cross-posted from: https://piefed.world/c/ysk/p/1503393/ysk-molly-signal-fork-has-not-been-updated-since-3-months-and-is-vulnerable-to-attacks-f

As of now, Molly lastest release was in 31 July (Version v8.19.2-4).

It contains vulnerabilities that had been simply fixed in mainline Signal.

Take for example the latest exploit disclosed in October, it has been fixed in Signal 8.27. 1. Meanwhile Molly remains vulnerable.

It's currently recommended to use mainline Signal and delete Molly till they at least return to updating their app adequately, if they ever will.

you are viewing a single comment's thread
view the rest of the comments
[–] 9 points 1 week ago (9 children)

That and unified push (although I didn't get that to work yet) are my main selling point, yes. I seriously don't understand how signal is only on the PlayStore

  • source
  • parent
  • hideshow 9 child comments
  • [–] 14 points 1 week ago (3 children)

    Are you messing with me? It's literally right below: https://signal.org/android/apk/

  • source
  • parent
  • hideshow 3 child comments
  • [+] -7 points 1 week ago (1 child)

    I'm aware of that. But I'm not going to manually download a file every time. And I especially can't expect that from family members who don't have the playstore and can't use a phone very well. A child I manage the phone for does not even have a browser so yeah

  • source
  • parent
  • hideshow 1 child comment
  • [–] 12 points 1 week ago*

    So use Obtainium? It's no worse than f-droid or wherever you get Molly from

    Edit: The page just fetches https://updates.signal.org/android/latest.json, which contains a link to the APK you want to download, so you can feed that to any periodic update service you want

  • source
  • parent
  • [–] 13 points 6 days ago* (2 children)

    As a Android developer who has an app in the Play store as well as in f-droid, I'll be the first to say that the f-droid people make it an absolute pain to put things there. I've almost stopped pushing there because of how annoying it is. My app went 3 months without being updated there because of how they manage things. They are way way way way. Way too frustrating to deal with.

    So yeah I'm not surprised. A lot of stuff is not there. I support the concept and it was my main goal to put it there, but they have radically changed my opinion about using it and anyone who refuses to use an app because it's not there. Should try publish in there sometime

  • source
  • parent
  • hideshow 2 child comments
  • [–] 4 points 6 days ago (1 child)

    What about your own repo then? I would be totally fine with that if signal did that.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 6 days ago

    Sure that is the work around that guardian did for signal. It's just a passion because everyone needs to add that repo manually. Very free people are going to bother with that additional friction if they even know it's there

  • source
  • parent