Molly (Signal fork) has not been updated since 3 months and is vulnerable

Original Article ↗ Hacker News Discussion ↗

Concerns are mounting that Molly, a popular privacy-focused fork of the Signal messenger, has gone unmaintained for months and now misses critical security fixes, including a recent call-related vulnerability. Commenters weigh the risks of relying on outdated third-party clients against using the official Signal app, which has added long‑requested features like multi‑device support but is criticized for centralization, mandatory phone-number registration paths, and dependence on Google services for efficient push notifications. The exchange broadens into a debate over trade‑offs between strict security pragmatism and user freedom, with some pointing to alternatives like Matrix, XMPP, SimpleX, or custom forks, while others argue Signal’s tightly controlled ecosystem is what makes it practical and safe for non‑technical users.

Signal vs. Molly: Updates and Vulnerabilities

  • Molly (Signal fork) has not tracked upstream for months and is now missing important security fixes (e.g., call teardown / “hot mic” bug, TLS blacklist).
  • Some users are migrating off Molly; one person offers a temporary fork (“Polly”) that cherry-picks key security fixes but is Android 14+/arm64 only.
  • Signal itself has at least one recent CVE (call stream may continue briefly after hangup), viewed as serious but narrower than e.g. chat compromise.

Signal APK, Updates, and Battery Use

  • Installing Signal from its APK site does support updates via in‑app notifications, but not fully automatic for everyone; behavior depends on OS/permissions (e.g., GrapheneOS requires install-permission).
  • Several report having to manually re-download the APK each update.
  • Without Google Play Services, Signal uses a persistent websocket. Some say battery drain is “extreme,” others report acceptable multi‑day battery life on de-Googled ROMs.

Multi‑Device and Use Cases Once Served by Molly

  • Signal now supports linking additional iPhones and Android phones as secondary devices; this removes a key Molly advantage for many.
  • Limitations remain:
    • Linked devices are not primary; the original device must stay active.
    • Linked devices auto‑unlink and lose older history after some inactivity.
    • Some confusion around support for Android tablets; newer comments say it is now supported.
  • Users needing two Signal accounts on one phone resort to work profiles, Samsung Secure Folder, Private Space, Beeper, or similar workarounds.

Centralization, Identity, and “Vendor Lock‑In”

  • Strong debate over Signal’s centralized model, phone‑number (and now sometimes payment) based identity, and non‑federation vs. XMPP, Matrix, SimpleX, etc.
  • Critics call this vendor lock‑in and argue spam and abuse could be handled with invite tokens instead of phone numbers.
  • Defenders emphasize:
    • Centralization enables rapid, consistent security and feature rollouts.
    • Phone‑number registration and other friction significantly deter spam at scale.
    • Decentralized systems shift complexity, discovery, and abuse mitigation to users and many small operators.

Attitude Toward “Non‑Normie” Use and FOSS Concerns

  • Complaints that Signal neglects power users:
    • No official F-Droid or fully Google‑free flavor.
    • No UnifiedPush support despite working well in Molly.
    • Registration on Android historically forcing SMS read permission (no manual code entry), seen as anti‑privacy by some.
  • Others counter that:
    • F-Droid and similar audiences are tiny relative to Signal’s mainstream base.
    • Maintaining additional build targets and non‑GMS paths is non‑trivial for a small nonprofit.
    • Signal is designed for “normies” first; advanced users can choose other projects (Matrix, XMPP, etc.).

Usability, Data Control, and Reliability

  • Reports of degraded call quality and reliability (missed rings, low video quality) leading some to consider Matrix.
  • Criticism of Signal’s removal of SMS integration, which previously helped onboard non‑technical users.
  • iOS users describe SQLite DB corruption with no official way to export/fix the DB due to sandboxing and lack of export tools; backups plus third‑party tools are suggested but not always enabled beforehand.
  • Some feel Signal “hates users” via strict inactivity deletions and UX friction; others report smooth long‑term family use and actively donate.

Third‑Party Clients and Policy

  • Signal’s code is open source, but terms historically forbade third‑party clients from using the official servers; LibreSignal was explicitly asked to stop.
  • Today, small‑scale tools like signal‑cli or a desktop client (Corvus) appear tolerated, likely because usage is tiny.
  • One commenter asserts an unproven claim about a government backdoor tied to anti‑fork policies; others demand evidence and point to reproducible Android builds and the lack of substantiation.