cross-posted from: https://piefed.world/c/ysk/p/1503393/ysk-molly-signal-fork-has-not-been-updated-since-3-months-and-is-vulnerable-to-attacks-f

As of now, Molly lastest release was in 31 July (Version v8.19.2-4).

It contains vulnerabilities that had been simply fixed in mainline Signal.

Take for example the latest exploit disclosed in October, it has been fixed in Signal 8.27. 1. Meanwhile Molly remains vulnerable.

It’s currently recommended to use mainline Signal and delete Molly till they at least return to updating their app adequately, if they ever will.

  • Alex@lemmy.mlEnglish
    191·
    3 days ago

    Why run Molly when Signal is right there? Is this about getting it via places other than the Play store?

    • dracs@programming.devEnglish
      9·
      3 days ago

      I’m running it specifically for the UnifiedPush support which gives me push notifications without Google Play Services.

      • pulsewidth@lemmy.worldEnglish
        41·
        3 days ago

        Signal works perfectly with MicroG for reference.

        I have no Google Play Services on my GrapheneOS phone, or any Google account. Signal with MicroG works fast and accurate for all notifications.

    • Philip@social.sdfeu.org
      61·
      3 days ago

      @stsquad @beep The main reason for me is that I could install and update the app using F-Droid and not have to do so manually or with yet-another package manager. Having push notifications working on a degoogled phone without draining my battery is a close second.

    • DeeBeeDouble@lemmy.worldEnglish
      101·
      3 days ago

      That and unified push (although I didn’t get that to work yet) are my main selling point, yes. I seriously don’t understand how signal is only on the PlayStore

      • twistypencil@lemmy.worldEnglish
        13·
        3 days ago

        As a Android developer who has an app in the Play store as well as in f-droid, I’ll be the first to say that the f-droid people make it an absolute pain to put things there. I’ve almost stopped pushing there because of how annoying it is. My app went 3 months without being updated there because of how they manage things. They are way way way way. Way too frustrating to deal with.

        So yeah I’m not surprised. A lot of stuff is not there. I support the concept and it was my main goal to put it there, but they have radically changed my opinion about using it and anyone who refuses to use an app because it’s not there. Should try publish in there sometime

          • twistypencil@lemmy.worldEnglish
            1·
            3 days ago

            Sure that is the work around that guardian did for signal. It’s just a passion because everyone needs to add that repo manually. Very free people are going to bother with that additional friction if they even know it’s there

        • DeeBeeDouble@lemmy.worldEnglish
          411·
          3 days ago

          I’m aware of that. But I’m not going to manually download a file every time. And I especially can’t expect that from family members who don’t have the playstore and can’t use a phone very well. A child I manage the phone for does not even have a browser so yeah

          • Consti@lemmy.worldEnglish
            131·
            3 days ago

            So use Obtainium? It’s no worse than f-droid or wherever you get Molly from

            Edit: The page just fetches https://updates.signal.org/android/latest.json, which contains a link to the APK you want to download, so you can feed that to any periodic update service you want

        • DeeBeeDouble@lemmy.worldEnglish
          2·
          3 days ago

          Yeah, that’s what I did for a while until I discovered molly… Its annoying but probably the best option if molly becomes abandoned

    • nelson@lemmy.worldEnglish
      3·
      3 days ago

      It does some extra stuff signal doesn’t ( apparently). Though there’s always a risk using a 3rd party client. And I guess it might be against the TOS of signal?

      • encrypt the database with a password
      • not using google for notifications
      • ram shedding And some others…

      https://molly.im/

      • exdor@programming.devEnglish
        6·
        3 days ago

        Yeah unofficially… that is very much a bandaid. It is really bad of Signal to not have a blobfree reproducible build on F-Droid and Flathub, or even just external repos (for F-Droid and flathub).

        Instead they have a hidden self-updating APK (which is a very cursed concept) with blobs, and a damn Appimage on Linux.

          • exdor@programming.devEnglish
            2·
            2 days ago

            They dont want to give control to platforms and their policies or update frequencies or some nonsense. Meanwhile they love Google

    • AlmightyDoorman@kbin.earth
      3·
      3 days ago

      I use molly because i have an android smartphone and tablet and running both with signal is not possible with signal. (Maybe the changed it? I have to check it)

      • exdor@programming.devEnglish
        71·
        2 days ago

        Session has removed forward secrecy. I dont know if they still have broken autodeletion and still store all messages in a blockchain (delaying actual deletion). Overall though, I would stay away from it.

        • BillionaireStew@lemmy.worldEnglish
          1·
          2 days ago

          It’s just forward secrecy, not “perfect forward secrecy”, unless you are writing Signal press material. (Edit: Parent comment was edited to use the correct term.)

          https://en.wikipedia.org/wiki/Forward_secrecy

          I feel that such marketing can impart a false sense of security that has bitten Session users many a time. Ask Pete Hegseth, as much as I like to see him faceplant.

          Not relying on the central server largely removes the need for forward security, since you can get a similar result by creating a new account (with a new private key) on your device as often as you like. It is Signal’s reliance on a fixed identity that complicates the matter of rotating keys.

          In other words, Signal is not better because it has “perfect forward secrecy”. It is worse because it needs it.

          Even so, it is such a talking point that Session does intend to implement “perfect forward secrecy”.

          https://getsession.org/blog/session-protocol-v2

          As for “store all messages in a blockchain”, I believe that is the alternative to storing them on a central server, as Signal does. They have to be stored somewhere until you are online to receive them. If they weren’t, someone would be replying in your stead and complaining that Session does not allow users to receive messages sent while they were offline. Of course the messages are stored encrypted in both cases but only Signal associates them with your metadata.

          I find it strange that you condemn Session’s use of a blockchain but are apparently unconcerned by Signal’s bundling a cryptocurrency wallet and linking it to users’ Signal accounts.

          https://en.wikipedia.org/wiki/MobileCoin#Signal_Integration

          https://support.signal.org/hc/en-us/articles/360057625692-In-app-Payments#payments_requirements_pin