deleted by creator

They dont want to give control to platforms and their policies or update frequencies or some nonsense. Meanwhile they love Google

That depends on where you got the APK from

• the playstore apk only supports FCM
• the standalone, hidden (you only find it via search engines), apk on their website also supports websocket
• Twinhelix Signal-FOSS only supports websocket
• molly also supports blobfree FCM and UnifiedPush

But note that UnifiedPush is not supported by signal, so you need to register a fake device on a server running MollySocket. Which is very much additional attack surface and only worth it if you really rarely use signal

Use Verified-Apps from PrivacyGuides to verify the signature of the APK before installing.

Before Appverifier was a thing, it was very obscure how to even check that signature.

Yeah, since a month or so, and emphasis on 2 and not unlimited

Yeah unofficially… that is very much a bandaid. It is really bad of Signal to not have a blobfree reproducible build on F-Droid and Flathub, or even just external repos (for F-Droid and flathub).

Instead they have a hidden self-updating APK (which is a very cursed concept) with blobs, and a damn Appimage on Linux.

Session has removed forward secrecy. I dont know if they still have broken autodeletion and still store all messages in a blockchain (delaying actual deletion). Overall though, I would stay away from it.

Signal-FOSS as alternative

I use Signal-FOSS by twinhelix. It exists since many years and upatches are fully automated.

They are very simple, deblob signal, remove firebase messages and maps and whatnot.

Twinhelix has also added some of the jw patches, which are nice to have.

It does not

• remove donations (which is nice and kinda shit of molly)
• remove payments with mobilecoin (kinda useless sadly as very few exchanges support it)
• add blobfree firebase messaging
• add unifiedpush support
• support linking multiple phones
• support encrypting the database
• probably more

If you dont need those features, I highly recommend it. Signal shipping Google blobs and having no F-Droid repo is very bad and that shouldn’t be supported.

See the list of known 3rd party F-Droid repos

UnifiedPush issues

Note that UnifiedPush needs to be supported by the server. The server then sends the push message to a UnifiedPush distributor (like Conversations, ntfy or Sunup). That distributor wakes up the app, which sends you the notification.

There is a slight polling delay of about 1 minute, so notifications are delayed.

I measured the effect of this by comparing molly with UP and the Signal APK with websocket. On a Pixel 8a running GrapheneOS, 12 hours idle on Wifi, airplane mode on (as the modem uses by far the most battery). I configured to send 10 messages to the device using Signals “send later” feature.

Websocket used 3% of the batterylife. Thats it.

And that effect is only significant for people who rarely use Signal, so the likelyhood of a nerd configuring MollySocket falling into that category is pretty low. If you regularly open Signal, this only delays notification alerts for no benefit.

And because the Signal servers don’t officially support this you need to either selfhost MollySocket (which would be fine apart from potential update delays, what this post is about) or trust some server operator. MollySocket is registered as another device, so the Signal servers and any standard Signal client would treat it as a trusted device with its own decryption key.

Apparently MollySocket discards the key and only receives “you have a message” (and no other metadata? I have obviously not researched this a lot), and I suppose Molly ensures that the device will never get a decryption key either. Still, it increases attack surface for very limited benefit.

It would be great if Signal officially supported UP instead of Google FCM.

I appreciate the textured background but the nerd in me wonders how much of the size it takes up

May I introduce you to the german “Elster” tax portal?

Most fucking insane security mechanisms ever. They support fido2 but with their app, not via a browser. Their linux program is a 10MB shell script that crashed my text editor.

They have a probably encrypted keyfile but that expires in 3 years and you need to

• login
• switch to desktop mode as otherwise they hide it
• send a code per email
• the site generated another code you also need
• you get another email with another link, which also doesnt include any code in the URL
• you need to log out to login again?
• you need to enter the 2 different codes for whatever reason. One is generated on the site before you need to log out, the other from the email
• then wait forever to create the keyfile
• you also need to setup a new password for the keyfile

So afaik you need a username, email, password, keyfile and password for the keyfile.

• why a keyfile again?
• why a username if it is never used?
• why so many emails with all the secret credentials instead of secure e2ee login on the website?

This should be illegal

Shouldnt you also disable the “Comodo” ones?

I dont “understand” the “point” of this “summary”

Tox did their own insecure crypto and got roasted by the Wireguard dev, now they are apparently rewriting it.

I agree that Matrix is complex but personally never had issues with key verification. Just try to restart it, maybe on the other device?

Tbh though shouldnt agents see the linter and CI output and adapt their PRs? At least everything that a machine can parse should be considered

Thats an extension not an alias

Uhm you sent the french variant

https://fsfe.org/news/2026/news-20260825-01.en.html

Flathub

Nixos

GrapheneOS

uBlue (Bazzite, Bluefin etc), Secureblue

90% of android and linux apps

github is scary big

deleted by creator

Mandela effect

They tried to hide it so people looked and found out he was cloned in prison /s

Yes but what the hell is going on in that linux install window