this post was submitted on 31 Oct 2026
176 points (99.4% liked)

You Should Know

48180 readers
158 users here now

YSK - for all the things that can make your life easier!

The rules for posting and commenting, besides the rules defined here for lemmy.world, are as follows:

Rules (interactive)


Rule 1- All posts must begin with YSK.

All posts must begin with YSK. If you're a Mastodon user, then include YSK after @youshouldknow. This is a community to share tips and tricks that will help you improve your life.



Rule 2- Your post body text must include the reason WHY YSK:

In your post's text body, you must include the reason "Why" YSK: It’s helpful for readability, and informs readers about the importance of the content.



Rule 3- Do not seek mental, medical and professional help here.

Do not seek mental, medical and professional help here. Breaking this rule will not get you or your post removed, but it will put you at risk, and possibly in danger.



Rule 4- No self promotion or upvote-farming of any kind.

That's it.



Rule 5- No baiting or sealioning or promoting an agenda.

Posts and comments which, instead of being of an innocuous nature, are specifically intended (based on reports and in the opinion of our crack moderation team) to bait users into ideological wars on charged political topics will be removed and the authors warned - or banned - depending on severity.



Rule 6- Regarding non-YSK posts.

Provided it is about the community itself, you may post non-YSK posts using the [META] tag on your post title.



Rule 7- You can't harass or disturb other members.

If you harass or discriminate against any individual member, you will be removed.

If you are a member, sympathizer or a resemblant of a movement that is known to largely hate, mock, discriminate against, and/or want to take lives of a group of people and you were provably vocal about your hate, then you will be banned on sight.

For further explanation, clarification and feedback about this rule, you may follow this link.



Rule 8- All comments should try to stay relevant to their parent content.



Rule 9- Reposts from other platforms are not allowed.

Let everyone have their own content.



Rule 10- The majority of bots aren't allowed to participate here.

To have your bot whitelisted, please contact the moderators for a short review.



Rule 11- Posts must actually be true:

Disinformation, trolling, and being misleading will not be tolerated. Repeated or egregious attempts will earn you a ban. This also applies to filing reports: If you continually file false reports YOU WILL BE BANNED! We can see who reports what, and shenanigans will not be tolerated. We are not here to ban people who said something you don't like.



Rule 12- Linking directly to a video as a source is not acceptable.

Video only posts are responsible for an outsized portion of rules violations. Your post must contain text and meet the requirements of the previous rules.



Rule 13- If you file a report, include what specific rule is being violated and how.


Rule 14- This is a human community, NO LLMS ALLOWED.

No LLM based bot will ever have permission to post in YSK, do not ask.



Partnered Communities:

You can view our partnered communities list by following this link. To partner with our community and be included, you are free to message the moderators or comment on a pinned post.

Community Moderation

For inquiry on becoming a moderator of this community, you may comment on the pinned post of the time, or simply shoot a message to the current moderators.

Credits

Our icon(masterpiece) was made by @clen15!

founded 3 years ago
MODERATORS
 

cross-posted from: https://piefed.world/c/ysk/p/1503393/ysk-molly-signal-fork-has-not-been-updated-since-3-months-and-is-vulnerable-to-attacks-f

As of now, Molly lastest release was in 31 July (Version v8.19.2-4).

It contains vulnerabilities that had been simply fixed in mainline Signal.

Take for example the latest exploit disclosed in October, it has been fixed in Signal 8.27. 1. Meanwhile Molly remains vulnerable.

It's currently recommended to use mainline Signal and delete Molly till they at least return to updating their app adequately, if they ever will.

you are viewing a single comment's thread
view the rest of the comments
[–] stsquad@lemmy.ml 18 points 1 day ago (10 children)

Why run Molly when Signal is right there? Is this about getting it via places other than the Play store?

[–] pkal@social.sdfeu.org 4 points 1 day ago

@stsquad @beep The main reason for me is that I could install and update the app using F-Droid and not have to do so manually or with yet-another package manager. Having push notifications working on a degoogled phone without draining my battery is a close second.

[–] fluckx@lemmy.world 3 points 1 day ago

It does some extra stuff signal doesn't ( apparently). Though there's always a risk using a 3rd party client. And I guess it might be against the TOS of signal?

  • encrypt the database with a password
  • not using google for notifications
  • ram shedding And some others....

https://molly.im/

[–] dracs@programming.dev 7 points 1 day ago (1 children)

I'm running it specifically for the UnifiedPush support which gives me push notifications without Google Play Services.

[–] pulsewidth@lemmy.world 2 points 1 day ago

Signal works perfectly with MicroG for reference.

I have no Google Play Services on my GrapheneOS phone, or any Google account. Signal with MicroG works fast and accurate for all notifications.

[–] anon_8675309@lemmy.world 6 points 1 day ago

I don’t use it but I think the biggest reason is it’s degoogled

[–] DeeBeeDouble@lemmy.world 9 points 1 day ago (3 children)

That and unified push (although I didn't get that to work yet) are my main selling point, yes. I seriously don't understand how signal is only on the PlayStore

[–] twistypencil@lemmy.world 12 points 1 day ago* (last edited 1 day ago) (1 children)

As a Android developer who has an app in the Play store as well as in f-droid, I'll be the first to say that the f-droid people make it an absolute pain to put things there. I've almost stopped pushing there because of how annoying it is. My app went 3 months without being updated there because of how they manage things. They are way way way way. Way too frustrating to deal with.

So yeah I'm not surprised. A lot of stuff is not there. I support the concept and it was my main goal to put it there, but they have radically changed my opinion about using it and anyone who refuses to use an app because it's not there. Should try publish in there sometime

[–] DeeBeeDouble@lemmy.world 3 points 1 day ago (1 children)

What about your own repo then? I would be totally fine with that if signal did that.

[–] twistypencil@lemmy.world 1 points 1 day ago

Sure that is the work around that guardian did for signal. It's just a passion because everyone needs to add that repo manually. Very free people are going to bother with that additional friction if they even know it's there

[–] p_consti@lemmy.world 14 points 1 day ago (2 children)

Are you messing with me? It's literally right below: https://signal.org/android/apk/

[–] bad1080@piefed.social 1 points 1 day ago

doesn't get updates tho

[–] BandanaBug@piefed.social 1 points 1 day ago (1 children)

I didn't know but you can use obtanium and this

[–] DeeBeeDouble@lemmy.world 2 points 1 day ago

Yeah, that's what I did for a while until I discovered molly... Its annoying but probably the best option if molly becomes abandoned

[–] wunderkatze@discuss.tchncs.de 5 points 1 day ago (2 children)

With Molly you can use one Signal account on two devices.

[–] Creat@discuss.tchncs.de 6 points 1 day ago

What does this mean? I use signal with the official client on like 5 devices just fine?

[–] beyoublahaj@lemmy.world -1 points 1 day ago (2 children)

Signal supports two android devices in one account as standard

[–] exdor@programming.dev 4 points 1 day ago

Yeah, since a month or so, and emphasis on 2 and not unlimited

Really? That's new to me... I'll check it out

[–] razen@lemmy.world 4 points 1 day ago (1 children)

Signal is distributed by the Guardian Project on Fdroid.

[–] exdor@programming.dev 5 points 1 day ago (1 children)

Yeah unofficially... that is very much a bandaid. It is really bad of Signal to not have a blobfree reproducible build on F-Droid and Flathub, or even just external repos (for F-Droid and flathub).

Instead they have a hidden self-updating APK (which is a very cursed concept) with blobs, and a damn Appimage on Linux.

[–] razen@lemmy.world 2 points 1 day ago* (last edited 1 day ago) (1 children)

Yeah, is there any actual reason given by Signal for this?

[–] exdor@programming.dev 1 points 8 hours ago

They dont want to give control to platforms and their policies or update frequencies or some nonsense. Meanwhile they love Google

[–] AlmightyDoorman@kbin.earth 3 points 1 day ago (1 children)

I use molly because i have an android smartphone and tablet and running both with signal is not possible with signal. (Maybe the changed it? I have to check it)

[–] plateee@piefed.social 6 points 1 day ago (2 children)

They did! (If you're talking about pairing a tablet with your smart phone like how their desktop app pairs).

https://aboutsignal.com/news/signal-allows-android-phones-to-be-linked-as-secondary-devices/

[–] AlmightyDoorman@kbin.earth 3 points 1 day ago

Perfect, will switch back to signal.

On an unrelated not my signal backup has corruptes sticker cache, so all old stickers are not showing correctly, does anyone know a way to force it to download it a new one?

[–] may16th@lemmy.world 2 points 1 day ago

Thanks, I've been using Molly on my tab for a while. Have now installed Signal

[–] BillionaireStew@lemmy.world -2 points 1 day ago (1 children)
[–] exdor@programming.dev 6 points 1 day ago* (last edited 8 hours ago) (1 children)

Session has removed forward secrecy. I dont know if they still have broken autodeletion and still store all messages in a blockchain (delaying actual deletion). Overall though, I would stay away from it.

[–] BillionaireStew@lemmy.world 1 points 20 hours ago* (last edited 6 hours ago)

It's just forward secrecy, not "perfect forward secrecy", unless you are writing Signal press material. (Edit: Parent comment was edited to use the correct term.)

https://en.wikipedia.org/wiki/Forward_secrecy

I feel that such marketing can impart a false sense of security that has bitten Session users many a time. Ask Pete Hegseth, as much as I like to see him faceplant.

Not relying on the central server largely removes the need for forward security, since you can get a similar result by creating a new account (with a new private key) on your device as often as you like. It is Signal's reliance on a fixed identity that complicates the matter of rotating keys.

In other words, Signal is not better because it has "perfect forward secrecy". It is worse because it needs it.

Even so, it is such a talking point that Session does intend to implement "perfect forward secrecy".

https://getsession.org/blog/session-protocol-v2

As for "store all messages in a blockchain", I believe that is the alternative to storing them on a central server, as Signal does. They have to be stored somewhere until you are online to receive them. If they weren't, someone would be replying in your stead and complaining that Session does not allow users to receive messages sent while they were offline. Of course the messages are stored encrypted in both cases but only Signal associates them with your metadata.

I find it strange that you condemn Session's use of a blockchain but are apparently unconcerned by Signal's bundling a cryptocurrency wallet and linking it to users' Signal accounts.

https://en.wikipedia.org/wiki/MobileCoin#Signal_Integration

https://support.signal.org/hc/en-us/articles/360057625692-In-app-Payments#payments_requirements_pin