Molly(Signal fork) has not been updated since 3 months and is vulnerable

Molly, a Signal fork, is vulnerable due to unpatched exploits from mainline Signal.

The messaging application Molly, a fork of Signal, has not received updates in three months, leaving it vulnerable to security exploits that have already been patched in the mainline Signal application. Molly's latest release, version v8.19.2-4, was updated on July 31st. A critical exploit disclosed in October, for instance, was fixed in Signal version 8.27.1 but remains unaddressed in Molly. Users are currently advised to switch to the official Signal app and uninstall Molly until its developers resume adequate update cycles. Discussions indicate that some users prefer Molly for features like unified push notifications or easier multi-device pairing, though Signal has also recently improved its multi-device capabilities.

The prolonged lack of updates for Molly signifies a potential abandonment by its development team, raising concerns about the long-term security and viability of the application for its user base. This situation highlights the risks inherent in relying on application forks, where users may forgo critical security patches if the maintainers do not keep pace with upstream changes. The situation also underscores the challenges faced by alternative distribution platforms like F-Droid, which can experience delays in app updates due to their review processes, as mentioned by an Android developer in the discussion.

For users who valued Molly for specific features like unified push notifications or simpler multi-device setup, the current vulnerability forces a re-evaluation of their messaging choices. While Signal has recently introduced improved multi-device functionality, the absence of timely security updates in Molly leaves its users exposed. This event may prompt a broader consideration of the security trade-offs associated with using forked applications versus the official, more frequently updated versions, especially concerning sensitive communication.