Our original proposal was trying to convince identity providers to add reputation management as a built-in application within their systems. That was wrong. As Phil Windley said in a recent post

[…] reputation is computed from identity and transactional data.

Your reputation is not embedded in your identity, it’s not owned by you or by your identity provider. It’s computed. See the previous post.

We focused on a special kind of reputation, one built from the whole set of comments you sent to blog authors and their acceptance or rejection. A little portion of “who you are”.

Given that set, everyone could “run” his personal reputation application and compute your reputation as a commenter. Unfortunately this set, your full comment history, is not easily available. Most of the times, a blog author will have to decide to accept or reject your new comment judging solely from the content of that very last submission. This was the problem we were trying to solve.

The revised “workflow” is now as follow.

• Alice is reading Bob’s blog and she wants to send a comment.
• She invokes a bookmarklet to ask her reputation manager for a unique comment token.
• The reputation manger leverages the identity manager infrastructure to authenticate Alice.
• Alice submits the comment along with her comment token.
• Bob’s blog, authorized by the comment token, asks the reputation manager for Alice’ s reputation.
• Bob accepts/rejects the comment and sends the feedback about his decision to the reputation manager.
• The identity provider updates the reputations of Alice and of those blogs that has previously received her comments.

Portability from one reputation manager to another is an important issue. A nice debate arose about this topic few weeks ago, with interesting contributions from Mary Hodder, Rob Hof and Michael Arrington.

It’s now clear that exporting a reputation should mean exporting the whole set of “identity transactional data” and implementing some countermeasures (signatures and encryption) to prevent frauds. Then the receiving reputation manager will apply its own computation and derive the reputation.

More details in the next posts.

UPDATE - I failed to mention that James Kobielus was the first to come up with the idea that “reputation is computed”. See his January 25th blogpost.