this post was submitted on 06 Jul 2026
17 points (100.0% liked)

DeGoogle Yourself

17311 readers
152 users here now

A community for those that would like to get away from Google.

Here you may post anything related to DeGoogling, why we should do it or good software alternatives!

Rules

  1. Be respectful even in disagreement

  2. No advertising unless it is very relevent and justified. Do not do this excessively.

  3. No low value posts / memes. We or you need to learn, or discuss something.

Related communities

!privacyguides@lemmy.one !privacy@lemmy.ml !privatelife@lemmy.ml !linuxphones@lemmy.ml !fossdroid@social.fossware.space !fdroid@lemmy.ml

founded 6 years ago
MODERATORS
CrypticCoffee@lemmy.ml
CrypticCoffee@lemm.ee
Byereddithellolemmy@lemmy.world
chevy9294@monero.town
17
How do you guys keep Signal up to date? (lemmy.ml)
submitted 1 week ago* (last edited 1 week ago) by _Nemo_@lemmy.ml to c/degoogle@lemmy.ml
27 comments fedilink hide all child comments
 

I'll cut straight to the chase: updating the Signal app annoys me and I'd like to know your best practices.

As far as I know, there are three ways of updating Signal:

  1. From the Play Store. This works quite reliably, yet comes at the cost of trusting and connecting to Google's servers.
  2. Via the app's built-in auto-updater that will, after a while, suggest an update through a notification. However, the frequency of these updates is really lackluster and thus unreliable, and there's no way to trigger an update check manually.
  3. Via the APK on Signal's website. In order for this to work, you need to have done the initial installation of the app from an APK already. Also, as far as I know, this version will not use GCM / Push notifications, but rather deliver notifications through a web socket, which is a huge drain on battery. Also, you'll have to constantly check for updates yourself or rely on the (unreliable) self-updating mechanism (see 2).
  4. //Edit a fourth way might be to just update via Obtainium and pulling APKs off their Github. I'm not sure what that does to GCM/Websocket usage, see 3.

Let me know how you do it, and if there's something I've overlooked.

you are viewing a single comment's thread
view the rest of the comments
[–] akunohana@piefed.blahaj.zone 22 points 1 week ago (4 children)

Molly via Obtainium.

https://github.com/mollyim/mollyim-android

Just paste the URL in the "add app" window.

[–] makothefrog@lemmy.world 2 points 3 days ago

I was hoping to keep my phone fully clear of play services but notifications through FCM are unfortunately integral to the android experience now. I set up my own Molly Socket and unified push, but I sometimes notifications were delayed, and I do really like being able to see the contents and reply to messages from the notification which I don't think unified push does (or at least molly socket didnt). And it was also the only app I had that supported unified push. I'm really hoping it catches on future. Would love to get rid of play services entirely

[–] _Nemo_@lemmy.ml 8 points 1 week ago (1 children)

I'll reply to you since you first brought it up, but it's a question to anyone here recommending Molly: what makes you cofident that Molly is secure (i.e. they're not fucking up Signal's cryptography by accident) and maintained by trustworthy people. Signal does get audits from time to time, Molly doesn't.

Mind you, I'm not trying to shit all over Molly; Unified Push looks great. I'm trying to approach this with due caution though.

[–] halm@leminal.space -4 points 1 week ago (1 children)

What makes you confident Signal is secure? It's a centralised service, so there's a single point of failure 🤷

[–] _Nemo_@lemmy.ml 3 points 6 days ago* (last edited 6 days ago)

Ignore the downvotes. That's a fair question to ask, but one that does have answers. Signal is FOSS, has E2EE and was audited several times, so we know that

  • it did not contain any backdoors at the time of the audit
  • it will not for the foreseeable future (they'd be visible in the client code)
  • I need not trust the server code since messages are E2EE

Thus, while mistakes do happen and can open up severe vulnerabilities, cf. Heartbleed, there's reason to assume that Signal is relatively secure. Signal's centralisation of server infrastructure is a valid concern, but not for security, but rather for

  • privacy (they might capture metadata, although it appears they don't; nation-state actors trying to subpoena user data have so far only gotten "date of registration" and "last online", which appears to be all they're storing; that's as close to "zero knowledge" as you get)
  • availability (as the recent AWS outage has shown, which took out Signal as well)
[–] merde@sh.itjust.works 4 points 1 week ago

at some point Molly started customising Signal's appearance or rather imposing a coloured theme. Some of us wrote back and we were ignored.

I went back to Signal with black backgrounds.

[–] Trilogy3452@lemmy.world 1 points 1 week ago

Is there a risk of getting banned? IIRC it's against their ToS