Benjamin Kellermann
email: benjamin.kellermann@tu-dresden.de

Stefanie Pötzsch
email: stefanie.poetzsch@tu-dresden.de

Sandra Steinbrecher
email: steinbrecher@acm.org

Privacy-Respecting Reputation for Wiki Users

Keywords: Empirical Study, Privacy, Reputation System, Wiki

Wikis are popular tools for creation and sharing of content. Integrated reputation systems allow to assess expertise and reliability of authors and thus to support trust in the wiki content. Yet, results from our empirical study indicate that the disclosure of user reputation evokes privacy issues. As a solution for this conflict between the need to evaluate trustworthiness of users and protecting their privacy, we present a privacy-respecting reputation system for wikis that we realized as OpenSource-Extension for the wiki software MediaWiki.

Introduction

A wiki gives users the possibility to create a common information basis. Technically it is implemented as a collection of HTML pages, usually called wiki articles, that are generated, modified, and reviewed by wiki users. A very popular example is the online encyclopaedia Wikipedia. In January 2011, Wikipedia was available in 276 languages or dialects, among which English (more than 3.5 million articles and more than 13 million registered users) was the largest one. 3 This means, Wikipedia covers more articles than the famous and still in print available Encyclopaedia Britannica (about 65 thousand articles).

Wikis enable every user to contribute to the content with only her web browser. This leads to the drawback that it becomes difficult for readers to assess quality of content, and/or expertise of authors respectively. Wikis are aware of this problem and give users the possibility not only to change others' articles but to tag an article, e.g., with a number of stars and/or adding a written comment. Examples for MediaWiki -the software used to implement Wikipedia -are the extensions ReaderFeedback, Rating or Discussion. 4 This helps other readers to decide on how much they trust in the article.

Furthermore, the background of the users who create and also of those who rate an article are important. Here reputation systems common for other Internet applications, e.g., electronic marketplaces like eBay5 can be used to help wiki users to build up a reputation about their expertise, that they can use as authors and raters of articles. Having a user's reputation publicly available helps others to assess the trustworthiness of this user. However, this reputation is an aggregate of the user's personal properties/expertise/knowledge and conveys personal data, which means that privacy concerns may evoke and should be addressed. In this paper -after discussing background and related work on privacy-respecting reputation systems in Section 2 -we present an empirical study on users' privacy awareness with respect to their reputation in a wiki (Section 3). From the results of the study and existing work we deduce requirements focused on user reputation systems for wikis in Section 4. Based on the study and the derived requirements we propose a reputation system for wikis that allows users to find a balance between their need for privacy and other users' need to assess trustworthiness. In Section 5 we outline the design and implementation of our user reputation system for the wiki system MediaWiki and evaluate how it can fulfill the previously explained requirements in Section 6. The main focus of our work in contrast to previous work is giving the user the choice to balance his wish for privacy with the trustworthiness the content he creates has for others.

Background and Related Work

In the scenario of a wiki users may take the following roles:

readers read articles others wrote (possibly with evaluating ratings others gave to the article), authors write articles or contribute to existing ones, and raters rate others' articles (usually after reading them).

In this scenario we want to integrate a user reputation system. Reputation systems for an interaction system need to provide the following protocols [START_REF] Jøsang | A survey of trust and reputation systems for online service provision[END_REF]:

Centralized communication protocols that allow users to:

provide ratings about other users, obtain reputation of other users from the reputation server. 2. A reputation computation algorithm to derive users' reputation based on received ratings, and possibly other information.

Earlier work about reputation systems focuses on the e-commerce scenario that reflects such an interaction system with buying and selling products, e.g., [START_REF] Schafer | E-commerce recommendation applications[END_REF][START_REF] Resnick | Trust among strangers in internet transactions: Empirical analysis of ebay's reputation system. The economics of the internet and e-commerce[END_REF][START_REF] Livingston | How valuable is a good reputation? A sample selection model of internet auctions[END_REF].

In our scenario where the interactions between users are only implicitly given by reading/writing content an interesting question is whether 1. users get ratings explicitly from other users or 2. users get ratings implicitly from ratings given to the content they wrote.

User reputation and trustworthiness of content alternatively can also be created from system-based observations about the users' behavior. This approach was the one followed for calculating the reputation of content and users in wikis recently: Dondio et al. suggested an algorithm to automatically calculate the overall trustworthiness of a wiki article based on statistical data [START_REF] Dondio | Extracting trust from domain analysis: A case study on the wikipedia project[END_REF]. Adler and Alfaro [START_REF] Adler | A content-driven reputation system for the wikipedia[END_REF] present a system for Wikipedia that computes an editor's reputation by observing whether subsequent users preserve the changes that were made. Recommer Systems are slightly different from Reputation Systems by especially recommending content to users. A popular technique used to do so is collaborative filtering, this means using the input from other users in determining what is useful information for a user. The WRS (Wikipedia Recommender System) [START_REF] Lefévre | Wrs: The wikipedia recommender system[END_REF] is a rating-based personalized recommender system that uses trust metrics to give not only general information but personalised recommendations by comparing a user with other users and then calculating a trust profile of their expertise.

It has been studied from the legal perspective that user reputation can be seen as personal data [START_REF] Bygrave | Data Protection Law, Approaching Its Rationale, Logic and Limits[END_REF] and should be protected by technical means [START_REF] Mahler | Reputation systems and data protection law[END_REF]. This is contradicting to personalising reputation/recommendation data for users by a system. In [START_REF] Pingel | Multilateral secure cross-community reputation systems[END_REF] a small survey among 13 persons indicated that these participants do not feel comfortable to publish their real names within online communities and that half of them regard their reputation as privacy-sensitive data. Besides, there exists no empirical study on how privacy aware users are about their reputation in the context of a wiki. The other direction on how much content-and authorrelated information actually influences users' perceived trustworthiness of a Wikipedia article is already studied by [START_REF] Kittur | Can you ever trust a wiki?: impacting perceived trustworthiness in wikipedia[END_REF]. Privacy usually covers three aspects: anonymity of providing ratings, anonymity of obtaining other users' reputation, and anonymity of users who are rated and whose reputation is obtained.

Anonymity services -as suggested in [START_REF] Pavlov | Supporting privacy in decentralized additive reputation systems[END_REF] -can only protect the users obtaining reputation. In order to obtain anonymity of users rating and being rated, it needs to be ensured that many users are indistinguishable by an attacker, so that they are in large anonymity sets. For anonymity of users who are rated and whose reputation is obtained, others should not be able to link interactions with the same user. The possibility of recognizing users by reputation is limited if the set of possible reputations is limited [START_REF] Steinbrecher | Design options for privacy-respecting reputation systems within centralised internet communities[END_REF] or if the reputation is only published as an estimated reputation [START_REF] Dellarocas | Immunizing online reputation reporting systems against unfair ratings and discriminatory behavior[END_REF]. Transaction pseudonyms can be used to avoid linkability between transactions [START_REF] Steinbrecher | Design options for privacy-respecting reputation systems within centralised internet communities[END_REF][START_REF] Androulaki | Reputation systems for anonymous networks[END_REF]. In order to obtain anonymity of raters, interactions and ratings related to these interactions need to be unlinkable. This can be reached by a reputation provider who only calculates a new user reputation after it collected not only one but several ratings [START_REF] Dellarocas | Designing reputation (feedback) mechanisms[END_REF], or who only publishes an estimation of the actual reputation [START_REF] Dellarocas | Immunizing online reputation reporting systems against unfair ratings and discriminatory behavior[END_REF]. Further, a rater can be anonymous against the reputation provider by using convertible credentials [START_REF] Pingel | Multilateral secure cross-community reputation systems[END_REF] or electronic cash [START_REF] Androulaki | Reputation systems for anonymous networks[END_REF][START_REF] Schiffner | Privacy and liveliness for reputation systems[END_REF] or involve Trusted Third Parties similarly for separating interactions and ratings while preventing attacks [START_REF] Kerschbaum | A verifiable, centralized, coercion-free reputation system[END_REF][START_REF] Schiffner | Privacy, liveliness and fairness for reputation[END_REF].

But to the best of our knowledge there exists no design and implementation of a user reputation system that shows the trade-off between trust and privacy requirements in wikis and allows users to make a decision on which to favor.

User Reputation and the Need for Privacy

In the previous section we pointed out that a user's reputation is an aggregate of her personal expertise, skills and reliability based on previous behavior and thus may be classified as personal data. According to [START_REF] Adams | The implications of users' privacy perception on communication and information privacy policies[END_REF], it is important what is deemed sensitive or personal data in the perception of the individual rather than if it can be evaluated by third parties (e.g., lawyers, computer specialists). Considering that individuals often claim to have a huge need for privacy but behave differently (see also the privacy paradox [START_REF] Pötzsch | Privacy Awareness: A Means to Solve the Privacy Paradox?[END_REF]), we decided to conduct a larger study with experimental part to learn how users actually treat their own reputation value compared to other personal data items. In the following we briefly sketch the design of the study and report key results.

Study Design

The web-based study consisted of an experiment and a standardized questionnaire. Invitations to participate in the study were posted in forums and blogs on the Internet and we also distributed flyers in a university library. All participants who completed the study were offered the chance to win vouchers for an online shop. For the experiment, all participants were asked to rate the same articles from a wiki about books and literature according to three given categories. Before participants actually accessed the wiki articles, they did a short literature quiz. By answering four multiple choice questions about famous writers and books, they received between zero and four points. These points are considered as a participant's reputation. Participants further were asked to indicate name, age and place of residence. When rating the wiki articles subsequently, each participant decides whether her name, age, place of residence, and/or reputation should be published together with her rating of the wiki article.

Half of the participants were randomly assigned to the experimental group. Together with each wiki article, privacy-awareness information were displayed to the experimental group (i.e., information about who can see which data). The other half of the participants belonged to the control group and did not receive privacy-awareness information. After finishing this first part of the study, all participants filled in the questionnaire. In this questionnaire we asked about perceived privacy in the wiki, experience with wikis, ratings systems and the Internet in general. We used questions from the applied privacy concerns and protection scale [START_REF] Taddicken | Measuring Online Privacy Concern and Protection in the (Social) Web: Development of the APCP and APCP-18 Scale[END_REF] to investigate general caution, privacy concerns and applied protection measures. Finally, we asked about demographic data and whether subjects had given their real name, place of residence and age at the beginning.

We calculated the Perceived Privacy Index (PPX) 6 from participants' answers to the questions how public, how private, how anonymous and how identifiable they have felt in the wiki. Each item was measured on a 0 to 100 % slider scale. The higher the PPX value, the more private a participant has felt.

Results

After excluding data sets from few participants who admitted not to have seriously participated in the study, 186 valid responses were further analyzed.

30 % of the participants agreed to publish their real name together with their rating of a wiki article. The disclosure of their real age was okay for 57 %, real place of residence for 55 % and 63 % agreed to have their reputation value published. This means, for each data item there was a considerable share of participants who wished to keep this information private. If participants indicated later in the standardized questionnaire that they did not provide true information in one of the first three categories, we treated this data item as not disclosed. Since the reputation value was calculated from answers in the literature quiz, lying was impossible here.

Further, we used a linear regression model [START_REF] Wirtz | Deskriptive Statistik. vol. 1 of Statistische Methoden für Psychologen[END_REF] to calculate how the disclosure of these four data items and a few other factors influence user's perceived privacy in the wiki. Results are listed in Table 1 and reveal that availability of privacy-awareness information and application-independent measures, like privacy concerns, general caution and protection measures, did not play a significant role for perceived privacy in the wiki. Yet, there are two factors that significantly decrease perceived privacy: the fact that a user has published her name and the fact that a user has published her reputation value. While it is not surprising that a user feels less private after disclosing her real name, we found that also disclosing the own reputation value has a similar effect on perceived privacy. According to the results it is to say that the reputation value is deemed an even more sensitive data than age or place of residence. Further unreported models show that also including combinations of data items, e.g., age published + reputation value published, have no additional effect.

In line with findings from the small survey in [START_REF] Pingel | Multilateral secure cross-community reputation systems[END_REF], the results of our empirical study underline that a user's reputation (even if only a numerical value) needs to be treated as personal data item, i.e., the user should have control over the disclosure of this information. Therefore we will present a privacy-respecting reputation system based on the ideas proposed in [START_REF] Pingel | Multilateral secure cross-community reputation systems[END_REF] but addressing and showing specifically the trade-off between privacy and trust requirements.

Requirements

Functional Requirements

The goal of a wiki is collecting valid and trustworthy information. The first means to reach this is editing/changing articles by other (possibly more knowledgeable) authors. Therefore many articles in Wikipedia have a long changing history. Even information valid at some point in time might change and then the wiki article needs to be changed. But usually many articles will converge to a version containing mostly valid information. Using a content rating system with positive ratings, such acrticles can be marked as such. If the article contains unvalid information the person detecting this can improve or even remove content. Incentives to improve content can be given by an additional user reputation system. The reputation computation algorithm from the user reputation system uses the content ratings from the content rating system as input to calculate the reputation of users who wrote this article. Users might even receive a monetary compensation for a good reputation. As for many other examples in our society where choices are made certificate-based we assume the following requirement to hold:

Positive integers as ratings and reputation: The rating protocol of the content rating system gets only positive integers as inputs and transfers it to positive reputation of content. The reputation computation algorithm of the user reputation system uses the ratings from the articles a user wrote to calculate her reputation.

Advantages and disadvantages of positive reputation systems depending on the user population are discussed in [START_REF] Whitmeyer | Effects of positive reputation systems[END_REF]. The main impact is that it encourages a user population of the wiki that creates valid content of high quality. In the long run all active wiki users would have a maximum reputation value. Low reputation corresponds to not contributing (in a positive way) to the quality of the wiki.

To help newcomers [START_REF] Friedman | The social cost of cheap pseudonyms[END_REF] to start they can bring in certificates from outside the wiki that are transferred to reputation, e.g., a master in medicine might result in some initial reputation for a medical wiki.

Possibility of non-zero initial reputation:

The reputation computation algorithm should be able to transfer a certificate a user got outside the wiki to an initial reputation inside the reputation system

As users have different areas of expertise we assume that wiki, user reputation system and content rating system agree on areas of expertise all articles, ratings, and reputations are linked with:

Area-specific reputation: The reputation system allows to set up different areas of expertise and users can have different reputations in these areas.

We abstract from a concrete classification of areas but refer to [START_REF] Jensen | Classifying areas of expertise in the wikipedia recommender system[END_REF] for a comparison of several approaches. We only assume an agreement on metadata (tags) for areas of expertise defined for all system components. These areas of expertise should have a tree structure with 'general' as root and certain specific expertise as children. E.g. 'medicine' inherits from 'general' and might have 'gynecology' and 'surgery' as children, which again may have specialized children. All articles in the wiki are tagged with these areas (resp. paths in the tree of areas) as well as user reputation always will be linked to such an area. E.g. an article about breast cancer will be tagged with the expertise path 'general → medicine → gynecology'. Wikipedia already realises this with its Categorys8 , but they are organised as general graph. For reasons of simplicity we assume a tree, but it can easily be extended to a general graph.

The reputation computation algorithm of a user reputation system needs to be accurate and self-correcting. This means that it should consider all ratings given in an appropriate way by considering at the same time various attacks [START_REF]ENISA: Position Paper. Reputation-based Systems: a security analysis[END_REF]. There exist numerous proposals for such algorithms [START_REF] Jøsang | A survey of trust and reputation systems for online service provision[END_REF] with respective advantages and disadvantages. For our scenario we assume a rating algorithm of the content rating system and a reputation computation algorithm of the user reputation system with the following features:

Influence of rater on user reputation: The higher the reputation of a rater is the more influence it will usually have on the perceived trustworthiness of the rating for others. For this reason the respecting rater's reputation should be used when calculating a user's reputation. Influence of time on user reputation: To encourage users to contribute to the wiki continuously their reputation should be aged. Availability of user reputation with content: As users want to estimate directly the quality of content the reputation of users who edited or rated this article should be stored with the content.

Beneath the functional requirements the scenario has privacy and security requirements that are partly contradicting and need to be balanced according to the principles of multilateral security [START_REF] Rannenberg | IT security and multilateral security[END_REF]. We list the most important ones in the following. But due to the contradiction our system can only fulfill them partly.

Security Requirements

The following security requirements most important for our scenario of a user reputation system in a wiki are derived from [START_REF] Schiffner | Privacy and liveliness for reputation systems[END_REF][START_REF]ENISA: Position Paper. Reputation-based Systems: a security analysis[END_REF]. They need to be met by the protocols for providing ratings to the content rating system and obtaining user reputation from the user reputation system:

Integrity of content and ratings: Users want content and ratings given to it to be preserved from manipulations. Accountability of raters: Raters should be accountable for their ratings. No self-rating: It should be impossible that users rate themselves [START_REF] Friedman | The social cost of cheap pseudonyms[END_REF].

Privacy Requirements

As we could see from the study in Section 3 both users' real names and reputation should be protected by technical means. For the real name the corresponding requirements are similar to [START_REF] Schiffner | Privacy and liveliness for reputation systems[END_REF][START_REF]ENISA: Position Paper. Reputation-based Systems: a security analysis[END_REF]:

Anonymity/pseudonymity of raters and authors: Users want to rate and provide content anonymously or under a pseudonym to not necessarily allow others to link this rating to their real name. Anonymity of readers: Users want to read content and evaluate corresponding user reputation anonymously.

Privacy of reputation can mean keeping the reputation confidential what would contradict the availability of reputation and therefore is no option. The better alternative is to relax the sensitivity of reputation as identifying or linkable attribute of users. This can be described by the following requirements:

Anonymity/pseudonymity of users for showing reputation: Users want to show reputation only pseudonymously or even anonymously. Unlinkability of users for rating and writing content: Users want to be unlinkable when rating and writing content, also for showing reputation.

It needs to be communicated to users whether a user reputation system has these privacy options to relax their privacy awareness about reputation (cp. Section 3).

Infrastructure and Design

Our scenario needs three major system components to be in place: The first component is the wiki itself where we decided to use MediaWiki. Second, for the content rating system, there are already some extensions to MediaWiki available where we chose the ReaderFeedback9 extension. As third component for the privacy and security requirements we use the privacy-enhancing identity management system PRIME [START_REF] Casassa-Mont | Architecture v2[END_REF] as it was used in [START_REF] Pingel | Multilateral secure cross-community reputation systems[END_REF] to assist users in controlling their personal data. This data can be certified by third parties in the form of credentials. Credentials can be convertible [START_REF] Chaum | Showing credentials without identification. Signatures transferred between unconditionally unlinkable pseudonyms[END_REF] and might be used with various unlinkable pseudonyms. The implementation used by Fig. 1: Registration process enabling unlinkability of a user and her pseudonyms PRIME for the credential realization is IdentityMixer10 . This allows for balancing privacy requirements with accountability of users as discussed in [START_REF] Pingel | Multilateral secure cross-community reputation systems[END_REF].

To reach (pseudonymous) accountability of all data and credentials a publickey-infrastructure is needed. For our scenario we assume all actions and ratings to be secured by (pseudonymous) digital signatures. Additionally we assume all communication to be secured by encryption and anonymised by using an anonymity service to reach confidentiality and anonymity of all ratings and actions performed against outsiders.

The user reputation system needs to be integrated in all three system components as we will describe in the following for all actions users can perform. An illustration, how the communication flow of the components is done is shown for the example of editing a wiki article in Fig. 3.

Registration

A user registers a basic pseudonym with an identity provider by declaration of some identity data (step 1 in Fig. 1). After verifying the data the identity provider issues a basic credential to her (step 2 in Fig. 1). This credential has the meaning, that the identity provider checked the identity data, is willing to disclose it in the case of the user's misbehavior, and that the credential is issued per user only once in her life.

When the user gains some expertise in an area that can be certified by an independent certifier (e.g., a university) she may ask the certifier (step 3 in Fig. 1) under her expertise pseudonym for a respective expertise credential (step 4).

When the user wants to register in a wiki under a wiki pseudonym she sends the wiki her basic credential (and possibly her expertise credential(s) (step 5 in Fig. 1). The wiki provider creates a list of wiki credentials and sends it back to the user (step 6). A wiki credential contains an attribute-triple, where the first element is a string for the area of expertise, the second is a time stamp, and the third is a positive integer for the reputation value derived from the expertise, certified in the expertise credential. There might be a list of these triples even if only showing one expertise credential as a user inherits a reputation for all areas lying in the path from 'general' to her specific area of expertise in the tree structure of metadata for the wiki. How the derivation works can be setup up by the wiki administrator depending on her wishes.

The user can show (parts of) a wiki credential with different pseudonyms within the wiki whenever she wants to reach unlinkability of rating or writing content. For considering the type of a rating or reputation, a page must indicate the areas of expertise relevant for it.

Editing a Wiki-Article

After editing a page (step 1 in Fig. 3), a user is asked which reputation will be shown to others reading the content (step 3). Here it comes clear why we only allow positive ratings because the user would suppress negative one here. There are actually two choices she can make:

First she decides which areas of expertise to choose the reputation from. As the area of the content is fixed, a user may choose the credential, which is specific to the content or an inherited one. A more specific credential will have more impact on the content, a more general one has the benefit of higher anonymity. E.g., if the content is about gynecology, a surgeon might use her credential about medicine or a general knowledge credential.

Second as the reputation is a positive value she can decide on which value smaller or equal to her reputation value in the area she wants to show. For this reason we make use of credentials that allow greater-than-proofs [START_REF] Camenisch | Design and implementation of the idemix anonymous credential system[END_REF]. E.g., when having a reputation value of 63, an author may prove that she has a value greater than 20 or greater than 50 or that she actually has 63. The higher a reputation value is, the more impact it will have on the reputation value of the content but as the number of authors having at least this reputation decreases with increasing reputation value, the anonymity of the author decreases as well.

As every user has to decide on this trade-off on her own, a so called "Send Personal Data Dialog" asks the user for her reputation value and tries to display the trade-off in a graphical way. This dialog is shown in Fig. 2(a). The calculation logics used to show the degree of anonymity is based on the number of credentials with a similar reputation value the wiki server saw recently to calculate the user's anonymity. This is the user's current anonymity set for showing this reputation value. Note that the server does not get the actual reputation value from the user in this dialogue, but only provides the user with the data she got from other users when showing reputation to calculate the user's anonymity. Based on this data the user can calculate her possible anonymity as an estimation and displays it to the user. This problem of only estimating anonymity is inherent existent in privacy-enhanced identity management [START_REF] Clauß | A framework for quantification of linkability within a privacy-enhancing identity management system[END_REF] as there exists no global authority that has all user data and can calculate a user's anonymity exactly. After the user In addition to the choices which areas of expertise and which ratings to show, the user can decide on whether she wants to indicate the wiki pseudonym she registered with the wiki to collect reputation. This gives her the possibility to benefit w.r.t. the increase of her reputation value, whenever other raters give a high rating to the page. However, giving the wiki pseudonym makes her linkable. The decision about sending the wiki pseudonym is done with a checkbox shown in Fig. 2(a) ('Send my identifier') on the bottom. This process is driven by the user's own decision whether she wants to collect these ratings or not, both at the time of editing an article by giving a linkable pseudonym and after the article is rated if she includes this rating in her wiki credential.

Collecting Reputation

If an author provided her identifier, she may collect reputation, given to articles she wrote. She therefore has to show the wiki pseudonym again. The dialog asking for this pseudonym is shown in Fig. 2(b). After showing the old wiki credential, the server issues a new reputation triple. There are a number of possibilities for calculation of reputation [START_REF] Jøsang | A survey of trust and reputation systems for online service provision[END_REF]. Our reputation system is able to handle ones based on positive ratings with the possibility to weight ratings depending on the rater('s) reputation and to decrease reputation depending on its age indicated in the time stamp of a wiki credential. Both aspects can be configured within our implementation by the wiki administrator. MediaWiki's ReaderFeedback extension allows readers to rate a page in four categories (reliability, completeness, neutrality, presentation) with 1-5 stars. A rating form is shown to the user on the bottom of each page. The aggregated reputation displayed is a daily and selected interval average rating. We modified this extension to collect the user's reputation together with the ratings of a page. A dialog similar to the one shown in Fig. 2(a) asking for the reputation to show is displayed when a user wants to submit her rating. As for writing content the user has to make a trade-off between showing expertise or remaining anonymous.

Reading Content in Wiki with User and Content Rating System

Readers have the possibility to view the average rating in the four categories the articles was rated on as in the ReaderFeedback extension. Additionally the detailed list of authors the content had (with their revealed user reputation at this point) and the ratings (with their raters and reputation) can be shown (Fig. 4). The raters' reputation is shown on top of the table below the name or pseudonym of the rater. The different icons represent the reputation type shown (e.g., the syringes represent a certain reputation in medical area). The stars below the raters are the ratings, which were given to a single revision of the page. If an author indicated some reputation together with a page edit, this reputation is shown beneath the authors name or pseudonym.

Evaluation

In the following we analyse to which extent the requirements from Section 4 could be met with the prototype.

Functional Requirements

Positive integers as ratings and reputation: This is given by design of the ReaderFeedback-Extension and our user reputation system based on this.

Security Requirements

Integrity of content and ratings: As all ratings and content are signed integrity is given. Accountability of raters: Accountability with the help of the identity provider is given as well as she can reveal the user's identity in the case of misuse. Within the registration process, the user shows her basic credential. Based on this credential, she gets only one wiki credential, which can be converted once by the user to avoid linkability to this registration. This has the advantage that the wiki server can verify if a revision is already rated by an author and update old ratings if necessary. Also self-ratings are prevented and users can collect their ratings to be included in their reputation. No self-rating: Self-rating is contradicting to the privacy requirements. It therefore is prevented only partially. If users cannot be linked between their areas of expertise, a user can rate her specialized expertise credential with a more general one. However, as the granularity of the ontology has not necessarily to be too fine-grained, a user may not get many ratings (e.g., if the tree from general to specialized is surgery -medicine -general, a user may rate the surgery credential twice) As every user gets only one nonconvertible credential from the identity provider, acting with two different wiki credentials which rate one user is prevented.

Privacy Requirements

Anonymity/pseudonymity of raters and authors: Pseudonymity of users is initially given by the infrastructure combined with the identity management. Anonymity of readers: Anonymity of readers is also assured if reading the wiki is possible without registration. Anonymity/Pseudonymity of users for showing reputation: Users show reputation under a pseudonym if they write under a pseudonym. And they can determine how much of their reputation to show to remain anonymous.

Unlinkability of users for rating and writing content For rating and writing content the users resp. the wiki provider can determine the unlinkability of users depending on the credentials used and on the reputation shown as we will outline in the following.

-Unlinkability for different articles: The wiki provider issues one credential per user and article. The user can convert the credentials once to assure unlinkability. The wiki provider learns from issuing the credentials the pages a user is interested in (except a user fetches credentials for all pages by default or some dummy-credentials in addition to the real ones). Still this has the advantage that the wiki server can verify, if a revision is already rated by an author and update old ratings if necessary. Also self-ratings are prevented and users can collect their ratings to be included in their reputation. Ratings received under different pseudonyms can be aggregated. -Unlinkability for versions of an article: As wiki articles change frequently users might also want to be unlinkable for different versions. To achieve this the wiki provider issues additionally a number of one-show credentials (containing the user's reputation) in a specific time period. With these credentials the user may rate a number revisions of an article in the specific period, proving her reputation anonymously. This makes the user unlinkable but she is not able to collect her ratings afterwards and whatever she does under these one-time pseudonyms does not influence her reputation. -Unlinkability with respect to reputation: Even if users are unlinkable for different (versions of) articles or ratings with respect to showing credentials they still might be linkable by their reputation if always showing the same one or one following deterministic rules. According to [START_REF] Steinbrecher | Design options for privacy-respecting reputation systems within centralised internet communities[END_REF] the set of pseudonyms P at time t in a system is split into several subsets regarding the relation "has the same reputation". The set P t,r = {p t,i |rep(t, p t,i ) = r.} with the pseudonyms having the reputation r ∈ R is the anonymity set a user has for re-using a pseudonym if we assume an attacker who knows the reputation of all users at a time (like the wiki provider does). This anonymity set can be increased in our system if a user shows a smaller than her actual reputation value. Then her anonymity set will be P t,≥r = {p t,i |rep(t, p t,i ) ≥ r.} with |P t,≥r | ≥ |P t,r | as all reputations only increase.

Conclusion and Future Work

In this paper we have investigated the privacy needs of users with respect to their reputation in a wiki in comparison to other personal data. As results of our empirical study shew that users' reputation value should be treated as personal data item we built a framework that allows users to balance their need for privacy and others' wish for trustworthiness of content by the usage of metadata to indicate users' areas of expertise. Still the design of the framework uses the assumption the platform MediaWiki makes for the reputation computation of content. Future studies need to show which set of possible reputation values users like most and how areas of expertise can be related.

Fig. 2 :

 2 Fig. 2: Two dialogs which show, how personal data is sent

Fig. 3 :

 3 Fig. 3: Communication between the components when editing a wiki article

Fig. 4 :

 4 Fig. 4: Example of ratings given to a specific article

Table 1 :

 1 Regression models for perceived privacy index (n=186)

	PPX (dependent var.)	estimate std. error p-value
	Application-specific predictors
	Privacy-awareness inform. available	4.57	12.01 0.704
	Name published	-46.66	14.49 0.002 * *
	Age published	-13.54	16.77 0.420
	Place of residence published	-21.65	16.06 0.179
	Reputation value published	-39.99	14.04 0.005 * *
	Application-independent predictors
	General caution	0.22	1.79 0.902
	Technical protection	-0.47	1.47 0.750
	Privacy concerns	-1.35	1.10 0.223
	Intercept 7	288.93	33.47
	sign. levels:

*** p < 0, 001; ** p < 0, 01; * p < 0, 05

http://en.wikipedia.org/wiki/Wikipedia:About

These extensions are available from http://www.mediawiki.org/wiki/Extension.

http://www.ebay.com

The questionnaire contained the questions: "Please indicate to which extent the following adjectives describe your feelings while using the wiki: 0 % (not at all) -100 % (very much)?" (originally asked in German). The PPX is composed of the adjectives "public" (scale inverted), "private", "anonymous","identifiable" (scale inverted).

Intercept indicates the basic value of PPX when all predictors are equal to zero.

http://en.wikipedia.org/wiki/Special:Categories

http://www.mediawiki.org/wiki/Extension:ReaderFeedback

http://prime.inf.tu-dresden.de/idemix/


Audun Jøsang
email: josang@matnat.uio.no

Walter Quattrociocchi
email: walter.quattrociocchi@istc.cnr.it

Dino Karabeg
email: dino.karabeg@ifi.uio.no

Taste and Trust

Keywords: Trust, Reputation, Taste, Recommender, Semantic, Opinion, Knowledge, Agents

Introduction

Understanding the dynamics between social artifacts such as reputation and trust and their effects on both opinions formation, revision and decision making is an important challenge. Several studies have focused on modeling their interdependencies and on predicting their evolutions [START_REF] Deighton | Marketing and seduction: Building exchange relationships by managing social consensus[END_REF][START_REF] Mccombs | Setting the agenda: the mass media and public opinion[END_REF][START_REF] Quattrociocchi | Reputation and uncertainty. a fairly optimistic society when cheating is total[END_REF][START_REF] Quattrociocchi | Simulating opinion dynamics in heterogeneous communication systems[END_REF], e.g. focusing on how the dynamics of decisions are affected by the society in which the individual is immersed. In fact, the dynamic nature of social interactions is considered to play a fundamental role [START_REF] Lorenz | Continuous opinion dynamics under bounded confidence: A survey[END_REF] in the formation of taste and trust. Taste as an aesthetic, sociological, economic and anthropological concept refers to a cultural patterns of choice and preference. The term "taste" is also commonly interpreted as the bio-chemical assessment of food. In this study we primarily consider the sociological interpretation of taste, i.e. where it reflects the subjective judgment of things such as styles, manners, consumer goods and works of art. Social inquiry of taste is about the human ability to judge what is beautiful, good and proper.

The social artifacts such as reputation and trust are built upon the acceptance (or refusal) of a social standard or norm. Dealing with decision making, either reputation or trust act as selection criteria in the mind of the individuals and, in turn, are based upon cognitive attitudes.

Social psychology offers an extensive literature on attitude change models, as reviewed by [START_REF] Mason | Situating social influence processes: Dynamic, multidirectional flows of influence within social networks[END_REF]. Most influential in social psychology is the "The Social Impact Theory" [START_REF] Nowak | From private attitude to public opinion: A dynamic theory of social impact[END_REF], according to which the amount of influence depends on the distance, number, and strength (i.e., persuasiveness) of influence sources. As stated in ( [START_REF] Castellano | Statistical physics of social dynamics[END_REF]), an important variable, poorly controlled in current studies, is structure topology. Interactions are invariably assumed as either all-to-all or based on a spatial regular location (lattice), while more realistic scenarios are ignored.

Within this universe, in this paper we outline the role of taste relative to trust and reputation. We will start by describing two simple examples to illustrate the effect of taste in trust situations. For example, assume that a trusted (without being more specific) friend recommends watching a movie, but you find the movie so unpleasant to watch that you leave before the end. As a result your trust in your friend's movie recommendations will drop, but interestingly your friend might still insist that it was a good movie. It is perfectly plausible that your friend genuinely likes movies that you dislike, which is unproblematic, so your friendship is not challenged. Assume now a different situation where a trusted friend recommends a car mechanic for servicing your car, but you end up very disappointed because the mechanic left oil marks everywhere and charged an unreasonably high amount for a relatively simple job. In this situation it is not plausible that your friend claims that the mechanic did a good job, because oil marks and unreasonable prices are undisputedly negative, i.e. they are taste independent aspects. You would therefore not find it credible if your friend genuinely thinks that the mechanic did a great job, and if he did you might suspect that there are other motives behind. Not only would your trust in your friends ability to recommend car mechanics drop, you would also find your friend irrational which could cause you to distrust him in general and even damage your friendship. The only rational response from your friend would be to agree that the mechanic did a horrible job, and to apologize for having recommended such a bad mechanic, in which case you mutual trust and friendship would survive. These two examples show that people can very well agree to disagree on taste dependent aspects, but can not agree to disagree on taste independent aspects. Determining what is taste dependent or independent thus has implications for analysing trust networks.

The concept of trust is relatively well studied in the trust management literature, where authors mostly agree that it is a rather overloaded concept with many different meanings. In order to foster a meaningful discussion it is therefore useful to define the exact type of trust that is intended when the term is used. In this paper we will distinguish between so-called evaluation trust and decision trust that can be defined as follows [START_REF] Jøsang | A Survey of Trust and Reputation Systems for Online Service Provision[END_REF].

-Evaluation Trust

Evaluation trust is the subjective probability by which an entity, A, expects that another entity, B, fulfills a function on which A's welfare depends.

-Decision Trust

Decision trust is the extent to which one party is willing to depend on something or somebody in a given situation with a feeling of relative security, even though negative consequences are possible.

Evaluation trust is conceptually much simpler than decision trust because evaluation trust only depends on assumed qualities of the trusted entity itself, whereas decision trust depends on additional parameters, such as utility and risk attitude of the trusting party, that in fact are external to the trusted entity.

Since taste and trust are both subjective, and they both express an entity's opinion about some concrete or abstract object there seems to be a close correspondence between the two concepts. A noteworthy aspect of trust is that it is typically assumed that relying party faces a (potential) risk exposure because of some value at stake with potential loss, and secondly that there is some uncertainty about whether the trusted object will fulfill its expected function. In case of taste, i.e. when the relying party likes or dislikes something, risk exposure or uncertainty are not normally assumed as important cognitive elements.

The term "trust" is both a verb and a noun, such as in "Bob trusts the car mechanic" and "Bob has full trust in the car mechanic", which both have the same semantical basis in the expectation of quality service. The term "taste" is also both a verb and a noun, such as in "Bob tastes the food" and "Bob has a taste for food", but which interestingly do not share the same semantic basis. To "taste the food" is the bio-chemical assessment of a particular food sample, whereas "taste for food" is the sociological ability to judge the quality of food in general. The verbs "to like" and "to dislike" correspond better to the sociological interpretation of taste as a noun, meaning that Bob's taste for food corresponds to which food he likes or dislikes. To say "Bob likes the food" would then express that the food has good quality according to Bob's sociological taste for food.

The concept "opinion" or more specifically the verb-like expression "to have an opinion about" is in many ways a generalisation of the verbs "to trust/distrust" and "to like/dislike". In that sense, the nouns "trust" and "taste" should be considered as subcategories of the more general noun "opinion". In this background we will consider "trust" and "taste" to be two variants of a more general concept which could be called "belief" or "opinion".

A scope 4 expresses what the opinion is about, e.g. the specific type(s) of trust or taste assumed in a given situation. In other words, the object is assumed to fulfill certain quality functions such as being reliable/unreliable or good/bad, and the scope is what the subject assumes those functions to be.

A scope can be narrow or broad. For example, a relatively broad trust scope could be "to be competent in car mechanics", whereas a relatively narrow trust scope could be "to know how to change wheels".

Trust transitivity means, for example, that if Alice trusts Bob who has a specific opinion about something, then Alice will tend to adopt the same opinion. This assumes that Alice is actually aware of Bob's opinion. This could e.g. be achieved through a referral or recommendation from Bob to Alice.

Let us assume two separate scenarios. In scenario 1) Alice needs to get her car serviced, so she asks Bob to recommend a good car mechanic. In scenario 2) Alice considers going to a rock concert, but she does not know the band, so she asks Bob about his opinion. This situation is illustrated in Fig. 1. In TNA-SL (Trust Network Analysis with Subjective Logic), there is a separation between functional and referral trust [START_REF] Jøsang | Trust Network Analysis with Subjective Logic[END_REF]. Alice's trust in Bob is considered to be referral, because Bob will not service the car or play the music, Bob will just refer to something else. In contrast, Bob's trust in the mechanic and Bob's taste for the band is functional, because they will service the car and play the music respectively.

A recommendation is equivalent to a referral, and is precisely what allows trust to become transitive. At the same time, a referral always assumes the existence of a functional scope at the end of the transitive path, which in this example is about being a good car mechanic, or a good rock band.

A transitive trust path stops with the first functional taste/trust edge encountered when there are no remaining outgoing referral edges. It is, of course, possible for a principal to have both functional and referral trust in another principal, but that should be expressed as two separate trust edges.

In practice the last functional edge in a trust chain can very well be either described as "likes/dislikes" or as "trusts/distrusts", or in more general terms as "has opinion about object Y ." The referral edges are clearly meaningful when interpreted as "trusts/distrusts", but their interpretation can also be generalised as "has opinion about advice from entity X." This seems reasonable because the main quality of a referral is to correctly recommend somebody's opinion, be it trust or taste. There is thus little room for taste dependence in the recommendations. However, the referral trust edge assumes that the relying party shares the same taste dependent scope as the functional edge.

The "referral" variant of a scope can be considered to be recursive, so that any transitive opinion chain, with arbitrary length, can be expressed using only one scope with two variants. This principle is captured by the following criterion.

Definition 1 (Functional opinion derivation). Derivation of functional opinion (e.g. taste or trust) through transitive referrals requires that the last edge represents a functional opinion (e.g. about taste or trust), and that all previous edges represent referral opinions.

When generalising "taste" and "trust" as two specific types of a subject entity's opinion about the quality of an object, it is possible to let any semantic opinion scope be part of a transitive trust path. This opinion scope can express trust, taste or other beliefs. Let the relying party be denoted by A, let the intermediate recommender agents be denoted by X i and the target object by Y . Then a transitive semantic path can be expressed as:

A referral opinion -→ X 1 referral opinion -→ • • • referral opinion -→ X n functional opinion -→ Y (1)
In practical situations, a scope can be characterised by being general or specific. For example, knowing how to change wheels on a car is more specific than to be a good car mechanic, where the former scope is a subset of the latter. Whenever a given scope is part of all the referral and functional scopes in a path, a transitive path can be formed based on that scope. This can be expressed with the following consistency criterion.

Definition 2 (Opinion scope consistency). A valid transitive opinion path requires that there exists a scope which is a common subset of all opinion scopes in the path. The scope of the derived opinion is then the largest common subset of all scopes along the path.

Trivially, every edge in a path can carry the same scope. Transitive opinion propagation is thus possible with two variants (i.e. functional and referral) of the same opinion scope.

The examples above assume binary beliefs about the recommending agents along the transitive path, and about the target object. In reality an opinion is never absolute, and researchers have proposed to express trust as discrete verbal statements, as probabilities or other continuous measures. For example, in TNA-SL (Trust Network Analysis with Subjective Logic) [START_REF] Jøsang | Trust Network Analysis with Subjective Logic[END_REF] arguments are expressed as subjective opinions which can contain degrees of belief and uncertainty.

Trust and reputation with different preference cliques

It is common that different subjects express different scores and/or rankings of the same objects as a function of some quality criterion. When two subjects give a different assessment of the same object or observation there can be at least two explanations. One explanation is that they interpreted the observation differently so that the two subjects in fact perceived two different things, e.g. due to different observation conditions or cognitive capabilities. We will exclude this explanation in the analysis below, and assume that the observations are objective. The other explanation is then that the subjects have a different preferences for the same objects, e.g. due to a different internalised value set. The effect of different preferences is extensively used in collaborative filtering and recommender systems, where a group of users who express similar preferences is called a clique or neighbourhood. The existence of preference cliques is important for trust models and for the analysis of semantic trust networks.

The easiest situation to analyse is when all subjects belong to the same clique, i.e. they have the same value set when assessing objects. For example assume that a digital music file is corrupted so that it can not be played on any playback device. All persons would normally assess a corrupted mp3 file to be bad. This situation is illustrated in Fig. 2 where agents A and B belong to the same preference clique.

Fig. 2. Homogeneous preference clique

Reputation systems work best in case of a homogeneous preference clique. When it can be assumed that observations are objective, and that assessments are based on the same value set, then global ranking of the quality of objects is meaningful. Working within a single clique also simplifies the the analysis of trust networks.

Situations of different cliques with different value sets are very common. Assume for example that two subjects A and B assess a piece of classical music and a piece of rock music, where A likes classical music but dislikes rock music, and B likes rock music but dislikes classical music. In this situation, A and B clearly belong to different cliques regarding their taste for music. This is illustrated in Fig. 3.

Fig. 3. Heterogeneous preference cliques with mutual acceptance

In this situation it would not be meaningful to let ratings from A and B be used to rank pieces of classical and rock music together because they have a different value set for judging music. Still, both A and B would normally respect and accept that other people have a different taste, and would therefore not question each other's moral integrity. The meaningful analysis of trust relationships between entities in different preference cliques would require to explicitly capture and express the difference in taste in the evaluation of trust opinions, so that a person would naturally distrust/discount a recommender who belongs to a different preference clique with respect to a specific scope. Several authors have proposed models inspired by this principle, e.g. [START_REF] Bhuiyan | Developing trust networks based on user tagging information for recommendation making[END_REF][START_REF] Golbeck | Generating predictive movie recommendations from trust in social networks[END_REF][START_REF] Hess | Trust-based recommendations for documents[END_REF][START_REF] Massa | Trust-aware recommender systems[END_REF][START_REF] John | Trust in recommender systems[END_REF][START_REF] Victor | Gradual trust and distrust in recommender systems[END_REF].

Another situation is if A has had her car serviced, and the mechanic has left oil marks on the car seats, which A assesses to reflect horrible car service. Let us assume that B assesses oil marks on car seats to reflect great car service. In this situation it is likely that A will think there is something wrong with B's judgment and might question his moral integrity, as illustrated in Fig. 3.

Fig. 4. Heterogeneous preference cliques with non-acceptance

In this situation it is plausible that the irrational assessment by B could make A suspicious about B's moral integrity for other trust scopes in addition to car service, because if B clearly makes an irrational assessment within one scope it is likely that B might also be irrational for other scopes. A simple reputation system applied to this situation where ratings from A and B carries the same weight would not be very meaningful. Additional functionality would be needed to make it more useful, e.g. enabling ratings from B to be excluded or discounted. However, this principle would still not be useful in all situations, because it is a priori not evident whose ratings should be considered as irrational. In the case of election or voting for example, people often belong to different preference categories, but their votes carry the same weight. Voting systems allow people belonging to different preference cliques to cast their vote do decide who will be elected to political seats.

Trust functions can exhibit variability and still be the same type of function. For example, there can be an infinity of different movies that can all be judged as "quality movie". Similarly, there can be an infinity of different music performances that can all be judged as quality performances, some being classical music and some being pop music.

In theory it might be possible refine variable scope functions so that in the end there is no room for variability, in which case it becomes a specific taste-independent scope. However, refining taste dependent scopes so that they become taste independent seems impractical, and nearly impossible in most cases.

Taste dependent scope seems to be manageable in case of trust systems where subjective trust is to be derived. However, for reputation systems, taste dependent scopes would significantly reduce the quality of the derived reputation scores. In case of reputation systems, it seems meaningless to let classical music lowers rate pop music, simply because they will not be able to judge the quality of the music. In that case it would be necessary that the reputation system discounts ratings from classical music lowers about pop music, because their judgment will have a weak basis. This is precisely the principle behind reputation systems that take trust relationships into account, as e.g proposed in [START_REF] Bhuiyan | Developing trust networks based on user tagging information for recommendation making[END_REF][START_REF] Golbeck | Generating predictive movie recommendations from trust in social networks[END_REF][START_REF] Hess | Trust-based recommendations for documents[END_REF][START_REF] Massa | Trust-aware recommender systems[END_REF][START_REF] John | Trust in recommender systems[END_REF][START_REF] Victor | Gradual trust and distrust in recommender systems[END_REF].

Semantic networks

Online social networks are growing fast these days, and it is fascinating to try understand their meaning and implications. All social networks have in common a set of three fundamental building blocks which are entities, pointers, and attributes. These are in essence the same fundamental building blocks required for the Semantic Web and for Semantic Networks which in general can represent relationships between concrete entities or abstract concepts, or both. An entity is something that exists, virtually or physically. It can be a person like you and me, an organisation, a Web site, a document, or a service. An abstract concept can be thought of as an object class, where an entity as an object instance.

An entity's identity serves as the pointer for accessing or navigating to the entity. Entities can point to other entities, and to each other, to form a graph. An entity pointing to another entity represents a directed edge in the graph and implicitly suggests a semantic relationship between the entities. A set of attributes can be used to describe the nature of the relationship, e.g. as "belongs to", "likes" or "trusts". Without attributes it would only be possible to define pure mathematical graphs. Equipped with attributes, the graphs come alive and can represent semantic and social networks as illustrated in the somewhat ego-centric example below.

Fig. 5. Semantic Network

There is of course an infinity of entities and relationships out there, so it is impossible to formally represent them all. In the semantic network illustrated above, only Walter, Audun and Dino are person-entities, and they typically have some semantic relationship to each other. The Walter-Audun-Dino relationships are just a tiny part of the whole semantic network, which shows that semantic networks are much more than just social networks.

The fact that Audun trusts Walter and Dino can be very useful in the sense that it can help Audun to learn something from them. This now becomes a semantic trust graph derived from the underlying semantic network. In fact, the missing -but potential -link between Audun and Mister X's TV station in the diagram, or the missing link between Audun and music Y, can be derived from the existing semantic trust graph.

An example of an implementation of this type of semantic network is the social website Rummble.com that allows people to express their taste for various things, and where they also can express levels of trust in each other. The computational trust engine inside Rummble.com uses Subjective Logic which represents trust by the three parameters Trusted -Distrusted -Don't Know. Some people might find it strange to include "Don't Know", but this is really essential for representing trust. In fact, there is a default "Don't Know" trust relationship between any pair of person-entities which in practice can take the value of the base rate trust between entities in the community. A link gets initialised with base rate trust, and then evolves dynamically with various degrees of trust.

Implications for knowledge management

We have a subjective view of the world philosophically seen. At the same time, we often strive towards a shared view, such as common knowledge. Wikipedia shows how technology may be combined with innovative social organization to establish a common body of knowledge from distributed subjective sources: Instead of only publishing distinct documents about a given subject, Wikipedia allows the global community to create and maintain a single document for each subject. While a single-document solution dramatically reduces effort and aggregates trust, Wikipedia-style unification is feasible only for undisputed facts, although various attempts have been made to add degrees of trust and/or reputation to Wikipedia [START_REF] Jensen | Supporting multi-agent reputation calculation in the wikipedia recommender system[END_REF] to reflect relative quality of contributions. Wikipedia therefore tends to exclude controversial content. Knowledge federation is a collaborative knowledge model aimed at exploiting possibilities between those two extremes. While aiming to identify and highlight that which is relevant and shared as community view, knowledge federation leaves room for dissent and difference of opinions. A federated organization of documents becomes in effect a representation of the collective state of mind, displaying both the points of agreement and the still contending individual positions.

While collaborative document federation à la Wikipedia is a proven way of creating shared documents, a specific value matrix object enables a complementary approach: by crowdsourcing or federating the information needed for corresponding judgment and decisions. A value matrix is an object -attached to a resource throughout its lifetime -that accumulates all data potentially useful for evaluating this resource [START_REF] Karabeg | Knowledge federation as a principle of social organization of knowledge creation and sharing[END_REF]. The columns define the criteria and the rows define available ways of evaluating those criteria. Implemented as an object, the value matrix gathers and stores relevant information, and provides suitable functions for evaluating the resource. By separating data collection from decision making, a value matrix object accumulates every piece of data that may be of value when making a decision, without judgment or bias, and affords free choice of criteria, including the ones reflecting taste and trust. In a socio-technical system where every resource (author, user, document, idea) has an associated value matrix object, creative systemic analysi and derivation of taste and trust become accessible. The development of a suitable theory, technical tools and practices are the subjects for further research.

Conclusion

Trust and taste are closely related, and it is necessary to take differences in taste into account when analysing trust networks. We argue that trust and taste are specific types of the more general concepts of belief or opinion with a given smenatic scope, so that trust networks can be generalised as semantic opinion networks. The analysis of trust networks can therefore be generalised to the analysis of semantic opinion networks. In such networks it is possible, and necessary, to take differences in taste and preferences into account for modelling, analysis and decision making. This has important implicaitons e.g. for the collaborative management of knowledge.

Fig. 1 .

 1 Fig. 1. Scenarios of recommended taste and trust

The terms "trust context"[START_REF] Grandison | A Survey of Trust in Internet Applications[END_REF], "trust purpose"[START_REF] Jøsang | A Survey of Trust and Reputation Systems for Online Service Provision[END_REF] and "subject matter"[START_REF] Mahoney | Generic Reliability Trust Model[END_REF] have been used in the literature with the same meaning.