(Point of order; XSF Members have no special standing within the Standards process excepting being able to stand for Council)

 

If your ideas are not simply using XHTML for IM, then you're more than welcome.

If your ideas are using XHTML for "day to day" instant messaging, then *that* is what XEP-0071 defined, and *that* is what was deprecated.

I think the Council decision noted that several other use cases (such as blogging) should not be seen as being affected by this.

 

So this is a really interesting case.

Email handles HTML as an embedded media type, so speaks "native" HTML5 or whatever else is in vogue; this gives it some useful advantages.

It also tends to downgrade either by embedding a fallback or actual alternative within a multipart/alternative; this means an attacker (spammer, etc) can embed a plaintext message which does not match the HTML content semantically. There are many cases of doing this deliberately, in fact, but this was one of my major concerns with any XHTML-IM replacement (which is why neither of the two proposed have this property).

In any case, this was just one of the problems:

* XHTML-IM forces clients to send multiple logical bodies, which an attacker (or simply misuser) can abuse in interesting and annoying ways.

* In some settings, "passing through" XHTML-IM can yield security problems, unless it is sanitized very carefully.

* While there are techniques such as iframes and similar that prevent these (or heavily mitigate) in browser settings, these cause UX irritations such as not being able to "select across" multiple messages.

It's entirely possible that some of these have changed; in particular, it may be that sanitization libraries are now considerably better.

But absent strong evidence, I'd leave XHTML-IM as deprecated.

As noted, but I'll repeat that here, that should not preclude you from using HTML or XHTML in contexts other than Instant Messaging.

Dave.