177
Signal-FOSS as alternative
I use Signal-FOSS by twinhelix. It exists since many years and upatches are fully automated.
They are very simple, deblob signal, remove firebase messages and maps and whatnot.
Twinhelix has also added some of the jw patches, which are nice to have.
It does not
- remove donations (which is nice and kinda shit of molly)
- remove payments with mobilecoin (kinda useless sadly as very few exchanges support it)
- add blobfree firebase messaging
- add unifiedpush support
- support linking multiple phones
- support encrypting the database
- probably more
If you dont need those features, I highly recommend it. Signal shipping Google blobs and having no F-Droid repo is very bad and that shouldn't be supported.
See the list of known 3rd party F-Droid repos
UnifiedPush issues
Note that UnifiedPush needs to be supported by the server. The server then sends the push message to a UnifiedPush distributor (like Conversations, ntfy or Sunup). That distributor wakes up the app, which sends you the notification.
There is a slight polling delay of about 1 minute, so notifications are delayed.
I measured the effect of this by comparing molly with UP and the Signal APK with websocket. On a Pixel 8a running GrapheneOS, 12 hours idle on Wifi, airplane mode on (as the modem uses by far the most battery). I configured to send 10 messages to the device using Signals "send later" feature.
Websocket used 3% of the batterylife. Thats it.
And that effect is only significant for people who rarely use Signal, so the likelyhood of a nerd configuring MollySocket falling into that category is pretty low. If you regularly open Signal, this only delays notification alerts for no benefit.
And because the Signal servers don't officially support this you need to either selfhost MollySocket (which would be fine apart from potential update delays, what this post is about) or trust some server operator. MollySocket is registered as another device, so the Signal servers and any standard Signal client would treat it as a trusted device with its own decryption key.
Apparently MollySocket discards the key and only receives "you have a message" (and no other metadata? I have obviously not researched this a lot), and I suppose Molly ensures that the device will never get a decryption key either. Still, it increases attack surface for very limited benefit.
It would be great if Signal officially supported UP instead of Google FCM.