I've more than my fill of XMPP experience since it was Jabber. Pretty completely done with it at this point - and my most recent experiences were still not great, and they're within the past couple of years. My standpoint isn't just from a user level, as well. Have run a few XMPP servers over the years.

Element, on the other hand, has really become an excellent client.

Well it just depends on your mental fortitude. Harassers always stop when they don't get a response, because your response is necessary for them to continue. Getting the messages at all can be upsetting, but the power is in your hands to delete them and not let it get to you.

What client were you testing? It's worth a bugreport if the block feature didn't work as expected

It's possible that the implementation leaves something to be desired. Because I have used this feature so little myself, I will have to investigate to see what is truly going on and know how the server handles it vs. how the client handles it. I am currently using Converations on my phone with a Disroot account, and I have someone blocked. When I go into "Account details" I can open "Show block list" in the drop-down menu and they are still there. (As they should be, lol.) I can hold down on it and elect to unblock them. My understanding is that the server keeps this list and doesn't allow messages directly from that JID to even be delivered to my client. I can also imagine some clients not being aware of this at all.

Even though I blocked their JID, it's possible we both can be in the same MUC and I get messages from them through the MUC itself. I'm not sure if it's possible to block that without help from the MUC's admin.

Edit: One caveat here is that if you block individual JID's, someone could create more JID's with which to message you. Some XMPP servers have this behavior whereby they silently delete all incoming messages from people you haven't added to your roster, so this "add-first" policy helps them keep out spam. Ideally you would be able to contact your server admin in cases of abuse if it would become necessary to block problematic servers or warn the admins of said servers of abuse.

XMPP is a simpler system that works on a "need to know" basis, meaning that servers and clients more or less only get the (meta) data that they need to function but not more. A group-chat for example exists only on one server and chat-history is only shared on request and usually is deleted quite quickly (that depends on the server settings though).

Matrix on the other hand works on a "replicate everything" basis (to be more resilient to censorship and other network disruptions). For that it runs a highly complicated distributed database where all (meta) data is automatically shared with all participating servers and is stored indefinitely. This has its upsides and downsides, but from a privacy/security perspective this is a strict negative.

I don't think it's better, but it's certainly different. For example, the XMPP ecosystem is mostly not based on web technologies, which makes incentives to build lighter clients: they have less attack surface, and arguably less unexpected fingerprint/leaks than a modern web browser engine.

Still, there's plenty of good and bad aspects with both. I'd say the reference implementation of Matrix (element) is pretty solid security-wise (good crypto, lots of eyes) compared to more amateur-ish XMPP clients, but on the other hand XMPP clients tend to play well with onion routing, while Element as a web client is quasi-unusable in the Tor Browser (lots of UI actions appear to be latency-sensitive) and using another javascript-enabled browser (than the Tor Browser) over tor defeats the whole purpose thanks to WebRTC leaks (and others).

I'd recommend you take a look at this FAQ. If something is not clear or missing, just ping us and we'll add relevant information :)

From the FAQ i linked:

While it is highly unlikely that a government would block the whole XMPP protocol (which is used for many things), it is entirely possible that they block specific servers, or block client connections to foreign servers, as is the case with many services going through China's Great Firewall for instance. (...) In the most extreme cases, it is possible for a network operator (or government order) to block the Jabber/XMPP network entirely. In this case, using censorship-circumvention mechanisms like Tor can help you stay in touch. However, please be aware that circumventing government censorship may be a criminal offense where you reside, and you may end up having trouble with your local authorities if they find out.

Both XMPP and Matrix can be reached via HTTPS so it becomes complicated for complete eradication. If state-level censorship is a concern of yours, Matrix is certainly more suited as a protocol as it has complex algorithms to resolve global state (consensus) in case some servers can't talk to one another.

Some other technologies like Briar are even more suited for this threat model, as it assumes all networks are compromised and/or unreachable. That is, it relies on gossip over lan-friendly medium (local wifi, USB keys..) with optional use of Tor onion services for reaching through the Internet without exposing so much metadata (beyond the fact you're using tor).

In Matrix client to server connections are just normal web-traffic, so that would require some deep packet inspection to block (pretty difficult but not impossible), however server federation uses a custom port and could probably blocked more easily.

XMPP by default uses custom ports and is quite easy to block by firewalls / routers, however it is possible to also use it via a normal web connection to circumvent that. That said, a lot of professional services use XMPP internally (emergency communication services, smart-meters etc.) and thus wide-spread blocking would be pretty disruptive for a lot of things. It is also possible to connect to and run a XMPP server entirely through TOR, which is pretty hard to block.

Neither is really great in that regard, but they are still harder to block then centralized commercial services (although Telegram tries to be "smart" by hosting their stuff on AWS etc, which also makes it hard to block as other stuff would be effected). Using XMPP through TOR should be relatively resilient though, but note that in some countries using TOR and other such services is illegal by itself AFAIK.