Molly (Signal fork) has not been updated since 3 months and is vulnerable
- ID
- 41621
- Status
- summarized
- Published
- 31 Oct 2026, 6:23 PM
- Fetched
- 01 Nov 2026, 4:06 AM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://piefed.world/post/1503394
- Source URL
- https://hnrss.org/best
Summary
- Score
- 4.0
- Created
- 01 Nov 2026, 4:07 AM
- Tags
- Audience
- developerssaas_founders
What happened
A PieFed post warns that Molly, a Signal fork for Android, has not shipped a release since v8.19.2-4 on 31 July 2026, while mainline Signal fixed an October-disclosed exploit in 8.27 that can let audio—and possibly video—continue after a call is hung up. The Hacker News thread drew 246 points and 150 comments, and the post recommends using mainline Signal and deleting Molly until it resumes adequate updates.
Why it matters
If you or your team installed Molly for Signal, switch to mainline Signal rather than waiting: the concrete gap is a July 31 fork build missing a fix present in Signal 8.27. If you maintain or recommend a security-sensitive fork, treat a three-month lag behind an upstream security fix as a stop-ship signal. No Malaysia-specific impact is stated in the text.
Discussion angle
Use this as a concrete fork-risk case: at what point does a three-month patch lag make a privacy/security fork untrustworthy, and what signals would you check before recommending one?