cross-posted from: https://piefed.world/c/ysk/p/1503393/ysk-molly-signal-fork-has-not-been-updated-since-3-months-and-is-vulnerable-to-attacks-f

As of now, Molly lastest release was in 31 July (Version v8.19.2-4).

It contains vulnerabilities that had been simply fixed in mainline Signal.

Take for example the latest exploit disclosed in October, it has been fixed in Signal 8.27. 1. Meanwhile Molly remains vulnerable.

It’s currently recommended to use mainline Signal and delete Molly till they at least return to updating their app adequately, if they ever will.

  • DeeBeeDouble@lemmy.worldEnglish
    411·
    4 days ago

    I’m aware of that. But I’m not going to manually download a file every time. And I especially can’t expect that from family members who don’t have the playstore and can’t use a phone very well. A child I manage the phone for does not even have a browser so yeah

    • Consti@lemmy.worldEnglish
      131·
      4 days ago

      So use Obtainium? It’s no worse than f-droid or wherever you get Molly from

      Edit: The page just fetches https://updates.signal.org/android/latest.json, which contains a link to the APK you want to download, so you can feed that to any periodic update service you want