--- title: Molly(Signal fork) has not been updated since 3 months... description: Molly, a Signal fork, has not released an update since July 31 (version v8.19.2-4). It contains vulnerabilities that mainline Signal fixed, such as an... canonical: https://daily.dev/posts/molly-signal-fork-has-not-been-updated-since-3-months-and-is-vulnerable-2imssq59p twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Molly(Signal fork) has not been updated since 3 months and is vulnerable | daily.dev og:description: Molly, a Signal fork, has not released an update since July 31 (version v8.19.2-4). It contains vulnerabilities that mainline Signal fixed, such as an... og:url: https://daily.dev/posts/molly-signal-fork-has-not-been-updated-since-3-months-and-is-vulnerable-2imssq59p og:image: https://api.daily.dev/og/posts/2IMSSQ59P.png og:image:alt: Molly(Signal fork) has not been updated since 3 months and is vulnerable og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Molly(Signal fork) has not been updated since 3 months and is vulnerable **[Hacker News](https://daily.dev/sources/hn)** · 1 min read · 0 upvotes · 0 comments ## Summary Molly, a Signal fork, has not released an update since July 31 (version v8.19.2-4). It contains vulnerabilities that mainline Signal fixed, such as an October-disclosed exploit where audio and possibly video continue after hanging up, which was fixed in Signal 8.27. The post recommends switching to mainline Signal and deleting Molly until the fork resumes regular updates. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Is the Molly Signal fork for Android still safe to use? No, Molly has not been updated since July 31, 2026 (version v8.19.2-4) and remains vulnerable to a bug fixed in mainline Signal 8.27 that let audio or possibly video continue after a call was ended. Mainline Signal is recommended until Molly resumes regular updates. _Anyone choosing between Signal forks and the official app can track patch gaps like this on daily.dev._ ### What was the Signal Android call vulnerability fixed in version 8.27? It was a bug that could let audio, and possibly video, continue after a call had been ended on Android. Signal fixed it in version 8.27, as detailed in Signal's own announcement about fixing a bug affecting ending calls on Android. _Developers tracking messaging app security fixes can follow disclosures like this on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 1 discussion and 120 comments across hackernews (as of 2026-10-31). **TL;DR:** Discussion largely pivots away from Molly itself into a broader airing of grievances about mainline Signal's design choices (phone number requirement, no de-Googled/F-Droid build, lack of UnifiedPush, SQLite export limitations), with a smaller contingent defending Signal's pragmatic, security-first tradeoffs. **Sentiment:** 10% positive · 35% mixed · 55% skeptical **The case for** - Some note mainline Signal recently added multi-device linking for a second phone, removing one of the main reasons people used Molly. - Several longtime users report Signal works reliably without Google services on LineageOS/GrapheneOS with acceptable battery life. - One commenter defends Signal's centralized, phone-number-based design as a pragmatic tradeoff that successfully mainstreamed E2EE. **The pushback** - Many argue Signal refuses reasonable features like UnifiedPush, manual SMS code entry, or a Google-free build, calling this hostile to non-mainstream users. - Commenters describe degraded call/video quality over the past year, including calls not ringing or not registering as missed. - A thread criticizes that Signal's iOS sandboxing prevents users from exporting or repairing a corrupted local SQLite database even though the app is open source. - Some feel Signal's app update mechanism (manual APK re-download, notification taps not working) is unreliable. - Critics argue Signal's centralized service and discouragement of third-party clients/federation amounts to vendor lock-in. **By community** - hackernews (heated): A long, contentious thread where criticism of Signal's design choices dominates but is repeatedly pushed back on by defenders citing pragmatic security tradeoffs. **Hottest debate:** Whether Signal's refusal to support Google-free builds, UnifiedPush, and third-party clients reflects user-hostile design or a necessary pragmatic tradeoff for security and mainstream adoption. **Open questions** - Why can't Signal's iOS app export or repair its own SQLite database to recover corrupted message history? - Could Signal offer an optional de-Googled/UnifiedPush build without major additional maintenance burden? - Is the perceived degradation in call/video quality over the past year a widespread issue or isolated reports? **Highlights** > Or this case we encountered, where on iOS Signal apparently corrupts its sqlite DB, leading to loss of all messages. https://github.com/signalapp/Signal-iOS/issues/5813 Interestingly here, the sqlite DB would be trivially fixable, and messages restorable, with the `sqlite3` CLI. But there's no way to get at that sqlite DB file. Even if you change Signal's code to add a feature to export the DB, it apparently cannot see your DB, because iOS sandboxes that so that it is only visible to Signal builds signed with the Signal developers' keys. So that means your messages are all there, on your device, running open-source software, and yet you cannot get them. This cannot have been the intention of Signal being Free Software. Where is "change it to make it do what you wish (freedom 1)"? (I do not use iOS myself but have friends suffering this issue. Everybody involved is programmers and yet we seem to be able to do nothing about it.) So it seems that even though the messages are on the user's device, it really is the Signal developers who "own" that data, and have the exclusive and ultimate control over it. Makes me wonder: Does this mean users suffering this need to GDPR-request their data out from Signal? > — [nh2 on hackernews · 7 comments](https://news.ycombinator.com/item?id=50315735) > I have been a signal user from very early on, converted most of my family and quite a few friends. I did use Molly to register my second phone (just found I can do that with signal now, so uninstalled Molly and installed signal).I have the impression that the calling experience significantly degraded over the last year, i.e. calls just not ringing at the other end, sometimes even not showing as missed calls, Video calls being very low quality even though both ends are on high quality connections (and switching to other apps yields high quality). Just yesterday I was standing in a queue inside and a friend was outside. We both tried to call each other but the call was just giving ringtone without ringing on the other end. It's become so bad that I'm now considering setting up my own matrix server and transition to that. Anyone else experiencing the same? I have been wondering if it might have been me using molly, so will test now after going back to signal for second device. > — [cycomanic on hackernews · 1 comments](https://news.ycombinator.com/item?id=50316252) > TIL: The official Signal app can now use one account, shard over two devices. This was my main reason to use Molly over Signal. https://aboutsignal.com/news/signal-allows-iphones-to-be-lin... > — [jttnr on hackernews · 3 comments](https://news.ycombinator.com/item?id=50315192) > It explains perfectly why Signal does not want third-party clients. To the haters: I am not saying that it is perfect, in an ideal world we could have secure third-party clients. I am just saying that it is pragmatic: in our world, we don't. Signal has forever been a pragmatic approach to private messaging, and it succeeded at that: Signal literally put E2EE on the map! Signal has a threat model, and they do the best app they can addressing that threat model. Which means that they cannot accept third-party clients or federation. They don't say "you cannot use XMPP or SimpleX or Matrix on the side", they just say "we provide this, if you benefit from it, use it for free". Still, there is a very vocal minority that takes every opportunity they take to explain how "insane" that is, and how they "cannot imagine how anyone with some kind of intelligence wouldn't be revolted". I believe it is the same posture as those complaining about Android or GrapheneOS not giving root access ("even in the advanced settings"). The fact is that if you want root access on your phone, you should install a system that gives you root access, and not select a system that does not and then complain. Signal is great at what it does. It's okay to also want something else while acknowledging that Signal is great at what it does. > — [palata on hackernews · 1 comments](https://news.ycombinator.com/item?id=50316514) > Sometimes I get the feeling that Signal hates users who aren't total normies. Unified Push, which works flawlessly on Molly, could easily be implemented in the regular client. Just as they could easily offer a Google free version for F-Droid or simply for people who want nothing to do with Google. But they just refuse. Just like it took years for nicknames to be introduced, and registering without a phone number has only recently become possible and only through the Google Play Store. > — [ada-h00k on hackernews · 13 comments](https://news.ycombinator.com/item?id=50315322) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=50314666) · 154 points · 120 comments ## Similar posts on daily.dev - [Molly](https://daily.dev/posts/molly-8kbd69yoq) · Hacker News · 1 upvotes · 0 comments - [Signal bug could keep your mic - and camera - on after hangup](https://daily.dev/posts/signal-bug-could-keep-your-mic---and-camera---on-after-hangup-vobvhphgb) · The Register · 0 upvotes · 0 comments - [Privacy Messenger Session Is Staring Down a 90-Day Countdown to Obscurity](https://daily.dev/posts/privacy-messenger-session-is-staring-down-a-90-day-countdown-to-obscurity-a2h6gn7xg) · It's Foss · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#android](https://daily.dev/tags/android) [View this post on daily.dev](https://daily.dev/posts/molly-signal-fork-has-not-been-updated-since-3-months-and-is-vulnerable-2imssq59p) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Molly(Signal fork) has not been updated since 3 months and is vulnerable","url":"https://daily.dev/posts/molly-signal-fork-has-not-been-updated-since-3-months-and-is-vulnerable-2imssq59p","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/molly-signal-fork-has-not-been-updated-since-3-months-and-is-vulnerable-2imssq59p"},"datePublished":"2026-10-31T13:42:15.997Z","dateModified":"2026-10-31T16:13:21.431Z","description":"Molly, a Signal fork, has not released an update since July 31 (version v8.19.2-4). It contains vulnerabilities that mainline Signal fixed, such as an...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/44d0db483aa0679a07bebb64b147d7c1?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/44d0db483aa0679a07bebb64b147d7c1?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/molly-signal-fork-has-not-been-updated-since-3-months-and-is-vulnerable-2imssq59p","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,android","timeRequired":"PT1M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"Molly(Signal fork) has not been updated since 3 months and is vulnerable"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/molly-signal-fork-has-not-been-updated-since-3-months-and-is-vulnerable-2imssq59p#faq","mainEntity":[{"@type":"Question","name":"Is the Molly Signal fork for Android still safe to use?","acceptedAnswer":{"@type":"Answer","text":"No, Molly has not been updated since July 31, 2026 (version v8.19.2-4) and remains vulnerable to a bug fixed in mainline Signal 8.27 that let audio or possibly video continue after a call was ended. Mainline Signal is recommended until Molly resumes regular updates. Anyone choosing between Signal forks and the official app can track patch gaps like this on daily.dev."}},{"@type":"Question","name":"What was the Signal Android call vulnerability fixed in version 8.27?","acceptedAnswer":{"@type":"Answer","text":"It was a bug that could let audio, and possibly video, continue after a call had been ended on Android. Signal fixed it in version 8.27, as detailed in Signal's own announcement about fixing a bug affecting ending calls on Android. Developers tracking messaging app security fixes can follow disclosures like this on daily.dev."}}]} ```