i thought it was solved with the version 0.8 of the client, also it seems that malleability it's more of a exchange, or merchants fault that keep running alternative custom client
i remember that it was mtgox fault at that time, because other exchange did not face this problem
malleability is not just one issue. there are many ways to screw with data and swap transactions, all of which are termed malleability.. yes there were some bug fixes, but there are still ways to twist a transaction to your favour, so its still not good to blindly trust a tx until its confirmed. not yet atleast
its also not good to technically trust a transaction with 1 confirm. because miners sometimes dont simply stale their attempts when there is a solved block by a competitor, and so orphans can make a tx with a confirm appear valid. then seconds/minutes later invalid, because that block became orphaned. and the competing block didnt include your transaction when it raced to first place to throw the other block into orphan
though only 1% of blocks lead to a orphan, and of those orphaned blocks the chances that the competing block didnt also have your tx, is 1 in ~4000 means the odds of a 1 confirm suddenly leaving a retailer with an empty pocket is something line 0.00025% (1 in ~400,000 chance). so people dont worry or talk about that kind of odds much.. but it is possible
thats why even the big names, andreas, gavin, and hundreds of others say
price of a coffee 0 confirms (only 1% of your customers lack morals and want to be a theif)
price of a TV 1 confirm (1 in 400,000 something will go wrong, and it takes 10 minutes to get the TV out of the shops storeroom, so no problem waiting)
price of second hand car 2 confirms
price of new car 3 confirms
price of small house 4 confirms
price of large mansion 5 confirms
bill Gates net value 6 confirms.
although the odds increase massively per confirm to numbers a brain cant quantify, and some people can take the small risk vs customer experience satisfaction, its still worth thinking about how important the item your selling is, vs how long you will make a customer wait vs risk of a miner not staling or immoral thief.
emphasis:
coffee can be bought using zero confirms.. not due to there being no malle.. but the social study that a coffee shop would only have 1% of coffee stolen. and a coffee shop makes enough profit to cover that loss, and would not want to lose more money simply by upsetting customers by making them wait, thus losing future customers loyalty. in short its more about social loyalty to keep profits coming in, to cover potential losses.
but ignoring social studies.. and thinking about bitcoin security/trust of tx's.. malle really needs to be fixed! as it is a risk that shouldnt rely on social statistics, or retailers profitability or customer loyalty to pretend its not a problem