They dont want to give control to platforms and their policies or update frequencies or some nonsense. Meanwhile they love Google

That depends on where you got the APK from

• the playstore apk only supports FCM
• the standalone, hidden (you only find it via search engines), apk on their website also supports websocket
• Twinhelix Signal-FOSS only supports websocket
• molly also supports blobfree FCM and UnifiedPush

But note that UnifiedPush is not supported by signal, so you need to register a fake device on a server running MollySocket. Which is very much additional attack surface and only worth it if you really rarely use signal

Use Verified-Apps from PrivacyGuides to verify the signature of the APK before installing.

Before Appverifier was a thing, it was very obscure how to even check that signature.

Yeah, since a month or so, and emphasis on 2 and not unlimited

Yeah unofficially… that is very much a bandaid. It is really bad of Signal to not have a blobfree reproducible build on F-Droid and Flathub, or even just external repos (for F-Droid and flathub).

Instead they have a hidden self-updating APK (which is a very cursed concept) with blobs, and a damn Appimage on Linux.

Session has removed forward secrecy. I dont know if they still have broken autodeletion and still store all messages in a blockchain (delaying actual deletion). Overall though, I would stay away from it.

Signal-FOSS as alternative

I use Signal-FOSS by twinhelix. It exists since many years and upatches are fully automated.

They are very simple, deblob signal, remove firebase messages and maps and whatnot.

Twinhelix has also added some of the jw patches, which are nice to have.

It does not

• remove donations (which is nice and kinda shit of molly)
• remove payments with mobilecoin (kinda useless sadly as very few exchanges support it)
• add blobfree firebase messaging
• add unifiedpush support
• support linking multiple phones
• support encrypting the database
• probably more

If you dont need those features, I highly recommend it. Signal shipping Google blobs and having no F-Droid repo is very bad and that shouldn’t be supported.

See the list of known 3rd party F-Droid repos

UnifiedPush issues

Note that UnifiedPush needs to be supported by the server. The server then sends the push message to a UnifiedPush distributor (like Conversations, ntfy or Sunup). That distributor wakes up the app, which sends you the notification.

There is a slight polling delay of about 1 minute, so notifications are delayed.

I measured the effect of this by comparing molly with UP and the Signal APK with websocket. On a Pixel 8a running GrapheneOS, 12 hours idle on Wifi, airplane mode on (as the modem uses by far the most battery). I configured to send 10 messages to the device using Signals “send later” feature.

Websocket used 3% of the batterylife. Thats it.

And that effect is only significant for people who rarely use Signal, so the likelyhood of a nerd configuring MollySocket falling into that category is pretty low. If you regularly open Signal, this only delays notification alerts for no benefit.

And because the Signal servers don’t officially support this you need to either selfhost MollySocket (which would be fine apart from potential update delays, what this post is about) or trust some server operator. MollySocket is registered as another device, so the Signal servers and any standard Signal client would treat it as a trusted device with its own decryption key.

Apparently MollySocket discards the key and only receives “you have a message” (and no other metadata? I have obviously not researched this a lot), and I suppose Molly ensures that the device will never get a decryption key either. Still, it increases attack surface for very limited benefit.

It would be great if Signal officially supported UP instead of Google FCM.

I appreciate the textured background but the nerd in me wonders how much of the size it takes up

I would include the 2-letter and 3-letter code in your searches

That seems to be kinda standard. If Sonarr/Radarr have a more elegant solution than looking in the title, that might be preferred

I would never use their proprietary clients. And when looking for software for Linux, start on flathub.org

There are Nicotine+ multiplatform and Seeker for Android.

Soulseek is entirely proprietary and scary insecure. Check the Nicotine+ documentation for an overview. They do not mention encryption or TLS anywhere, which tells us that there is no encryption. Anyone relaying or passively monitoring your internet traffic will know your username, password and what you share.

This is seriously scary as even with user accounts, known contacts etc, you basically can’t trust anyone to actually be who they pretend to be. In practice it works, but that is likely because nobody cares to attack them.

The server is proprietary running whatever software and can access all your data.

And the best, they use MD5 hashes for the files afaik, which is broken. This is pretty unimportant but still interesting: the files you download are sent over an unencrypted connection and could be modified by a man-in-the-middle without you noticing. One could change the file or hide malware inside it that exploits a vulnerability etc.

Most importantly, this will just be open traffic that will be exposed to anyone who cares. You shouldnt use that IP to do ANYTHING else.

Sadly Soulseek is really good for finding stuff, still very much unbeaten.

There is aMule, recently revived. Many servers and also the decentralized Kademlia network. The UX is way worse than Soulseek, there is no Android version, the revival is heavily driven by AI… but it is pretty good, decentralized and encrypted!

I found this repo with tips for setting up aMule and some scripts.