cross-posted from: https://piefed.world/c/ysk/p/1503393/ysk-molly-signal-fork-has-not-been-updated-since-3-months-and-is-vulnerable-to-attacks-f

As of now, Molly lastest release was in 31 July (Version v8.19.2-4).

It contains vulnerabilities that had been simply fixed in mainline Signal.

Take for example the latest exploit disclosed in October, it has been fixed in Signal 8.27. 1. Meanwhile Molly remains vulnerable.

It’s currently recommended to use mainline Signal and delete Molly till they at least return to updating their app adequately, if they ever will.

  • doodeux@scribe.disroot.orgEnglish
    9·
    3 days ago

    I’m new to GrapheneOS and running Signal without anything configured with the word Google in it. I am receiving notifications just fine.

    • exdor@programming.devEnglish
      21·
      3 days ago

      That depends on where you got the APK from

      • the playstore apk only supports FCM
      • the standalone, hidden (you only find it via search engines), apk on their website also supports websocket
      • Twinhelix Signal-FOSS only supports websocket
      • molly also supports blobfree FCM and UnifiedPush

      But note that UnifiedPush is not supported by signal, so you need to register a fake device on a server running MollySocket. Which is very much additional attack surface and only worth it if you really rarely use signal