cross-posted from: https://piefed.world/c/ysk/p/1503393/ysk-molly-signal-fork-has-not-been-updated-since-3-months-and-is-vulnerable-to-attacks-f
As of now, Molly lastest release was in 31 July (Version v8.19.2-4).
It contains vulnerabilities that had been simply fixed in mainline Signal.
Take for example the latest exploit disclosed in October, it has been fixed in Signal 8.27. 1. Meanwhile Molly remains vulnerable.
It’s currently recommended to use mainline Signal and delete Molly till they at least return to updating their app adequately, if they ever will.
That sucks. Does the original Signal app deliver notifications properly without Play Services?
I’m new to GrapheneOS and running Signal without anything configured with the word Google in it. I am receiving notifications just fine.
That depends on where you got the APK from
But note that UnifiedPush is not supported by signal, so you need to register a fake device on a server running MollySocket. Which is very much additional attack surface and only worth it if you really rarely use signal
The APK from Signal’s website doesn’t require Play services, just don’t install Signal via Play Store. DaNgEr ZoNE eye rolls aside:
https://signal.org/android/apk
Annoying, I rather liked Molly.
Use Verified-Apps from PrivacyGuides to verify the signature of the APK before installing.
Before Appverifier was a thing, it was very obscure how to even check that signature.
I’m going go try Signal-FOSS instead that you mentioned earlier.
i have no problems with notifications on crdroid (lineageOS fork) and microG
Iirc, the push notifications are flowing through Google firebase, which is why you still get them.