[infosechandbook]

Hi, authors here.

We recommended alternatives back in 2019 when we published this article originally. Unfortunately, people then started to discuss why all of these alternatives were much worse according to them, distracting attention away from XMPP's downsides.

[zaik]

Were those arguments valid? If you recommend X instead of Y, it seems reasonable to discuss not only the downsides of Y but also how X is better or worse in comparison to Y.

[infosechandbook]

> If you recommend X instead of Y, it seems reasonable to discuss not only the downsides of Y but also how X is better or worse in comparison to Y.

Indeed. One should mention upsides and downsides of a solution. In our opinion, many "use XMPP" comments only focus on the upsides but rarely mention any downsides. This is the primary reason for our article on some (not all) downsides of XMPP. We focus on easy-to-verify findings. However, we (and others) can't write an exhaustive list of pros and cons of all messengers.

> Were those arguments valid? Most of them drew attention to unrelated features. E.g., "Y requires your phone number; thus, users of Y can easily be tracked"; however, the situation isn't binary, and phone numbers weren't in our article in the first place.

[zaik]

If a service requires my phone number, it is indeed a privacy concern. Phone numbers are strong identifiers; for most people they are tightly coupled to their real world identity. Most XMPP servers do not even require an email address (+ I have the freedom to host my own and still be able to communicate with everyone else using XMPP). Thus I can create a new XMPP account without linking to my real world identity.

[infosechandbook]

Excellent example for what we mean: Our article doesn't discuss anything about "What is needed to register for service X." Discussing this is perfectly valid; however, it isn't about the article.

[zaik]

It is about the article if its conclusion is 'we recommend to use X instead of Y'.