cross-posted from: https://piefed.world/c/ysk/p/1503393/ysk-molly-signal-fork-has-not-been-updated-since-3-months-and-is-vulnerable-to-attacks-f

As of now, Molly lastest release was in 31 July (Version v8.19.2-4).

It contains vulnerabilities that had been simply fixed in mainline Signal.

Take for example the latest exploit disclosed in October, it has been fixed in Signal 8.27. 1. Meanwhile Molly remains vulnerable.

It’s currently recommended to use mainline Signal and delete Molly till they at least return to updating their app adequately, if they ever will.

  • DeeBeeDouble@lemmy.worldEnglish
    101·
    3 days ago

    That and unified push (although I didn’t get that to work yet) are my main selling point, yes. I seriously don’t understand how signal is only on the PlayStore

    • twistypencil@lemmy.worldEnglish
      13·
      3 days ago

      As a Android developer who has an app in the Play store as well as in f-droid, I’ll be the first to say that the f-droid people make it an absolute pain to put things there. I’ve almost stopped pushing there because of how annoying it is. My app went 3 months without being updated there because of how they manage things. They are way way way way. Way too frustrating to deal with.

      So yeah I’m not surprised. A lot of stuff is not there. I support the concept and it was my main goal to put it there, but they have radically changed my opinion about using it and anyone who refuses to use an app because it’s not there. Should try publish in there sometime

        • twistypencil@lemmy.worldEnglish
          1·
          2 days ago

          Sure that is the work around that guardian did for signal. It’s just a passion because everyone needs to add that repo manually. Very free people are going to bother with that additional friction if they even know it’s there

      • DeeBeeDouble@lemmy.worldEnglish
        411·
        3 days ago

        I’m aware of that. But I’m not going to manually download a file every time. And I especially can’t expect that from family members who don’t have the playstore and can’t use a phone very well. A child I manage the phone for does not even have a browser so yeah

        • Consti@lemmy.worldEnglish
          131·
          3 days ago

          So use Obtainium? It’s no worse than f-droid or wherever you get Molly from

          Edit: The page just fetches https://updates.signal.org/android/latest.json, which contains a link to the APK you want to download, so you can feed that to any periodic update service you want

      • DeeBeeDouble@lemmy.worldEnglish
        2·
        3 days ago

        Yeah, that’s what I did for a while until I discovered molly… Its annoying but probably the best option if molly becomes abandoned