TechnologySaturday, October 31, 20261 min read

Molly(Signal fork) has not been updated since 3 months and is vulnerable

By Hacker News · Published by Everything Blog

In short

The Molly messaging fork has not received an update in three months, leaving it vulnerable to security issues that have already been resolved in mainline Signal. Development stalled following the release of version v8.19.2-4 on July 31, leaving the app open to flaws such as an exploit patched by Signal in version 8.27.1. Users are currently advised to delete Molly and switch to the official Signal app until updates resume.

Key points

Users are advised to delete Molly and migrate to the official Signal client until mainten…: Users are advised to delete Molly and migrate to the official Signal client until maintenance resumes.
Mainline Signal now supports linking secondary Android devices, removing a key feature li…: Mainline Signal now supports linking secondary Android devices, removing a key feature limitation that originally drove Molly adoption.
Relying on stalled downstream forks exposes users to known security issues that upstream…: Relying on stalled downstream forks exposes users to known security issues that upstream developers have already resolved.

Sources checked by our analysis pipeline: 1

YSK Molly(Signal fork) has not been updated since 3 months and is vulnerable to attacks fixed in mainline Signal

submitted by

edited

cross-posted from: https://piefed.world/c/ysk/p/1503393/ysk-molly-signal-fork-has-not-been-updated-since-3-months-and-is-vulnerable-to-attacks-f

As of now, Molly lastest release was in 31 July (Version v8.19.2-4).

It contains vulnerabilities that had been simply fixed in mainline Signal.

Take for example the latest exploit disclosed in October, it has been fixed in Signal 8.27. 1. Meanwhile Molly remains vulnerable.

It’s currently recommended to use mainline Signal and delete Molly till they at least return to updating their app adequately, if they ever will.

ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_1FAEFB6177B4672DEE07F9D3AFC62588CCD2631EDCF22E8CCC1FB35B501C9C86

Why run Molly when Signal is right there? Is this about getting it via places other than the Play store?

Signal is distributed by the Guardian Project on Fdroid.

That and unified push (although I didn’t get that to work yet) are my main selling point, yes. I seriously don’t understand how signal is only on the PlayStore

Are you messing with me? It’s literally right below: https://signal.org/android/apk/

doesn’t get updates tho

I’m aware of that. But I’m not going to manually download a file every…

AI Analysis

Tone

Negative

In short

Key Points

Users are advised to delete Molly and migrate to the official Signal client until mainten…: Users are advised to delete Molly and migrate to the official Signal client until maintenance resumes.
Mainline Signal now supports linking secondary Android devices, removing a key feature li…: Mainline Signal now supports linking secondary Android devices, removing a key feature limitation that originally drove Molly adoption.
Relying on stalled downstream forks exposes users to known security issues that upstream…: Relying on stalled downstream forks exposes users to known security issues that upstream developers have already resolved.

Topics

Technology

Was this summary useful?

AI Analysis

Tone

Negative

In short

Key Points

Users are advised to delete Molly and migrate to the official Signal client until mainten…: Users are advised to delete Molly and migrate to the official Signal client until maintenance resumes.
Mainline Signal now supports linking secondary Android devices, removing a key feature li…: Mainline Signal now supports linking secondary Android devices, removing a key feature limitation that originally drove Molly adoption.
Relying on stalled downstream forks exposes users to known security issues that upstream…: Relying on stalled downstream forks exposes users to known security issues that upstream developers have already resolved.

Topics

Technology

Was this summary useful?

I took two iPhones on vacation. The Duo won me over.
Apple’s new $2,000 iPhone Duo proved capable of handling real-world travel demands when paired against the traditional iPhone 17 Pro Max during a five-day vacation test. Despite a squatter form factor and early interface hurdles, the novel hardware demonstrated sufficient durability and utility to become the primary daily device.
12 min read
Kim Jong Un's cyber army: How North Korea's hackers steal billions for regime
State-sponsored operatives are circumventing strict United Nations sanctions by orchestrating sophisticated digital heists against global cryptocurrency platforms. These illicit revenues are funneled directly into financing Pyongyang's ballistic missile and weapons of mass destruction programs. The operations rely on deceiving industry employees through social engineering to bypass standard cybersecurity defenses.
3 min read
Google taught the world how to search. Now it faces a revolution it can’t afford to lose.
Major shifts in the industry are forcing leaders to balance product preservation against commercial viability. Navigating this dilemma requires protecting foundational search utilities while mitigating disruptions to existing corporate revenue streams. How the organization handles this fundamental tension will directly shape its financial stability and market standing.
1 min read

Molly(Signal fork) has not been updated since 3 months and is vulnerable

In short

Key points

More in Technology