Not sure about the way decodex.json is updated

[anthony-o]

Hello,

At the moment, this github repository contains for me a big problem: I cannot check if the commits are really a mirror from the Le Monde Decodex program; we are only forced to trust you.

What can be a bit better would be to publish the code which does the "automatic updates" and seems to create the commits in this Git repository. But then again, how to be sure that the commits would come from this tool and not from you "manually"?

Do you have any idea to be more transparent and better serve the public interest?

[mtparet]

Hello,

I understand your concerns. Yes indeed I should (and will) push the code what do the work.

As the content of the url is not signed, I don't think there is a way to ensure content has not be modified, like in https://archive.org/ there are no proof they did not modify the sites.

[mtparet]

Code uploaded https://github.com/mtparet/decodex-data-updater

[mtparet]

There is an interesting similar project https://github.com/lauregch/decodecodex which execute the code in a google spreadsheet so you can copy it and verify what is executed.

[anthony-o]

I think the only way to create a really trustable source of updates would be to code an Ethereum contract ( = program which will be auto-executed directly in the Ethereum worldwide blockchain) which would retrieve the json data from Le Monde and publish it internally in a new block of the blockchain... following replies of this stackoverflow question perhaps?

[mtparet]

Ethereum itself cannot retrieve data from outside of the blockchain https://www.quora.com/Can-you-have-data-fetched-from-a-URL-as-input-data-in-an-Ethereum-smart-contract but as mentionned in the issue you pointed we could use an external service like oraclize. (It moves the problem of the trust to this entity)