All are necessary because permissions alone can't solve certain malicious behaviors. Look at some scorecards on the Community site you'll quickly see why some of the warnings are not things a permissions system or sandboxing could catch.

The blog post contains details about the rollout, but it will be a phased approach because it requires changes to the plugin API.

Security and authorization is just hard and at one point if you are designing a platform you have to ask yourself if it's worth the risk for the sake of flexibility. To plan for a perfectly safe system is a hopeless proposition.

The permission system are definitely useful for hard limits - but AI review can surface way more detail (what kinds of things are actually sent over the network, etc).

I am curious how well this works out in practice for the ecosystem, though. In my experience blanket scans have a good chance to produce false-positives (= CVE exists but doesn't apply to the context it's used in), so the scans need some know-how to interpret correctly, which can lead to a lot of maintainer churn.

I was a big todo.sh fan in college. Then wundrrlist and joplin. Still miss wunderlist. Tried Tiddlywiki too and liked it. You can make all of them work if it's just you. Sharing and collaboration is pain!

Then Notion. It is just perfect. Was very happy to pay for personal plan which is now removed. There is no official client for Linux (thanks Lotion). I was even using it to host my blog. Now downgraded to a free plan. Using wordpress for blogging.

Have tried obsidian and joplin as notion replacement but couldn't make it work. Notion mobile app is not very fast but better than any other options. I am so used to its databases, cross-linking, creating reminders.

Why not bring back the personal plan! It was really affordable.