Signal fork Molly goes unpatched three months after an exploit fix in Signal 8.27
A Hacker News/Lemmy post warns that the privacy-hardened Signal fork Molly remains vulnerable to an October exploit that mainline Signal already patched.
What to know
- Molly, a hardened Signal fork popular on de-Googled Android phones, has gone three months without an update and lacks the fix for an October exploit that Signal itself patched in version 8.27.
- The original post urges users to uninstall Molly and switch to mainline Signal until it resumes updates.
- Commenters explain they stick with Molly for features missing from mainline Signal, such as UnifiedPush notifications on phones without Google Play Services.
- The thread broadens into criticism of both F-Droid's slow publishing process and Signal's own Play Store-centric distribution, including its self-updating APK and lack of reproducible builds.
The dispute Whether the fault for stale, vulnerable forks lies with the fork maintainers themselves, with F-Droid's slow review process, or with Signal's restrictive official distribution. · positions read across 29 posts and comments
People keep running Molly despite the risk because it offers features mainline Signal lacks, like UnifiedPush and de-Googled compatibility.
-
“I’m running it specifically for the UnifiedPush support which gives me push notifications without Google Play Services.”
HN commenter · Hacker News ↗
Signal itself is to blame for pushing users toward forks by relying on Play Store distribution and a cursed self-updating APK instead of proper reproducible builds.
-
“I seriously don’t understand how signal is only on the PlayStore”
HN commenter · Hacker News ↗
F-Droid's own publishing process is slow and frustrating, which likely explains delays like Molly's.
-
“My app went 3 months without being updated there because of how they manage things. They are way way way way. Way too frustrating to deal with.”
HN commenter · Hacker News ↗
Molly developers Maintainers of the Molly Signal forkSignal Upstream secure messaging app makerF-Droid Open-source Android app repositoryDeepLogin Poster who raised the alarm
How it unfolded 1 development · click the chart to see its coverage articlesposts
-
1
Commenters criticize Signal's Play Store-centric distribution
Other commenters turn the criticism back on Signal itself, faulting it for lacking a reproducible, blob-free build on F-Droid or Flathub and instead relying on a self-updating APK and an AppImage on Linux.
“It is really bad of Signal to not have a blobfree reproducible build on F-Droid and Flathub, or even just external repos (for F-Droid and flathub).”
— HN commenter -
The incorporated 501c3 named Signal is, in IT terms, a vendor. Is it not?The Signal client software is open source and some of the clients have reproducible builds. The Signal server software is open source, though has a history of being over a year out of date at some points. Other deployments of this server software for production use are…
2 more of the top 3 · 29 posts in this stretch
-
T
Uh, perhaps don't use Molly, the Signal fork? https:// piefed.world/c/ysk/p/1503393/y sk-molly-signal-fork-has-not-been-updated-since-3-months-and-is-vulnerable-to-attacks-f
-
It explains perfectly why Signal does not want third-party clients.To the haters: I am not saying that it is perfect, in an ideal world we could have secure third-party clients. I am just saying that it is pragmatic: in our world, we don't.Signal has forever been a pragmatic approach to private messaging, and it succeeded at that: Signal literally…
-
-
background
Developer blames F-Droid's process for update delays — A commenter identifying as an Android developer with an app on both Play Store and F-Droid says F-Droid's publishing process is so slow and frustrating that it has caused months-long update gaps for their own app, suggesting similar friction could explain Molly's lag.
-
background
Users defend Molly for UnifiedPush and de-Googled setups — Commenters explain they keep running Molly specifically for UnifiedPush notifications and compatibility with GrapheneOS phones that lack Google Play Services, despite the security risk.
-
background
Post flags Molly's three-month update gap as a security risk — A cross-post from PieFed's 'ysk' community reaches Hacker News, arguing Molly remains vulnerable and urging users to switch to mainline Signal and delete Molly until it resumes updates. The post reaches 102 points and 61 comments on HN.
-
background
Exploit disclosed and patched in Signal 8.27 — An exploit affecting Signal protocol clients was disclosed in October and fixed by Signal in version 8.27, but the Molly fork did not receive the corresponding fix.
Also covered reported alongside — the timeline has no entry for these yet
-
first by HN Best, 11d ago · also HN Frontpage
What people are saying 21 voices from 1 site · best of 29 · verbatim
- Is Molly actually abandoned, or will it resume updates?
- Why doesn't Signal publish a blob-free reproducible build on F-Droid or Flathub itself?
- Oct 31
-
I worry we are entering a period where it will no longer be safe to use software if it did not get an update after 2026, particularly for older P2P/network-based software and libraries.
-
Signal's rigid anti-fork stance allows it to stay compliant with its 9-figure government contract, which requires it to include a backdoor in final builds that are not reproducible from the official source code.All these poor, starving users who can't have any freedom unless they compile their own builds don't even have proof that Signal _doesn't…
-
Have you managed to transfer from Molly to Signal?Molly backups stopped working (probably due to lack of updates) and I can't seem to transfer between the two apps on the same device.
-
If anyone is interested, I run my own minimalist fork of Molly named Polly.I just released a stopgap with the fixes: - RingRTC 2.73.0-1, which includes the call-teardown fix (the hangup/hot-mic issue) - Signal's blacklist of the eight compromised eMudhra TLS intermediateshttps://github.com/lone-cloud/polly/releases/tag/v8.19.2-6It's still based on…
-
TBH this was my reason not to use Signal at all... same with WhatsApp super annoying linking between mobile and desktop :/Why can't we use XMPP where you can have multiple device and accounts without required mobile phone? Oh I know - because dumb walled gardens and BigTech not liking it... it's a mirracle we got away with e-mail before they came…
-
Signal only has one recent CVE, one which lets an attacker keep an audio or video stream open after you hang up. It doesn't disclose e.g. your chats with other users.
-
Unfortunately linked accounts don't count as primary devices so you will always have to keep the original device active or else they'll eventually delete your account.
-
I have the opposite use case where I need to have two Signal accounts on a single phone. Having Molly alongside the official Signal app was always the solution, but I wish Signal would allow switching between profiles, or Android would allow arbitrary user accounts (I don't really want to add Signal to my work profile).
-
One of the most frustrating decisions from them was to stop allowing signal to be a catch-all messenger for encrypted and non-encrypted messages. I was able to onboard so many people, including very non techy relatives, because switching to a secure app for a small subset of people was never something they really wanted to do.For security and…
-
Signal is not good for normies: compare sending a message with Signal to WhatsApp. Didn’t go through? WhatsApp will try try try to resend. Signal tries far less then shows the dreaded red exclamation point. Not great while travelling or with poor reception.
-
Network-connected application developers have as a community, desensitized me to this. They are the Boy Who Cried Wolf. Continuous mandatory updates in the name of security. Guilting you into thinking each update is critical due to "security".I don't care. It's a hassle, and I don't believe the threats they warn of are something to warrant my…
-
I have been a signal user from very early on, converted most of my family and quite a few friends. I did use Molly to register my second phone (just found I can do that with signal now, so uninstalled Molly and installed signal).I have the impression that the calling experience significantly degraded over the last year, i.e. calls just not ringing…
-
Yeah, the hostility toward F-Droid and wanting to run their app on LineageOS without gapps made me ditch Signal years ago. It seemed like the main gimmick back then was that it was also your SMS app, which IIRC isn't a choice anymore. So what's the draw now? Why would you not use XMPP+OMEMO or Matrix which work everywhere, don't need a phone…
-
Don't Stand Out.When you say "Each user can choose a different notification service" you aren't enhancing privacy you are standing out.When you say "Each group of users can have their own servers" you aren't enhancing privacy you are standing out.So yeah, it's only for "total normies" in the sense that if you insist on standing out from those…
-
>Signal hates users who aren't total normies.No it's the other way around. Signal is explicitly designed for normies, which is why so many people use it. I doubt they sat around and thought of ways to screw certain users.>Just as they could easily offer a Google free versionEasily? There's no easy in maintaining and releasing two different…
-
I want to express a very different perspective here as a counterpoint: I'm really grateful for the Signal team's work.Today, I discussed my father's health condition with my family. Signal worked smoothly (even for my aging mother!), and it's free and secure.Over the past five years, I have donated $500 to the foundation in total. I hope they…
-
That article only mentions iPhones, for which Molly was never an option anyway.But, apparently Android is also supported: https://aboutsignal.com/news/signal-allows-android-phones-to...So glad they finally added this!
-
Sometimes I get the feeling that Signal hates users who aren't total normies. Unified Push, which works flawlessly on Molly, could easily be implemented in the regular client. Just as they could easily offer a Google free version for F-Droid or simply for people who want nothing to do with Google. But they just refuse. Just like it took years for…
-
TIL: The official Signal app can now use one account, shard over two devices.This was my main reason to use Molly over Signal.
-
Well that's timely, and a bummer. I was just wondering about this yesterday, I use signal on my primary phone and Molly on a secondary phone.Signal got an update yesterday and when I saw the notification I couldn't remember the last time Molly was updated...
-
Someone in that thread notes that when you install the Signal APK from here [1] it "doesn’t get updates tho", but this isn't the case. Signal will update itself; you get a notification to update. Often earlier than the Play Store, probably due to its reputation to randomly delay updates.[1]