contract paper, I really don't see any reason why people wouldn't want to do this outside of getting the 15 minutes free time to do it. If simply printing off and signing papers, peeling off the carbon copy, and going that route is what your company needs, you might try seeing if obsidian or notion (note taking apps) can be used to make the templates you need still anyway, really you should tailor these concerns for what works best for your work and work style.

    If you're unable to step away for 15 minutes to write up a document or make an AI do it for you to come back and accuracy check it, maybe call while you're working on something and lets see if we can't figure something out for ya. I'm not a lawyer, and I can't guarantee my documents will hold in court necessarily, though it's a layer away from nothing. However, there are many lawyers who offer these services as well around here (dfw metro) for a small fee, to make sure that the wording is legally binding if you're worried about further loopholes being abused (worth asking for advice like this if you have the money).

Thanks for reading

If you need any IT or CyberSecurity work remotely or within the DFW area, please contact us over at FeemcoTechnologies.

Comments

Post a Comment

Popular Posts

pyscript, nim, aaaaand go

Image
     Just wanted to drop some stuff over what I've been playing with lately. Please be aware, tools and links described here might be or be able to be used maliciously, don't click or run things without understanding them. Much of the code referenced here can be found on github . Pyscript      To start with, I found the latest version of pyscript and couldn't really think of anything to do with it, outside of visualizations for web interface, or making integrations with jypyter widgets a little different without learning javascript. So I went a different route. In case anyone isn't aware, pyscript is intended to go along side pyodide or micropython (web versions of python) to leverage python programming inside a web page (loading these as javascript modules with fun little interface features). There is a wide range of examples (https://pyscript.com/@examples) and even an online ide (coding environment) to play with.     That's where I came in, af...
Read more

ISP Routing Hell

Image
Weird Routes?  History:      So I wasn't really sure how to start this post, but I guess some back story. Many in the IT world know consumer ISPs (internet service providers) like ATT, Comcast, Charter (now spectrum), all have a weird history of "you can't prove there's a problem because we don't escalate it properly, now you're stuck with this while we replace your router 200 times because it can't be on us" sort of problems. I switched to spectrum because in my area its the only non-att fiber lines, and ATT couldn't tell me why my router had an ssh server listening on it. They couldn't think it was compromised or could be compromised, they couldn't tell me anything they just replaced it. Then replaced it again. Then again. After 2 years of doing that, I just had enough. Later that year after leaving ATT, https://en.wikipedia.org/wiki/Salt_Typhoon . But sadly, despite my contempt for ATT by this point, this post isn't about them. More ...
Read more

DNS-Rebinding and such

      What started off as an interesting read on how DNS rebinding attacks work, and how they're leveraged to scan internal networks. The high level gist of the scenario is that if you have multiple A records, or the ability to rapidly change A records during someone's visit to a page, you can cause them to run push requests to other pages. This may include things like scanning a web-page visitor's local network, or replaying known addresses (maybe due to public dns resolving internal addresses) there is potential for attempting things like xss to steal credentials. Since it's the same domain being resolved, the browser often won't have any issue attempting requests.     Now, what this turned into was my general thought of "I've seen attacks before where people used webrtc, wasm, flash, vbs, etc... to port scan a network, I wonder if you could just use javascript targeting subdomains of other websites that have sub-domains pointing to private ips. This woul...
Read more