Molly.im

Nuttso

securitypost "reverse engineered" . XD you made my day. Please stop using Molly. It's not for you. Just for you to know. We have direct contact to the board. It's not that signals board doesn't know about us

securitypost

Nuttso

When software is forked, you can change whatever part you like and that part is no longer the same, by the very definition of it, as the original software.

You can have all the contact with "The Board" you want, but Molly is consistently very out of date and, by the very definition of it, insecure. I also don't know who you are (you will notice Signal board members are too busy to be posting here) and you're seemingly the sole developer of this out of date software, which has consistently shown it isn't being kept up to date. It is a badly managed project.

Don't worry, I definitely wouldn't be stupid enough to use Molly IM right now, I only use software that is kept up to date and complies with modern security standards. It's clearly a hobby project. Still I suppose you might as well bring out your hat for money while you still can. Users here of Molly might be confusing "it works!" with "it works therefore it is secure!", which is seemingly the case.

Nuttso

securitypost you don't need to know me. I was part of Grapheneos before it was copperhead. Before you even heard of a secure operating system. I supported Daniel since day one. Consider him a friend. Same as Oscar Mira the lead developer of Molly. I'm a founding member of Molly. So yeah my reputation can be verified. On the other hand i won't even comment your nonsense further.

MrChunky

So is Molly out of date? Does it significantly lag Signal for important security updates? I didn't notice that allegation being disputed.

popcorn

MrChunky Look at the release notes for the Signal versions they haven't merged...

https://github.com/signalapp/Signal-Android/releases

I haven't seen a single security related update for a loooong time in Signal. The releases are adding stuff like "★ A new and improved keyboard for emojis, stickers, and animated GIFs is our GIFt to you." (Release notes complete with a cute star and a terrible pun... doesn't seem like a thing Molly should really be concerned with at all.)

mulfi

We are going to have one secueity update soon

https://github.com/Imahian/Notes/tree/main/docs/CVEs/CVE-2026-113380

Nuttso

popcorn I already said above as well that nothing critical is missing. We are monitoring all changes. Look I have to be honest. I absolutely don't care if anyone doesn't like molly. Use something else. If anybody wants us to be as fast as Signal. Fund the project. Simple

IksNorTen

Nuttso Why are you so angry at people?

This discussion is about one simple thing: users are reporting that the app is getting harder to use. It's increasingly buggy.

Nobody is questioning whether it's up to date security-wise, although that's a fair debate too, given the difficulties you mention yourself in keeping it current.

The people here aren't attacking Molly. They truly appreciate your work, and they deserve respect, not "use something else" or "fund the project".

As for the history/experience with GrapheneOS team you brought up in your other message: nobody cares either.
What matters is who you are as a person, and how you act and speak. Right now that doesn't leave a good impression, of you and of the Molly project.

Norman

Nuttso
I personally don't have the extra money at the moment to put towards Molly, but I have been using it for well over a year now, mainly because of the ability to use UnifiedPush for notifications rather than FCM or WebSocket.

I really appreciate all the work that goes to into the project, it's often thankless effort and you don't see much of it in return because a lot of people forget that FOSS projects like this have real people behind them.

I've not run into any issues yet, though I do share the worries of people about the speed at which the project is keeping up to date with Signal. I hope you guys get the funding and time to work on this more.

Lastly, I do think it would be interesting if you opened up donation payments using Monero as a privacy-respecting alternative. Maybe you'll receive more donations that way as well, as there does exist a niche of privacy-respecting Monero holders.

fid03

IksNorTen Nobody is questioning whether it's up to date security-wise,

Except some people did that in this very thread.

NetRunner88

IksNorTen users are reporting that the app is getting harder to use. It's increasingly buggy

What bug ?
Bugs are self cultivating between updates ?
And every release reset the bug counter to zero ?

I don't understand what you are saying.

Nuttso

fid03 thank you

Nuttso

IksNorTen Why are you so angry at people?

You want to know why I get so angry? I'll tell you exactly why.

When someone who has never contributed a single thing to this project, who has absolutely zero technical understanding, comes along and attacks me, my friends, and ultimately our entire project, despite everyone knowing perfectly well how limited our resources are, that's where my patience runs out.

Anyone can clearly see that Signal has adopted a completely different update schedule, suddenly pushing out updates almost every week, many, many, many of which are currently not even security-relevant.

And when I have to explain myself to these people here for the third time, you should really be able to answer your own question.

We built all of this through our own efforts. There were several occasions when we reached a point where we genuinely didn't know how we could possibly move forward. This project costs money. We provide everything completely free of charge. From day one, we have practically begged people to help us.

We gave you real database encryption.

And then someone comes along and dismisses our app as nothing more than a stripped-down version of Signal?

That is an outright insult.

And you seriously ask me why I get so angry?

Let's not forget that Molly offers far more features than that. We have a functioning Signal server in our development environment, and we've put considerable work into getting it running and developing it further.

We're actively working on new ideas and concepts to make the entire system even more secure, including approaches involving attestation and additional security mechanisms.

We're investing our own time, money, knowledge, and energy into building something that goes far beyond simply modifying Signal. We're trying to push security and privacy further, despite having extremely limited resources.

And after all of that, I have to come here and read complaints from people who are unhappy because their fucking stickers aren't displaying properly like in the latest Signal update?

Seriously?

Leave me the hell alone.

0xC0DED0D0

With this thread unnecessarily "heating up" I've been casually researching the general Signal environment.

Found that there's a fork of Molly (no, not of Signal – directly of Molly) called Wren. The developer, munzzy, has some other interesting projects as well.

I don't know if there's any animosity behind the fork, but as I am firmly in Camp Molly (until proven otherwise), it seems a waste to develop on two fronts.

Could bringing munzzy on board be of help, @Nuttso? Or else "re-forking" his commits, I suppose.

Just an idea. Still cheering for Molly. 👍

tifus

Nuttso
Thank you for this post. :-)
We have a new "Daniel Micay" here.

tifus

0xC0DED0D0

Ship without Google. Molly's unified build has carried Firebase in every APK since December 2025 (Molly commit b698bbd5, and its firebase_messaging.xml); Wren links it only on request and tools/apk-report.sh proves any APK clean. docs/FOSS.md has the details.

:-)

Nuttso

tifus Daniel had the same problems a while ago. Even way bigger ones. I fully understand and support his attitude towards ungrateful people. You can ask him. I was with him since the beginning and didn't quit supporting him.

xxx

Nuttso towards ungrateful people

I think most people just don't know how difficult this fork is to maintain.

magnesium-lion

Nuttso

Nuttso And after all of that, I have to come here and read complaints from people who are unhappy because their fucking stickers aren't displaying properly like in the latest Signal update?

This appears to be a strawman.
Nobody was complaining about their stickers not showing the way they do in the latest Signal versions. That was part of the changelogs someone copy and pasted as part of saying they haven't seen a security related update from Signal in a long time.

taxonomy

We're getting multiple posts in here from accounts created in the last day or two. Its starting to look like ragebaiting by a single user. Let's not feed the troll(s).

« Previous Page Next Page »