Remove Molly (Signal Fork)

Site Development Tool Suggestions
1

Hello everyone!

As discussed here: Molly lagging behind Signal android updates? - #40 by yolakalemowa we no longer have any visibility nor guarantee of how long Molly’s developers take to update the application after any new Signal update.

The tracking isn’t what it used to be, and it poses a risk to the app.

Also worth noting that lately it’s been more than 6-7 weeks without any update, whereas the delay was originally supposed to be 2 weeks, except in cases of a critical vulnerability. It’s not the first time this happens.

The risk-benefit balance is starting to tip toward the risk now (as the app starts to lose its main advantage of being maintained quickly).

For an application as sensitive as this one (instant messenger), this should no longer be suggested by Privacy Guides.

2

I think it might be worth noting that there have been long delays recently (much longer than the stated two week updates), but removing it is probably premature.

3

This is a fair critique. Derelict Molly updates have been a PG discussion topic at least three times this year. And PG does usually prioritize timely updates as an indication of actively-maintained projects.

However, worth noting that ‘timely updates’ are not currently a listed requirement for PG recommended messengers. Although we do directly cite that ‘2 week’ update lag from Molly

___

Here’s the real question to answer - does it? Judging from release notes, it seems as though the lagging updates were mostly Signal UI features. Whether or not there are missing security updates of any kind should probably be a point of discussion

___

I do believe that Molly still offers unique security features, and have not yet seen any evidence that these lagging updates have impaired Molly’s security, so Id be inclined to keep the recommendation. Though it’s a fair discussion to have - at the very least, we may need to update the recommendation itself if the ‘2 weeks’ is no longer true

Molly devs (I know you’re here), it may be worth chiming in as to why this schedule hasn’t been maintained

4

A potentially relevant post by a Molly developer on the GrapheneOS forum.

We don’t follow signals update schedule. Only if there is something security relevant.

5

This makes sense, and thanks for the update.

I continue to use Molly…for now…but it is definitely perplexing why they expect people to trust that they can develop a top notch fork of a premier encrypted messenger, but they can’t accurately update text in their GitHub (to remove the existence of Molly-FOSS as well as their own proclamation that they update every two weeks).

I don’t think I’m splitting hairs here. It’s been a long time since I coded, but I remember that attention to detail, and being meticulous and systematic about it were definitely attributes that were required to produce code without bugs. Them not wanting to update their GitHub doesn’t necessarily indicate there are quality issues with Molly, but with 436 contributors, you would think there would be a system where one of those contributors could spend an hour to update the README. It’s not a red flag, but it’s definitely an orange flag.