Iris Apfel&#x27;s close friend Bruce Sutka reminisces to PEOPLE about his fondest memories of the fashion icon, who died on Friday at the age of 102.

Iris Apfel’s Friend Recalls Walmart and Paris Outings with Fashion Icon

Iris Apfel, a textile expert, interior designer and fashion celebrity known for her eccentric style, has died. She was 102.

Fashion icon Iris Apfel, famous for her eye-catching and irreverent style, dies at 102 | PBS NewsHour

She came to fame in the fashion world in her 80s and 90s, and her wildly eclectic closet of clothes formed a hit exhibition at the Metropolitan Museum of Art.

Iris Apfel, Eye-Catcher With a Kaleidoscopic Wardrobe, Dies at 102 - The New York Times

Celebrities including Maria Shriver, Vera Wang, Viola Davis, Kate Walsh and Molly Ringwald are paying tribute to Iris Apfel on social media after she died on Friday at age 102.

Vera Wang, Viola Davis and More Stars Mourn Death of Fashion Icon Iris Apfel: 'Forever an Inspiration'

Iris Apfel, known globally for her bold style and individuality, has died at 102. Her work appeared in the White House and the Metropolitan Museum of Art.

Iris Apfel, beloved style icon whose fame peaked in her 90s, dies at 102

Sydney Sweeney is effortlessly chic in a black velvet miniskirt and fitted top as she enjoys a night out in NYC... ahead of hosting SNL Her star is on the rise

Young Iris Apfel: Throwback photos show fashion icon's incredible ascent as she passes away aged 102 - from childhood on farm to signing a modelling contract at 97 | Daily Mail Online

Her clothes weren’t so much outfits, as living tableaux. She left the house each day dressed as a picture of joy

Iris Apfel: joyful iconoclast, who broke all the rules with incredible taste | Fashion | The Guardian

The model waxes lyrical about her favourite SS24 H&amp;M studio number, her beloved vintage spots and her &#x27;sleepy girl&#x27; music recommendations.

Iris Law On Her Go-To H&M Studio Dress, Vintage Shopping In Paris And Loving 'Sad Girl' Music

Iris Apfel's final heart-warming Instagram post revealed - just one day before she died aged 102 | Daily Mail Online

New York designer has been hailed an ‘innovator’ who will ‘go down in history’

Iris Apfel death: Tommy Hilfiger and Hannah Waddingham lead tributes to style icon, after death aged 102 | The Independent

Risü

Nuclear power plants could resolve the energy crisis in the United States brought on by the recent exponential growth of data centers. However, some have safety concerns. Incidents like the Chornobyl disaster are still fresh in people’s minds. Could living next to one of these stations adversely affect their well-being? How close is too close? Nuclear power plants could resolve the energy crisis in the United States brought on by the recent exponential growth of data centers. However, some have safety concerns. Incidents like the Chornobyl disaster are still fresh in people’s minds. Could living next to one of these stations adversely affect their well-being? How close is too close? The Palisade Plant’s Reopening Marks a Nuclear Milestone The Palisade Plant’s Reopening Marks a Nuclear Milestone In Southwest Michigan, Holtec International — a firm that specializes in reactor component design and manufacturing — is bringing the Palisades nuclear power plant back online. According to projections, it could be operational by October 2025. It will be the first domestic facility ever reopened, potentially setting a precedent for the rest of the country. The Palisades plant closed in 2022. Since it has a capacity of 800 megawatts, the state wants to reopen it to meet its new clean energy goals. The Michigan Legislature set aside $150 million in the fiscal year 2025 budget to support that effort. Also, the federal government offered Holtec a conditional $1.5 billion loan. has a capacity of 800 megawatts has a capacity of 800 megawatts While Holtec is optimistic about the October 2025 deadline, various representatives from the Nuclear Regulatory Commission (NRC) have said the timeline is “very, very demanding” and “very aggressive.” These comments came after a September 2024 inspection where 1,000 steam generator tubes were found damaged. 1,000 steam generator tubes 1,000 steam generator tubes Although NRC staff say repairing and reinforcing the tubes with a specialized coating has been used thousands of times in other nuclear facilities, some residents have contended it is a shortsighted move. They argue repairing components instead of replacing them prioritizes short-term savings over long-term safety. Michigan residents are no strangers to nuclear energy. Historically, these plants have supplied 30% of the electricity generated in-state. While decommissioning projects dropped that figure to 24.9% as of 2024, it is still above the national average of 19.1%. Some people are concerned about what the state’s heightened reliance on this power source means for their well-being. supplied 30% of the electricity supplied 30% of the electricity Why Nuclear Power Plants Persist Despite Potential Risks Three major nuclear accidents have happened in recent years — Three Mile Island in 1979, Chornobyl in 1986, and Fukushima in 2011. Meltdowns are exceedingly rare — hundreds of power plants exist, and almost all never experience such an incident. Moreover, only one has ever occurred on U.S. soil. This sector is generally far safer than the oil and gas industry, which is why some officials are seeking to reopen shuttered plants. Due to heightened demand and an increased reliance on clean power, electricity costs are rising faster than existing energy infrastructure can keep up. While renewables are inexhaustible sources, production is intermittent — considerably less consistent than fossil fuels. Nuclear provides a reliable alternative. electricity costs are rising electricity costs are rising However, almost all progress in this sector was halted after the partial nuclear meltdown in Pennsylvania. Today, most of the country’s reactors are more than four decades old. While a significant number have been closed over the years, including the Palisades plant, the U.S. still has the most operational reactors in the world. more than four decades more than four decades For years, the facilities that remain active have provided enough power. However, as more data centers come online to support the rapidly expanding cloud computing and artificial intelligence markets, many states are finding they are no longer enough. They are faced with a tough decision — they can either build new stations or reopen old ones. The Vogtle plant came online in April 2024. It is the first nuclear reactor built in the U.S. in decades. Despite being operational, many consider its construction a mistake because it was completed seven years late and ran around $17 billion over budget. These time and cost overruns suggest reopening shuttered plants may be the most sensible option moving forward. was completed seven years late was completed seven years late Should Locals Be Concerned About Nuclear Waste? Nuclear waste is a radioactive by-product of electricity generation within reactors. The U.S. has generated approximately 90,000 metric tons to date. It takes years, even decades, to decay, which poses long-term environmental and health problems. While it is typically stored on-site or in specialized underground facilities, cheaper, more dangerous measures are sometimes used. approximately 90,000 metric tons approximately 90,000 metric tons In the 1900s, the government disposed of nuclear waste by dumping it into the ocean. This practice has since stopped, in part because regulations are much more strict. However, some companies have tried similar methods when decommissioning plants. Holtec — the same firm in charge of reopening the Palisades plant — is in charge of shuttering the Pilgrim Nuclear Power Station in Plymouth, Massachusetts. It requested permission to dump 1.1 million gallons of radioactive wastewater into Cape Cod Bay. Holtec argued it would treat the water beforehand, but studies showed the radiation would linger for at least one month. 1.1 million gallons of radioactive wastewater 1.1 million gallons of radioactive wastewater Cape Cod Bay is a protected ocean sanctuary, so officials denied Holtec’s request. However, the attempt still infuriated locals. They would have been exposed to low levels of contamination when swimming or fishing. Given that no dose of radiation is safe, they were right to be concerned with the proposal. Studies Show Living Near a Nuclear Power Plant Is Risky One of the biggest concerns for people living next to nuclear reactors is the possibility of a meltdown. However, these incidents are exceedingly rare. Radiation is a more present risk. Nuclear power harnesses the energy created during nuclear fission. The neutrons released during this process trigger a chain reaction that produces radiation, heat, and radioactive waste products. Although the International Commission on Radiological Protection has established regulatory dose limits, even extremely low-level exposure to ionizing radiation can increase an individual’s risk of developing cancer. The scientific community has accepted the linear no-threshold model, which assumes that no safe dosage exists. While professionals debate the exact effects, they accept the risk as fact. An evaluation of 47 epidemiological studies covering 175 nuclear power plants, 480,623 workers, and 7.5 million residents found evidence of an elevated cancer risk. Workers exposed to levels within regulatory dose limits were 0.85 times less likely to develop acute lymphocytic leukemia but 5.53 times more likely to develop mesothelioma. were 0.85 times less likely were 0.85 times less likely The meta-analysis also found living near a nuclear plant is dangerous. For those within 18.5 miles, exposure of under 1 millisievert per year increases leukemia risk by 9% and thyroid cancer risk by 17%. Notably, the researchers acknowledge these findings may be biased or overestimated because some studies didn’t adjust for cancer risk confounders. However, similar recent studies have similar findings. Research from the International Agency for Research on Cancer found that the mortality rate for leukemiaincreased by around 250% per gray (Gy) radiation dose. While plant workers typically accumulated just 0.016 Gy — and only 13 in 100,000 deaths in the study population were attributable to radiation over a 35-year period — these findings highlight the risks of living near and working in these facilities. increased by around 250% increased by around 250% There Is Always a Non-Zero Chance of a Nuclear Meltdown Since most of the country’s reactors are more than four decades old, stakeholders are pushing for modernization. However, digitalization comes with risks. Cyberattacks on critical infrastructure are on the rise, many of which involve state-sponsored threat actors. Some target nuclear facilities or administrative systems, increasing the risk of a meltdown. more than four decades more than four decades This isn’t a hypothetical. In March 2022, the U.S. Justice Department unsealed criminal indictments against several Russian government agents. They had been charged with spearfishing attacks that compromised the Wolf Creek Nuclear Operating Corp.’s business network in Kansas. They may not have been able to adjust control systems, but their actions proved they could gain access to these stations. charged with spearfishing attacks charged with spearfishing attacks The only way to prevent a cyberattack is to rely on manual methods and systems. However, those make stations prone to human error, which could cause equipment malfunctions. Either way, nearby residents face the possibility of a nuclear meltdown. The risk is extremely low but present. If it came to pass, they’d have to leave their homes or risk a lethal dose of radiation. A Buffer Zone Can Protect People From Radiation Exposure While a nuclear power plant only needs to take up a relatively small area, officials should consider mandating expansive buffer zones. Given that studies show people living within around 18.5 miles of one of these facilities experience higher rates of cancer, it would be wise to give the reactors a wide berth.

Is It Risky to Live Near a Nuclear Power Plant?

Inside the Math Banks Use to Decide If You’re a Credit Risk

AI Literacy Is Now the Law—Ignore It at Your Own Risk

La alfabetización en inteligencia artificial es ahora ley: ignorarla es hacerlo bajo su propio riesgo

A alfabetización da intelixencia artificial é agora a lei: non o faga por conta e risco

AIリテラシーは法律で定められているが、無視すれば自己責任

ឥឡូវនេះអក្ខរកម្ម AI គឺជាច្បាប់—មិនអើពើនឹងហានិភ័យផ្ទាល់ខ្លួនរបស់អ្នក។

AI 리터러시는 이제 법률입니다. 스스로 위험을 감수하고 무시하세요

Literasi AI Kini Menjadi Undang-undang—Abaikan Atas Risiko Anda Sendiri

Kwandika AI Ubu ni Amategeko-Ntiwirengagize ku kaga kawe

Literatura e inteligjencës artificiale është tani ligji - injorojeni atë në rrezikun tuaj

AI Kusoma Kuandika Sasa Ni Sheria—Ipuuze Kwa Hatari Yako Mwenyewe

AI Literacy ሕጂ ሕጊ ኮይኑ ኣሎ- ብናይ ገዛእ ርእስኻ ሓደጋ ሸለል በሎ

AI Literacy Is Now the Law—Balewalain Ito sa Iyong Sariling Panganib

AI خواندگی اب قانون ہے — اسے اپنے خطرے پر نظر انداز کریں۔

Ever been hit with a flood of annoying “last-minute fixes” as a developer? We call this “Scope Creep,” and it’s just one of the many consequences your company might face when risk assessment isn't right. Add security threats, downtime, and data breaches into the mix, and things get worse for your company. An NYSE trading firm called Knight Capital lost $400M in 2012 within five minutes after their developer forgot to deploy a new RLP code to one of its live servers. Such a billion-dollar mistake was avoidable through mitigations like automation or a supervisory review. Situations like this shouldn’t have caught a serious organization like Knight Capital off-guard. The message is simple – risk assessment matters. It requires carrying your team effort (from stakeholders to programmers) to compile worthwhile risks. But the real value lies in how you analyze the impact of these risks and their likelihood of occurring. In this article, I’ll break down the two main methodologies – quantitative and qualitative – and how they'll help you predict, prioritize, and mitigate risks before they turn into disasters. What is a Risk Assessment? Generally, software risk assessment is a disciplined and ongoing process of identifying, analyzing, and prioritizing the impact of potential risks on a project. It’s like a therapy session with everyone involved in a project (including stakeholders and clients), not just for the patient’s benefit. A well-run risk assessment workshop helps you identify the potential shortcomings from each participant's perspective. Then, a QA engineer — or, as some might call them, a professional overthinker, steps in to evaluate the likelihood of each risk, its impact, and how you should prioritize risks. For instance, on the ill-fated RLP project Knight Capital was working on, deployment safeguards or a supervisory review should have been high on their priority list if they knew failure could cost them a billion dollars. And that brings us to the key methods of assessment. Quantitative vs Qualitative Risk Assessment - Is One Any Better? A strong risk assessment requires both methodologies to work together. Don’t fall into the trap of relying solely on a simple risk matrix, like many organizations that take the easy way out with qualitative assessment alone. Quantitative Risk Assessment – The Number Guy’s Favorite Quantitative risk assessment relies on hard data — numbers that measure the likelihood and impact of risks on company assets. If you want to get your management team’s attention, this is the way to do it. With stats showing risk impact on customer records, revenue drops, and potential damage costs, you’ll be speaking their language. The go-to quantitative techniques are mathematical calculations like Monte Carlo simulations and decision tree analysis. In a 2002 Harvard publication, NASA also used a time domain analysis to test the reliability of its space mission system software in different stages. Back then, they used the complex Statistical Modeling & Estimation of Reliability Functions for Software (SMERFS) tool. Today, there are more user-friendly, holistic tools tailored to common software development cycles. For example, BrowserStack lets teams test apps and software on real devices and browsers. Meanwhile, EcoOnline simplifies the process of task-based risk assessment for startups and small businesses—even in high-risk industries like construction and chemicals. No doubt, quantitative assessments require specialized tools and expertise. But the payoff? A clear forecast of when risks might hit and how much they could cost. Uses of Quantitative Analysis Quantitative risk assessment is like the proof in the pudding for a risk management effort, backing up potential risks with numbers. Estimate financial losses. Clear data helps pinpoint the cost of risks, like how a small authentication bug could lead to millions in damages. And it guarantees team members never overlook threatening issues out of ignorance.
You can avoid misplace risk mitigation priorities. Quantified risk assessment can motivate management to invest resources to the biggest threats rather than their best interests. It assists in legal and regulatory compliance. Accurate documentation, including contracts and audit reports, helps industry experts compile the necessary data for compliance assessments and due diligence. Qualitative Risk Assessment – The Expert’s Intuition At a first glance, the qualitative approach seems like guesswork. It relies on an expert’s judgment to analyze identified risks. It is quick and subjective. Qualitative risk assessment prioritizes risks based on worst case scenarios, such as high-low level priority or moderate-severe. However, it’s not set in stone. Managers can get creative with the categorization, like a gen z would tag the worst risk as “god-level.” Remember those frustrating last-minute revisions and feature additions? If your project manager asks for risk input, identify and flag feature creep as high-risk. That way, the product development team gets the memo—perhaps through an L10 meeting, a ClickUp board, or a risk matrix review. Additionally, some risks can’t be measured in numbers. Only expert insight can predict the impact of regulatory changes across industries like AI, healthcare, or finance. Just ask Apple. They had to pay $95 million to settle a class-action lawsuit over privacy concerns regarding newly-released Siri features. Overall, qualitative risk assessment helps teams identify potential issues, determine the assets at risk, gauge their impact, propose solutions, and assign an overall risk rating. Uses of Qualitative Methodology When numbers can’t tell the full story, subjective but trained evaluation helps you to: Analyze hard-to-quantify risks. Issues like potential reputational damage from a data breach or employee burnout are immeasurable but relevant. An experienced executive or manager (hopefully empathetic) can qualify their impact across assets.
Speed up prioritization. Engineering team members can effectively categorize threats to their job from high to low risks. No point in waiting for extensive data analysis in some cases.
Provide a strategic direction – Leadership teams use qualitative assessments to make informed, big-picture decisions, balancing risks and opportunities even when concrete data is unavailable. Wrapping Up Quality risk assessment is an art and science that can turn a good team into a great one. It covers every possible threat to projects before production, helping a company save money across the board. A well-planned process that cuts deployment times and prevents reputational and financial hits to the company. You can’t go wrong with a risk management strategy that combines both risk assessment methodologies. Quantitative methods provide hard data to predict potential losses, while qualitative assessment offers expert opinions on hard-to-quantify risks. With these, you can say goodbye to scope creep, unplanned bug errors, and regulatory issues that disrupt the workflow in most teams. Ever been hit with a flood of annoying “last-minute fixes” as a developer? We call this “Scope Creep,” and it’s just one of the many consequences your company might face when risk assessment isn't right. Add security threats, downtime, and data breaches into the mix, and things get worse for your company. An NYSE trading firm called Knight Capital lost $400M in 2012 within five minutes after their developer forgot to deploy a new RLP code to one of its live servers. Such a billion-dollar mistake was avoidable through mitigations like automation or a supervisory review. Situations like this shouldn’t have caught a serious organization like Knight Capital off-guard. $400M The message is simple – risk assessment matters. It requires carrying your team effort (from stakeholders to programmers) to compile worthwhile risks. But the real value lies in how you analyze the impact of these risks and their likelihood of occurring. In this article, I’ll break down the two main methodologies – quantitative and qualitative – and how they'll help you predict, prioritize, and mitigate risks before they turn into disasters. What is a Risk Assessment? Generally, software risk assessment is a disciplined and ongoing process of identifying, analyzing, and prioritizing the impact of potential risks on a project. It’s like a therapy session with everyone involved in a project (including stakeholders and clients), not just for the patient’s benefit. A well-run risk assessment workshop helps you identify the potential shortcomings from each participant's perspective. Then, a QA engineer — or, as some might call them, a professional overthinker, steps in to evaluate the likelihood of each risk, its impact, and how you should prioritize risks. For instance, on the ill-fated RLP project Knight Capital was working on, deployment safeguards or a supervisory review should have been high on their priority list if they knew failure could cost them a billion dollars. And that brings us to the key methods of assessment. Quantitative vs Qualitative Risk Assessment - Is One Any Better? A strong risk assessment requires both methodologies to work together. Don’t fall into the trap of relying solely on a simple risk matrix, like many organizations that take the easy way out with qualitative assessment alone. Quantitative Risk Assessment – The Number Guy’s Favorite Quantitative risk assessment relies on hard data — numbers that measure the likelihood and impact of risks on company assets. If you want to get your management team’s attention, this is the way to do it. With stats showing risk impact on customer records, revenue drops, and potential damage costs, you’ll be speaking their language. The go-to quantitative techniques are mathematical calculations like Monte Carlo simulations and decision tree analysis. In a 2002 Harvard publication , NASA also used a time domain analysis to test the reliability of its space mission system software in different stages. Back then, they used the complex Statistical Modeling & Estimation of Reliability Functions for Software (SMERFS) tool. Today, there are more user-friendly, holistic tools tailored to common software development cycles. 2002 Harvard publication For example, BrowserStack lets teams test apps and software on real devices and browsers. Meanwhile, EcoOnline simplifies the process of task-based risk assessment for startups and small businesses—even in high-risk industries like construction and chemicals. No doubt, quantitative assessments require specialized tools and expertise. But the payoff? A clear forecast of when risks might hit and how much they could cost. Uses of Quantitative Analysis Quantitative risk assessment is like the proof in the pudding for a risk management effort, backing up potential risks with numbers. Estimate financial losses. Clear data helps pinpoint the cost of risks, like how a small authentication bug could lead to millions in damages. And it guarantees team members never overlook threatening issues out of ignorance. You can avoid misplace risk mitigation priorities. Quantified risk assessment can motivate management to invest resources to the biggest threats rather than their best interests. Estimate financial losses. Clear data helps pinpoint the cost of risks, like how a small authentication bug could lead to millions in damages. And it guarantees team members never overlook threatening issues out of ignorance. You can avoid misplace risk mitigation priorities. Quantified risk assessment can motivate management to invest resources to the biggest threats rather than their best interests. It assists in legal and regulatory compliance. Accurate documentation, including contracts and audit reports, helps industry experts compile the necessary data for compliance assessments and due diligence. Qualitative Risk Assessment – The Expert’s Intuition At a first glance, the qualitative approach seems like guesswork. It relies on an expert’s judgment to analyze identified risks. It is quick and subjective. Qualitative risk assessment prioritizes risks based on worst case scenarios, such as high-low level priority or moderate-severe. However, it’s not set in stone. Managers can get creative with the categorization, like a gen z would tag the worst risk as “god-level.” Remember those frustrating last-minute revisions and feature additions? If your project manager asks for risk input, identify and flag feature creep as high-risk. That way, the product development team gets the memo—perhaps through an L10 meeting, a ClickUp board, or a risk matrix review. Additionally, some risks can’t be measured in numbers. Only expert insight can predict the impact of regulatory changes across industries like AI, healthcare, or finance. Just ask Apple. They had to pay $95 million to settle a class-action lawsuit over privacy concerns regarding newly-released Siri features. $95 million to settle a class-action lawsuit Overall, qualitative risk assessment helps teams identify potential issues, determine the assets at risk, gauge their impact, propose solutions, and assign an overall risk rating. Uses of Qualitative Methodology When numbers can’t tell the full story, subjective but trained evaluation helps you to: Analyze hard-to-quantify risks. Issues like potential reputational damage from a data breach or employee burnout are immeasurable but relevant. An experienced executive or manager (hopefully empathetic) can qualify their impact across assets. Speed up prioritization. Engineering team members can effectively categorize threats to their job from high to low risks. No point in waiting for extensive data analysis in some cases. Provide a strategic direction – Leadership teams use qualitative assessments to make informed, big-picture decisions, balancing risks and opportunities even when concrete data is unavailable. Analyze hard-to-quantify risks. Issues like potential reputational damage from a data breach or employee burnout are immeasurable but relevant. An experienced executive or manager (hopefully empathetic) can qualify their impact across assets. Speed up prioritization. Engineering team members can effectively categorize threats to their job from high to low risks. No point in waiting for extensive data analysis in some cases. Provide a strategic direction – Leadership teams use qualitative assessments to make informed, big-picture decisions, balancing risks and opportunities even when concrete data is unavailable. Wrapping Up Quality risk assessment is an art and science that can turn a good team into a great one. It covers every possible threat to projects before production, helping a company save money across the board. A well-planned process that cuts deployment times and prevents reputational and financial hits to the company. You can’t go wrong with a risk management strategy that combines both risk assessment methodologies. Quantitative methods provide hard data to predict potential losses, while qualitative assessment offers expert opinions on hard-to-quantify risks. With these, you can say goodbye to scope creep, unplanned bug errors, and regulatory issues that disrupt the workflow in most teams.

How a Five-Minute Mistake Cost $400M—And Why Risk Assessment Could Save Your Company

President Trump recently announced he plans to hold talks with Putin to end the Ukraine conflict. Trump’s recent moves have caught European leaders by surprise, who now fear they could be bypassed in any potential peace talks. Besides the security concerns, the Ukraine conflict has a massive economic impact on Europe. In this article, we will discuss how Trump’s recent moves could impact Europe’s economy including its crypto tax policies and make review of existing EU capital gain tax for individuals. The two most important events of the Munich Conference were the speeches by US Vice President Vance and European Commission President Ursula von der Leyen. And despite all the differences in their positions, both said a lot about EU security spending. In fact the EU will need to pay social benefits in upcoming years, as well as raise defense spending. After a recent informal retreat in Brussels in early February, EU leaders decided they need to invest around 500 billion euros in the next decade for defense. EU Position During the recent Munich conference, European Commission chief Ursula von der Leyen stated that she would propose the activation of an escape clause for the EU’s fiscal rule to boost member defense spending. EU countries collectively spend around 2% of GDP on defense, with the figure rising to 320 billion euros in 2024 compared to 200 billion euros before. Ursula proposed to increase that figure to 3%, which would lead to hundreds of billions more on defense spending, necessitating the change in EU members' economic policy. Several countries have also called for the issuance of Eurobonds to fund increased defense spending. Overall, any increase in defense spending would likely be debt-financed, which would mean a substantial increase in taxes, impacting all financial sectors, including the crypto industry. According to the European Parliament, the EU economic recovery after the 2019 pandemic was negatively impacted by the Ukraine conflict. In 2022 alone, the budgetary impact was an additional 175 billion euros, accounting for around 1.1% to 1.4% of the EU GDP. One of the immediate impacts was a rise in energy prices, which led to increased inflation. To lower the inflation, the ECB began raising interest rates. While there has been some recovery, including rate cuts by the ECB, the EU economy is still in a difficult situation. With Europe planning to increase defense spending, there is a strong chance that higher taxes will be imposed on EU crypto companies and net-worth individuals. Below is a deep dive into existing EU crypto tax landscape. EU Tax Hells for Crypto Here is a short summary of some of the highest crypto taxes in the EU. Netherlands In the Netherlands, there is a 36% tax on the presumed yield from crypto holdings from the previous year. Denmark In Denmark, crypto income is taxed under four levels, which are National income tax at 12.1% to 15%, Municipal tax at 24.982%, Labour market tax at 8%, and Church tax at an average of 0.7%. Combined, the effective tax rate is 37%. Finland Finland has complex crypto tax rules, which includes a 30% tax on all total sales above 1000 euros, and below 30,000 euros. For Any additional sales, you pay a 32.4% tax. Ireland Ireland has 33% сapital gain tax (flat rate). Germany For short-term crypto trading Germany has 45% tax rate. What is the middle level of EU crypto tax? For large European economies, such a tax rate is already in the range between 20-30%. In France there is a 30% capital gains tax on crypto, Italy and Spain have 26% capital gain tax on crypto profits. Also in Austria, it’s 27,5%, Belgium - 25%. EU Crypto Tax Havens Crypto tax regulation for individuals is quite liberal in some EU countries, with the lowest taxes imposed on selling crypto. When it comes to capital tax, four EU countries stand out, but in reality there are many more. Here is brief overview of these tax havens: Cyprus Cyprus, which is traditionally known to be a tax haven, is great for the crypto industry for businesses and individuals. The country offers an option for individual long-term holders to pay 0% tax and 20% for short-term operations. Romania In Romania, there is a temporary tax amnesty for all crypto investments until July 31, 2025. Germany In Germany, there is no capital gains tax for long term holders of crypto. Czech Republic In the Czech Republic, there is no capital gains tax for three-year holders of crypto. Other Jurisdictions Poland with its positive approach to crypto has 19% tax. Greece and Bulgaria have 15% tax rate for individual crypto income. Also Luxembourg and Portugal (1 year holding) exempt long-term holders from capital gain tax. Among European countries, Malta and Andorra also have low capital tax rates. EU Bitcoin Reserve During a press conference on January 30, 2025, ECB president Christine Lagarde nixed the idea of adding Bitcoin to the EU’s reserves. She noted that Bitcoin was too volatile, and had a close association with money laundering. Despite this statement, some EU countries have been considering the idea of adding Bitcoin to their reserves, below are some of them. Norway Norway’s sovereign wealth fund, which manages over $1.5 trillion in funds, has huge indirect Bitcoin exposure. The Norges Bank Investment Management (NBIM) owns over $600 million worth of MicroStrategy shares. Czech Republic While the Czech Republic is not part of the eurozone, it is part of the ECB General Council. The governor of the central bank, Aleš Michl has acknowledged the volatility of Bitcoin while discussing its potential addition to the central bank’s holdings. Recently, the Czech central bank confirmed it had analyzed the addition of new asset classes to its reserve. However, it does not plan to take action until the analysis is complete. The push comes amid the Trump administration’s overtures into creating a Bitcoin reserve. It has clarified that such a reserve would be created from asset seizures, and not from purchases of Bitcoin. Thus far, Texas and Utah have introduced legislation to include Bitcoin in their treasuries. In Utah, a vote was passed in favor, while in Texas, there are two pending bills. \ European central banks will likely add crypto to their holdings in coming months, especially if the Trump administration goes ahead with its plans. However, this will not lead to a drop in the effective tax rate for crypto investors. The increase in the value of crypto due to this move could lead to more taxes as central banks seek to increase their holdings. With Trump seeking to tighten the screws on the trade imbalance between the EU and America, it could deepen the economic difficulties in Europe, leading to new avenues being considered for taxation, including crypto. Besides the US, economic ties with Russia, and China, have worsened, which could translate into increased taxation for EU citizens. The potential outcome would be that crypto investors would move to friendlier countries. Possible Scenario At the same time, high taxes in the above-mentioned EU member countries will be ineffective if tax breaks are maintained and if military spending increases, there is a possibility of unification of the tax policies of the member countries. But even if this does not happen, the main donor countries of the EU military budget will be forced to look for additional sources of income. And raise taxes even more. In this sense, I would call such European countries as Germany, France, Poland, Italy, Spain and Netherlands looking especially risky. Moreover, such measures may be extended to income from capital and financial transactions in general. And this is indeed likely, since governments do not have many sources of income. Even if such measures are introduced gradually, so as not to frighten investors too much, they will still hurt the Eurozone economy. From the point of view of the interests of the European Union, supporting innovation and capital inflow, including the crypto industry, is an absolute benefit for member countries, but in a situation of crisis and increased military spending, the EU countries have less room for choice. President Trump recently announced he plans to hold talks with Putin to end the Ukraine conflict. Trump’s recent moves have caught European leaders by surprise, who now fear they could be bypassed in any potential peace talks. Besides the security concerns, the Ukraine conflict has a massive economic impact on Europe. In this article, we will discuss how Trump’s recent moves could impact Europe’s economy including its crypto tax policies and make review of existing EU capital gain tax for individuals. President Trump recently announced he plans to hold talks with Putin to end the Ukraine conflict. Trump’s recent moves have caught European leaders by surprise, who now fear they could be bypassed in any potential peace talks. Besides the security concerns, the Ukraine conflict has a massive economic impact on Europe. In this article, we will discuss how Trump’s recent moves could impact Europe’s economy including its crypto tax policies and make review of existing EU capital gain tax for individuals. The two most important events of the Munich Conference were the speeches by US Vice President Vance and European Commission President Ursula von der Leyen. And despite all the differences in their positions, both said a lot about EU security spending. In fact the EU will need to pay social benefits in upcoming years, as well as raise defense spending. After a recent informal retreat in Brussels in early February, EU leaders decided they need to invest around 500 billion euros in the next decade for defense. EU Position During the recent Munich conference, European Commission chief Ursula von der Leyen stated that she would propose the activation of an escape clause for the EU’s fiscal rule to boost member defense spending. EU countries collectively spend around 2% of GDP on defense, with the figure rising to 320 billion euros in 2024 compared to 200 billion euros before. Ursula proposed to increase that figure to 3%, which would lead to hundreds of billions more on defense spending, necessitating the change in EU members' economic policy. Several countries have also called for the issuance of Eurobonds to fund increased defense spending. Overall, any increase in defense spending would likely be debt-financed, which would mean a substantial increase in taxes, impacting all financial sectors, including the crypto industry. According to the European Parliament, the EU economic recovery after the 2019 pandemic was negatively impacted by the Ukraine conflict. In 2022 alone, the budgetary impact was an additional 175 billion euros, accounting for around 1.1% to 1.4% of the EU GDP. One of the immediate impacts was a rise in energy prices, which led to increased inflation. To lower the inflation, the ECB began raising interest rates. While there has been some recovery, including rate cuts by the ECB, the EU economy is still in a difficult situation. With Europe planning to increase defense spending, there is a strong chance that higher taxes will be imposed on EU crypto companies and net-worth individuals. Below is a deep dive into existing EU crypto tax landscape. EU Tax Hells for Crypto EU Tax Hells for Crypto Here is a short summary of some of the highest crypto taxes in the EU. Netherlands In the Netherlands, there is a 36% tax on the presumed yield from crypto holdings from the previous year. Denmark In Denmark, crypto income is taxed under four levels, which are National income tax at 12.1% to 15%, Municipal tax at 24.982%, Labour market tax at 8%, and Church tax at an average of 0.7%. Combined, the effective tax rate is 37%. Finland Finland has complex crypto tax rules, which includes a 30% tax on all total sales above 1000 euros, and below 30,000 euros. For Any additional sales, you pay a 32.4% tax. Ireland Ireland has 33% сapital gain tax (flat rate). Germany For short-term crypto trading Germany has 45% tax rate. What is the middle level of EU crypto tax? For large European economies, such a tax rate is already in the range between 20-30%. In France there is a 30% capital gains tax on crypto, Italy and Spain have 26% capital gain tax on crypto profits. Also in Austria, it’s 27,5%, Belgium - 25%. EU Crypto Tax Havens EU Crypto Tax Havens Crypto tax regulation for individuals is quite liberal in some EU countries, with the lowest taxes imposed on selling crypto. When it comes to capital tax, four EU countries stand out, but in reality there are many more. Here is brief overview of these tax havens: Cyprus Cyprus Cyprus, which is traditionally known to be a tax haven, is great for the crypto industry for businesses and individuals. The country offers an option for individual long-term holders to pay 0% tax and 20% for short-term operations. Romania In Romania, there is a temporary tax amnesty for all crypto investments until July 31, 2025. Germany In Germany, there is no capital gains tax for long term holders of crypto. Czech Republic In the Czech Republic, there is no capital gains tax for three-year holders of crypto. Other Jurisdictions Poland with its positive approach to crypto has 19% tax. Greece and Bulgaria have 15% tax rate for individual crypto income. Also Luxembourg and Portugal (1 year holding) exempt long-term holders from capital gain tax. Among European countries, Malta and Andorra also have low capital tax rates. EU Bitcoin Reserve EU Bitcoin Reserve During a press conference on January 30, 2025, ECB president Christine Lagarde nixed the idea of adding Bitcoin to the EU’s reserves. She noted that Bitcoin was too volatile, and had a close association with money laundering. Despite this statement, some EU countries have been considering the idea of adding Bitcoin to their reserves, below are some of them. Norway Norway Norway’s sovereign wealth fund, which manages over $1.5 trillion in funds, has huge indirect Bitcoin exposure. The Norges Bank Investment Management (NBIM) owns over $600 million worth of MicroStrategy shares. Czech Republic Czech Republic While the Czech Republic is not part of the eurozone, it is part of the ECB General Council. The governor of the central bank, Aleš Michl has acknowledged the volatility of Bitcoin while discussing its potential addition to the central bank’s holdings. Recently, the Czech central bank confirmed it had analyzed the addition of new asset classes to its reserve. However, it does not plan to take action until the analysis is complete. The push comes amid the Trump administration’s overtures into creating a Bitcoin reserve. It has clarified that such a reserve would be created from asset seizures, and not from purchases of Bitcoin. Thus far, Texas and Utah have introduced legislation to include Bitcoin in their treasuries. In Utah, a vote was passed in favor, while in Texas, there are two pending bills. \ European central banks will likely add crypto to their holdings in coming months, especially if the Trump administration goes ahead with its plans. However, this will not lead to a drop in the effective tax rate for crypto investors. The increase in the value of crypto due to this move could lead to more taxes as central banks seek to increase their holdings. With Trump seeking to tighten the screws on the trade imbalance between the EU and America, it could deepen the economic difficulties in Europe, leading to new avenues being considered for taxation, including crypto. Besides the US, economic ties with Russia, and China, have worsened, which could translate into increased taxation for EU citizens. The potential outcome would be that crypto investors would move to friendlier countries. Possible Scenario Possible Scenario At the same time, high taxes in the above-mentioned EU member countries will be ineffective if tax breaks are maintained and if military spending increases, there is a possibility of unification of the tax policies of the member countries. But even if this does not happen, the main donor countries of the EU military budget will be forced to look for additional sources of income. And raise taxes even more. In this sense, I would call such European countries as Germany, France, Poland, Italy, Spain and Netherlands looking especially risky. Moreover, such measures may be extended to income from capital and financial transactions in general. And this is indeed likely, since governments do not have many sources of income. Even if such measures are introduced gradually, so as not to frighten investors too much, they will still hurt the Eurozone economy. From the point of view of the interests of the European Union, supporting innovation and capital inflow, including the crypto industry, is an absolute benefit for member countries, but in a situation of crisis and increased military spending, the EU countries have less room for choice.

Will the EU’s Defense Spending Boom Put Crypto Gains at Risk?

هل يؤدي ارتفاع الإنفاق الدفاعي في الاتحاد الأوروبي إلى تعريض مكاسب العملات المشفرة للخطر؟

L'auge de la despesa en defensa de la UE posarà en risc els guanys criptogràfics?

¿El auge del gasto de defensa de la UE pondrá en riesgo las ganancias de las criptomonedas?

Asettaako EU:n puolustusmenojen puomi salausvoitot vaaraan?

Hoće li procvat potrošnje EU-a na obranu ugroziti dobitak od kripto?

Èske boom Depans Defans Inyon Ewopeyen an pral mete pwogrè Crypto an risk?

EUの防衛費の急増は暗号通貨の利益を危険にさらすか？

Czy gwałtowny wzrost wydatków na obronę w UE zagrozi zyskom kryptowalut?

Поставит ли рост расходов ЕС на оборону под угрозу доходы от криптовалют?

Да ли ће бум потрошње ЕУ за одбрану довести у опасност добитке од криптовалута?

Xana Ku Andza Ka Ku Tirhisa Mali Ya Vusirheleri Ka EU Ku Ta Veka Ku Vuyeriwa Ka Crypto ekhombyeni?

欧盟国防开支激增是否会危及加密货币收益？

More Yield, More Problems: The Restaking Risks You Can't Afford to Ignore

هل يستحق العائد الإضافي بنسبة 0.05% حقًا المخاطرة بوضع عملتك المشفرة في محفظتك؟

০.০৫% অতিরিক্ত ফলন কি সত্যিই আপনার ক্রিপ্টো বাজি ধরার ঝুঁকির যোগ্য?

¿Realmente vale la pena correr el riesgo de apostar sus criptomonedas por ese rendimiento adicional del 0,05 %?

क्या 0.05% अतिरिक्त लाभ वास्तव में आपके क्रिप्टो को दांव पर लगाने के जोखिम के लायक है?

Արդյո՞ք այդ 0,05% հավելյալ եկամտաբերությունը իսկապես արժե ձեր կրիպտո վտանգը դնելու համար:

0.05% の追加利回りは本当に暗号通貨をステーキングするリスクに見合う価値があるのでしょうか?

Adakah Hasil Tambahan 0.05% Itu Benar-Benar Berbaloi dengan Risiko Mengambil Kripto Anda?

के त्यो ०.०५% अतिरिक्त उपज साँच्चै तपाईंको क्रिप्टो दांव लगाउने जोखिमको लायक छ?

Na Poelo Yeo ya 0.05% e Eketsegilego e Ruri e Swanelega Kotsi ya go Bea Crypto ya Gago Bekeng?

Naozaj stojí tých 0,05 % výnosu navyše za riziko stávkovania vašich kryptomien?

Iyo 0.05% Yekuwedzera Goho Inonyatso Kukodzera Njodzi Yekudzvanya Crypto Yako?

Je, Mavuno ya Ziada ya 0.05% yanastahili Hatari ya Kuweka Crypto yako?

Authors:
(1) Jorge Francisco Garcia-Samartın, Centro de Automatica y Robotica (UPM-CSIC), Universidad Politecnica de Madrid — Consejo Superior de Investigaciones Cientıficas, Jose Gutierrez Abascal 2, 28006 Madrid, Spain (jorge.gsamartin@upm.es);
(2) Adrian Rieker, Centro de Automatica y Robotica (UPM-CSIC), Universidad Politecnica de Madrid — Consejo Superior de Investigaciones Cientıficas, Jose Gutierrez Abascal 2, 28006 Madrid, Spain;
(3) Antonio Barrientos, Centro de Automatica y Robotica (UPM-CSIC), Universidad Politecnica de Madrid — Consejo Superior de Investigaciones Cientıficas, Jose Gutierrez Abascal 2, 28006 Madrid, Spain. Table of Links Abstract and 1 Introduction 2 Related Works 2.1 Pneumatic Actuation 2.2 Pneumatic Arms 2.3 Control of Soft Robots 3 PAUL: Design and Manufacturing 3.1 Robot Design 3.2 Material Selection 3.3 Manufacturing 3.4 Actuation Bank 4 Data Acquisition and Open-Loop Control 4.1 Hardware Setup 4.2 Vision Capture System 4.3 Dataset Generation: Table-Based Models 4.4 Open-Loop Control 5 Results 5.1 Final PAUL version 5.2 Workspace Analysis 5.3 Performance of the Table-Based Models 5.4 Bending Experiments 5.5 Weight Carrying Experiments 6 Conclusions Funding Information A. Conducted Experiments and References 2 Related Works 2.1 Pneumatic Actuation There are numerous possibilities for designing and constructing pneumatic actuators. As is common in soft robotics, bio-inspired actuators exist. In [21], an actuator is presented that combines both pneumatics and tendons to mimic and attempts to mimic the behaviour of an octopus arm. Similar in final operation, although inspired by the human finger, can be considered the work of [22]. This consists of three one-dimensional valves that swell, thus mimicking the movement of the phalanges. Nevertheless, the most common bio-inspired pneumatic actuators are Pneumatic Artificial Muscles (PAMs). They are based on achieving extension or contraction of a pneumatic chamber, similar to that of a muscle. The walls of the chamber are usually made of a very thin and flexible membrane, which facilitates large deformations with little air flow introduced [23]. Although some actuators lengthen longitudinally upon inflation [24], the prevalent approach involves utilising McKibben muscles, consisting of a bladder inserted into a braided mesh that constrains the movement of the bladder as it inflates, producing a contraction of the whole [25]. An arm of two PAM segments is designed and modelled in [26]. Another alternative that has gained particular importance in recent years is the Pneunet-type actuators, firstly introduced in [27]. Manipulators that use this type of action consist of a finned beam type structure and, in some cases, some material of varying stiffness. It has been widely used for grippers [28, 29], soft gloves [30] and for modelling human body parts [31]. Different authors have proposed evolutions to this structure. An optimisation of the geometry is carried out at [32], whereas [33] presents PneuFlex actuator, which has evolved the Pneunet concept by making the beam have a variable cross-section. On the other hand, the works of [34] and [35] show how it is possible to design pneumatic segments based on this actuator with bidirectional bending. Jamming, initially used for soft grippers [36] can also be used to create manipulators in the form of beams [37]. Their function is the reverse of that of Pneunets: in their natural state they are bent and, when negative pressure is applied, they stiffen. In [38], a TPU-printed segment at which pressure or vacuum can be applied, is introduced. 2.2 Pneumatic Arms In addition to the design of actuators, pneumatic soft robotics has to face the challenge of their integration for the construction of arms with various degrees of freedom. While some of the previous work, such as [26], does form small arms, several alternatives have been developed for the construction of manipulators. A first option are hybrid approaches, in which both rigid and purely soft elements are combined, which makes it possible to obtain a relatively stable mechanism in a simple way. An example of this can be found in the work [39], in which antagonistically actuated PAM pairs are used to move a rigid beam arm with seven degrees of freedom. A very similar procedure is followed in [40]. To prevent the robot from causing harm to humans, inflatable sleeves are added to the arm. In [41], a pneumatic segment with rigid bases is developed. This consists of six tubes which, due to their geometry, when inflated in groups of three, allow the assembly to rotate on the axis perpendicular to the bases. Although a whole robotic arm is not developed as such, but only a segment of one degree of freedom, it is integrated into an entirely soft robotic arm. The same authors had previously developed a six-degree-of-freedom robotic arm from 85 cm-long segments, capable of lifting loads of up to 3 kg [42]. The work of [43], on the other hand, presents an origami robotic arm made of TPU. This is inflated and deflated by pneumatic actuation, but its position is controlled by tendons which, while slowing down the system, make it much more precise. Among 3D printed robots, [44] presents a three-degree-of-freedom segment, whose movement is achieved by inflating or deflating one or more of its three pneumatic tubes. It also has cables that play the role of antagonist and stiffen the movements of the manipulator. Its working principle is very similar to that of the work of [1]. Also based on the philosophy of printable and deployable robots, [45, 46] present a Honeycomb Pneumatic Network (HPN) arm. It has been constructed by concatenating TPU honeycomb structures, each with an airbag inside. Several prototypes are presented in the paper, one of which can reach a length of 600 mm after joining four segments together. While several of its advantages are discussed, it presents the problem that its weight, without being exaggerated, is high: the arm, considering all the tubes, weighs 4.4 kg. The robot of [47] consists of two segments, each with three pneumatic tubes. Although this theoretically gives it six degrees of freedom, the controllers are only responsible for the upper module, which does not allow all positions and orientations to be freely fixed. The STIFF-FLOP manipulator was introduced in [48]. This consists of an elastomeric cylinder with a series of pneumatic chambers inside, the inflation and deflation of which causes deformation of the cylinder and therefore movement of the robot. Various iterations of this design exist, such as the STIFF-FLOP segment with stiffening tendons demonstrated in [31]. In this line, SoPrA, presented in [49], is made combining three fibre-reinforced silicone segments, each shaped like a conical trunk, so that the end of the robot is much narrower than the base. Although the truncated cone shape is advantageous because, as the authors point out, the upper segments require more torque and hold more tubes inside them, the manufacturing process used to achieve the taper prevents new segments from being easily added to the robot. In [50], a 3-segment arm is built using silicone rubber. Each segment is 110 mm long, has a diameter of 45 mm and, contrary to traditional STIFF-FLOP structure, it is equipped with four inflatable cavities. This implies an increase of weight and difficulty of control, as redundancy is increased compared to having only three degrees of freedom per segment. This paper is available on arxiv under CC BY-NC-SA 4.0 DEED license. Authors: (1) Jorge Francisco Garcia-Samartın, Centro de Automatica y Robotica (UPM-CSIC), Universidad Politecnica de Madrid — Consejo Superior de Investigaciones Cientıficas, Jose Gutierrez Abascal 2, 28006 Madrid, Spain (jorge.gsamartin@upm.es); (2) Adrian Rieker, Centro de Automatica y Robotica (UPM-CSIC), Universidad Politecnica de Madrid — Consejo Superior de Investigaciones Cientıficas, Jose Gutierrez Abascal 2, 28006 Madrid, Spain; (3) Antonio Barrientos, Centro de Automatica y Robotica (UPM-CSIC), Universidad Politecnica de Madrid — Consejo Superior de Investigaciones Cientıficas, Jose Gutierrez Abascal 2, 28006 Madrid, Spain. Authors: Authors: (1) Jorge Francisco Garcia-Samartın, Centro de Automatica y Robotica (UPM-CSIC), Universidad Politecnica de Madrid — Consejo Superior de Investigaciones Cientıficas, Jose Gutierrez Abascal 2, 28006 Madrid, Spain (jorge.gsamartin@upm.es); (2) Adrian Rieker, Centro de Automatica y Robotica (UPM-CSIC), Universidad Politecnica de Madrid — Consejo Superior de Investigaciones Cientıficas, Jose Gutierrez Abascal 2, 28006 Madrid, Spain; (3) Antonio Barrientos, Centro de Automatica y Robotica (UPM-CSIC), Universidad Politecnica de Madrid — Consejo Superior de Investigaciones Cientıficas, Jose Gutierrez Abascal 2, 28006 Madrid, Spain. Table of Links Abstract and 1 Introduction Abstract and 1 Introduction 2 Related Works 2.1 Pneumatic Actuation 2.1 Pneumatic Actuation 2.2 Pneumatic Arms 2.2 Pneumatic Arms 2.3 Control of Soft Robots 2.3 Control of Soft Robots 3 PAUL: Design and Manufacturing 3.1 Robot Design 3.1 Robot Design 3.2 Material Selection 3.2 Material Selection 3.3 Manufacturing 3.3 Manufacturing 3.4 Actuation Bank 3.4 Actuation Bank 4 Data Acquisition and Open-Loop Control 4.1 Hardware Setup 4.1 Hardware Setup 4.2 Vision Capture System 4.2 Vision Capture System 4.3 Dataset Generation: Table-Based Models 4.3 Dataset Generation: Table-Based Models 4.4 Open-Loop Control 4.4 Open-Loop Control 5 Results 5.1 Final PAUL version 5.1 Final PAUL version 5.2 Workspace Analysis 5.2 Workspace Analysis 5.3 Performance of the Table-Based Models 5.3 Performance of the Table-Based Models 5.4 Bending Experiments 5.4 Bending Experiments 5.5 Weight Carrying Experiments 5.5 Weight Carrying Experiments 6 Conclusions 6 Conclusions Funding Information Funding Information A. Conducted Experiments and References A. Conducted Experiments and References 2 Related Works 2.1 Pneumatic Actuation There are numerous possibilities for designing and constructing pneumatic actuators. As is common in soft robotics, bio-inspired actuators exist. In [21], an actuator is presented that combines both pneumatics and tendons to mimic and attempts to mimic the behaviour of an octopus arm. Similar in final operation, although inspired by the human finger, can be considered the work of [22]. This consists of three one-dimensional valves that swell, thus mimicking the movement of the phalanges. Nevertheless, the most common bio-inspired pneumatic actuators are Pneumatic Artificial Muscles (PAMs). They are based on achieving extension or contraction of a pneumatic chamber, similar to that of a muscle. The walls of the chamber are usually made of a very thin and flexible membrane, which facilitates large deformations with little air flow introduced [23]. Although some actuators lengthen longitudinally upon inflation [24], the prevalent approach involves utilising McKibben muscles, consisting of a bladder inserted into a braided mesh that constrains the movement of the bladder as it inflates, producing a contraction of the whole [25]. An arm of two PAM segments is designed and modelled in [26]. Another alternative that has gained particular importance in recent years is the Pneunet-type actuators, firstly introduced in [27]. Manipulators that use this type of action consist of a finned beam type structure and, in some cases, some material of varying stiffness. It has been widely used for grippers [28, 29], soft gloves [30] and for modelling human body parts [31]. Different authors have proposed evolutions to this structure. An optimisation of the geometry is carried out at [32], whereas [33] presents PneuFlex actuator, which has evolved the Pneunet concept by making the beam have a variable cross-section. On the other hand, the works of [34] and [35] show how it is possible to design pneumatic segments based on this actuator with bidirectional bending. Jamming, initially used for soft grippers [36] can also be used to create manipulators in the form of beams [37]. Their function is the reverse of that of Pneunets: in their natural state they are bent and, when negative pressure is applied, they stiffen. In [38], a TPU-printed segment at which pressure or vacuum can be applied, is introduced. 2.2 Pneumatic Arms In addition to the design of actuators, pneumatic soft robotics has to face the challenge of their integration for the construction of arms with various degrees of freedom. While some of the previous work, such as [26], does form small arms, several alternatives have been developed for the construction of manipulators. A first option are hybrid approaches, in which both rigid and purely soft elements are combined, which makes it possible to obtain a relatively stable mechanism in a simple way. An example of this can be found in the work [39], in which antagonistically actuated PAM pairs are used to move a rigid beam arm with seven degrees of freedom. A very similar procedure is followed in [40]. To prevent the robot from causing harm to humans, inflatable sleeves are added to the arm. In [41], a pneumatic segment with rigid bases is developed. This consists of six tubes which, due to their geometry, when inflated in groups of three, allow the assembly to rotate on the axis perpendicular to the bases. Although a whole robotic arm is not developed as such, but only a segment of one degree of freedom, it is integrated into an entirely soft robotic arm. The same authors had previously developed a six-degree-of-freedom robotic arm from 85 cm-long segments, capable of lifting loads of up to 3 kg [42]. The work of [43], on the other hand, presents an origami robotic arm made of TPU. This is inflated and deflated by pneumatic actuation, but its position is controlled by tendons which, while slowing down the system, make it much more precise. Among 3D printed robots, [44] presents a three-degree-of-freedom segment, whose movement is achieved by inflating or deflating one or more of its three pneumatic tubes. It also has cables that play the role of antagonist and stiffen the movements of the manipulator. Its working principle is very similar to that of the work of [1]. Also based on the philosophy of printable and deployable robots, [45, 46] present a Honeycomb Pneumatic Network (HPN) arm. It has been constructed by concatenating TPU honeycomb structures, each with an airbag inside. Several prototypes are presented in the paper, one of which can reach a length of 600 mm after joining four segments together. While several of its advantages are discussed, it presents the problem that its weight, without being exaggerated, is high: the arm, considering all the tubes, weighs 4.4 kg. The robot of [47] consists of two segments, each with three pneumatic tubes. Although this theoretically gives it six degrees of freedom, the controllers are only responsible for the upper module, which does not allow all positions and orientations to be freely fixed. The STIFF-FLOP manipulator was introduced in [48]. This consists of an elastomeric cylinder with a series of pneumatic chambers inside, the inflation and deflation of which causes deformation of the cylinder and therefore movement of the robot. Various iterations of this design exist, such as the STIFF-FLOP segment with stiffening tendons demonstrated in [31]. In this line, SoPrA, presented in [49], is made combining three fibre-reinforced silicone segments, each shaped like a conical trunk, so that the end of the robot is much narrower than the base. Although the truncated cone shape is advantageous because, as the authors point out, the upper segments require more torque and hold more tubes inside them, the manufacturing process used to achieve the taper prevents new segments from being easily added to the robot. In [50], a 3-segment arm is built using silicone rubber. Each segment is 110 mm long, has a diameter of 45 mm and, contrary to traditional STIFF-FLOP structure, it is equipped with four inflatable cavities. This implies an increase of weight and difficulty of control, as redundancy is increased compared to having only three degrees of freedom per segment. This paper is available on arxiv under CC BY-NC-SA 4.0 DEED license. This paper is available on arxiv under CC BY-NC-SA 4.0 DEED license. available on arxiv

Soft, Squeezable, and Smarter Than Ever: The Rise of Pneumatic Robots

Meko, stisljivo i pametnije nego ikad: Uspon pneumatskih robota

Měkké, stlačitelné a chytřejší než kdy jindy: Vzestup pneumatických robotů

Suaves, flexibles y más inteligentes que nunca: el auge de los robots neumáticos

नरम, दबाने योग्य और पहले से कहीं अधिक स्मार्ट: न्यूमेटिक रोबोट का उदय

柔らかく、握りやすく、かつてないほどスマート：空気圧ロボットの台頭

Меки, стискачки и попаметни од кога било: Подемот на пневматските роботи

نرم، د فشار وړ، او تر بل هر وخت هوښیار: د نیوماتیک روبوټونو عروج

Yakapfava, Inosvinwa, uye Yakangwara Kupfuura Zvakamboitika: Kukwidzwa kwePneumatic Robots

Нарм, фишурдашаванда ва аз ҳарвақта донотар: Афзоиши роботҳои пневматикӣ

Everumşak, gysylýan we öňküsinden has akylly: Pnewmatik robotlaryň döremegi

Ku Olova, Ku Pfuxetiwa Ni Ku Tlhariha Ku Tlula Rini Na Rini: Ku Tlakuka Ka Tirhoboto Ta Pneumatic

Yumshoq, siqib chiquvchi va har qachongidan ham aqlli: pnevmatik robotlarning yuksalishi

The story About a year after landing our first enterprise customers, I decided to change our name to Macro and I committed to paying $600k for the domain “macro.com,” spread over three years. It was a seller-financed deal, meaning we paid ~$200k up front and the rest monthly. We've now raised over $20M to build our AI workspace (LLMs + built-in file editors for word, notes, code, diagrams, PDFs, whiteboards) but back then it was only $2M, so this was a BIG bet!! A brand to match our ambition Why change our name? It came down to a question: what kind of company do I want to build? Our original name felt small and niche, but my ambitions were much bigger: I wanted to rebuild the Office Suite (we now call it an “AI workspace” because office suite sounds too boomer). I’ve learned that it’s easier to work on big ideas than small ones and felt we needed a name to match. Building big things is easier Around the same time, it hit me—America doesn’t reward building small things. It’s easier to raise capital, recruit talent, and sell your vision when you’re solving big, important problems. I’d always wanted to build something big eventually but I didn’t realize I was allowed to just go for it out of college. I assumed I had to build up to the big thing by building incrementally bigger things to build credibility. Wrong! Just build the thing you’re most excited to build (that’s probably also what the world needs!). Success feeds success Two months after changing our name we raised our Seed from a16z. The best thing about that round was the credibility it gave us. That perception of success turned into tangible results: better hires, more customers, and stronger momentum. As a 24-year-old founder, I knew I needed that credibility, and a great domain like “macro.com” was a powerful way to signal it. I credit Waseem Daher at Pilot for giving me the confidence to go big on the domain, after telling his story about Pilot dot com. I think thinking big is a cultural thing that we can either have more or less of depending on the times. Hopefully this inspires others to go big as well! The story About a year after landing our first enterprise customers, I decided to change our name to Macro and I committed to paying $600k for the domain “ macro.com ,” spread over three years. It was a seller-financed deal, meaning we paid ~$200k up front and the rest monthly. macro.com We've now raised over $20M to build our AI workspace (LLMs + built-in file editors for word, notes, code, diagrams, PDFs, whiteboards) but back then it was only $2M, so this was a BIG bet!! our AI workspace A brand to match our ambition A brand to match our ambition Why change our name? It came down to a question: what kind of company do I want to build? Our original name felt small and niche, but my ambitions were much bigger: I wanted to rebuild the Office Suite (we now call it an “AI workspace” because office suite sounds too boomer). I’ve learned that it’s easier to work on big ideas than small ones and felt we needed a name to match. Building big things is easier Around the same time, it hit me—America doesn’t reward building small things. It’s easier to raise capital, recruit talent, and sell your vision when you’re solving big, important problems. I’d always wanted to build something big eventually but I didn’t realize I was allowed to just go for it out of college. I assumed I had to build up to the big thing by building incrementally bigger things to build credibility. Wrong! Just build the thing you’re most excited to build (that’s probably also what the world needs!). eventually just go for it Success feeds success Two months after changing our name we raised our Seed from a16z. The best thing about that round was the credibility it gave us. That perception of success turned into tangible results: better hires, more customers, and stronger momentum. As a 24-year-old founder, I knew I needed that credibility, and a great domain like “ macro.com ” was a powerful way to signal it. macro.com I credit Waseem Daher at Pilot for giving me the confidence to go big on the domain, after telling his story about Pilot dot com. I think thinking big is a cultural thing that we can either have more or less of depending on the times. Hopefully this inspires others to go big as well!

This Startup Founder Spent $600k on a Domain—And the Risk Paid Off Big

Aquest fundador d'inici va gastar 600.000 dòlars en un domini, i el risc va pagar molt

Αυτός ο ιδρυτής εκκίνησης ξόδεψε 600.000 $ σε έναν τομέα - και ο κίνδυνος απέδωσε πολύ

El fundador de esta startup gastó 600.000 dólares en un dominio y el riesgo valió la pena

Startup-en sortzaile honek 600.000 $ gastatu zituen domeinu batean, eta arriskua asko ordaindu zuen

מייסד סטארט-אפ זה הוציא 600 אלף דולר על דומיין - והסיכון השתלם בגדול

Ovaj osnivač startupa potrošio je 600 tisuća dolara na domenu—i rizik se uvelike isplatio

このスタートアップの創業者はドメインに60万ドルを費やしたが、そのリスクは大きな利益をもたらした

Бұл стартаптың негізін қалаушы доменге 600 мың доллар жұмсады және тәуекел үлкен төленді

यो स्टार्टअप संस्थापकले एउटा डोमेनमा $६०० हजार खर्च गरे—र जोखिम ठूलो मूल्य चुकाए

මෙම ආරම්භක නිර්මාතෘ ඩොමේන් එකක් සඳහා ඩොලර් 600,000 ක් වියදම් කළ අතර අවදානම විශාල ලෙස ගෙවා දැමීය

اس سٹارٹ اپ بانی نے ایک ڈومین پر $600k خرچ کیے — اور رسک کی بڑی ادائیگی

Ushbu startap asoschisi domenga 600 ming dollar sarfladi va bu xavf katta foyda keltirdi

The federal government’s fraud case against a former CFO accused of secretly investing $35 million of company funds in a cryptocurrency-backed venture poses an important legal question: should executives face criminal liability for corporate investment decisions that fail? Prosecutors contend that Nevin Shetty’s investment in HighTower Treasury—a firm in which he held a partial ownership stake—constitutes fraud because it allegedly defied Fabric’s conservative investment policy, but a debate has emerged that this case is more about business judgment than criminality, warning that prosecuting Shetty could set a troubling precedent for executive decision-making. Shetty’s defense is focused on the investment in an account at HighTower Treasury, was tied to a stable cryptocurrency and, they say, made in good faith as a high-yield opportunity for Fabric. The prosecution’s case is built around Shetty’s (alleged) failure to disclose his ownership interest and the perceived risk of cryptocurrency investments, exemplifies a growing trend of prosecuting failed business decisions as fraud. But critics warn that allowing the government to criminalize high-risk investments without clear evidence of criminal intent risks stifling innovation and undermining the autonomy of corporate executives. Risk or Fraud? Shetty decided to invest Fabric’s funds in an account at HighTower, a DeFi platform offering returns on stablecoins. Stablecoins like TerraUSD, typically pegged to the U.S. Dollar to maintain a predictable value, are generally marketed as an innovative and secure way to participate in the crypto ecosystem. Shetty has said he believed the investment was consistent with Fabric’s financial goals and reasonably safe. But then, in a stunning turn of events, TerraUSD’s value collapsed, leading to $60 billion in financial losses. In the wake of this collapse, the government has argued that Shetty’s decision to invest in cryptocurrency, a highly volatile asset class, constitutes wire fraud because it allegedly violated Fabric’s investment guidelines. His former employer and prosecutors claim Shetty knowingly exposed Fabric to risk and attempted to profit personally from the investment, transforming what may have been poor judgment into a crime. The Question of Disclosure and Intent One of the primary ways in which Shetty drew the ire of prosecutors is that he failed to disclose the nature of the investment and his ownership interest in HighTower, thereby depriving Fabric of the ability to make an informed decision. Although the prosecution carefully doesn’t say the words explicitly, the government’s argument is rooted in the “right to control” theory, posturing that Shetty’s nondisclosure equates to depriving Fabric of its right to manage its assets freely. However, the Supreme Court recently rejected this theory unanimously (9-0) in Ciminelli v. United States (2023), ruling that fraud statutes apply to concrete deprivations of money or property, not the loss of decision-making authority. Prosecutors’ reliance on a discredited legal theory has drawn criticism from the legal community, with experts questioning whether Shetty’s actions meet the legal definition of fraud. Shetty’s defense team also points to his intentions, arguing that he genuinely believed the investment aligned with Fabric’s financial goals. His attorneys contend that he viewed TerraUSD as a secure investment based on assurances from Terraform Labs and its founder, Do Kwon, who marketed it as a stable asset pegged to the U.S. dollar. According to the defense, Shetty’s investment decisions may appear risky in hindsight, but they were not intended to harm Fabric. In their failed motion to dismiss, Shetty’s attorneys highlight the lack of evidence showing that he acted with criminal intent, a crucial element of wire fraud. They argue that Shetty’s failure to disclose his ownership interest may have been an ethical lapse, but not a criminal act. By prosecuting Shetty for what amounts to a failure in business judgment, they argue, the government risks conflating corporate policy violations with federal crimes, creating a dangerous precedent for business leaders. Potential Prosecutorial Overreach Should Have Founders and Startup Execs on Edge The prosecution’s broad interpretation of fraud statutes has led many to question whether the DOJ is overreaching by criminalizing poor investment decisions. According to these critics, Shetty’s case underscores the risks of allowing the government to pursue criminal charges based on poor outcomes rather than criminal intent. The National Association of Criminal Defense Lawyers (NACDL), which filed an amicus brief supporting Shetty, argues that the government’s theory stretches the bounds of federal fraud statutes. The NACDL asserts that self-dealing, without clear evidence of embezzlement or theft, should not constitute fraud, as it does not meet the statutory requirement of intent to deprive. Legal experts warn that prosecuting Shetty could effectively render any unsuccessful investment as potentially criminal as it obviously wasn’t as safe as the investors expected and hoped it to be. Business leaders and investors are regularly tasked with evaluating opportunities that may involve calculated risks, and treating these decisions as potential crimes could stifle that process, ultimately harming the economy and limiting companies’ ability to adapt to market trends. Demonizing Crypto This case also highlights the risks of criminalizing investments in emerging asset classes like cryptocurrency. Despite cryptocurrency’s historic volatility, many companies have pursued it as a high-potential area for growth. Cryptocurrency assets are indeed their own asset class and within that asset class there are a myriad of different investment options with different risk-reward profiles.  By treating Shetty’s cryptocurrency investment as fraud, the government could deter other executives from considering similar assets, ultimately hindering the adoption of new technologies in the financial sector. Cryptocurrency investments carry unique risks, as the collapse of TerraUSD illustrated. Nonetheless, Shetty’s attorneys argue that he reasonably relied on Terraform Labs’ marketing and public statements about TerraUSD’s stability. According to his defense, Shetty believed that TerraUSD offered a secure way to generate returns for Fabric without jeopardizing its principal. Prosecutors, however, argue that Shetty’s decision to invest in a cryptocurrency venture shows reckless disregard for Fabric’s investment policy. But as legal analysts note, investing in cryptocurrency does not inherently criminalize executives who invest in it. Criminalizing investments based on generalizations could limit opportunities for businesses to innovate and diversify their portfolios. Conclusion: Be Careful Out There As the Shetty case progresses, it offers the judiciary an opportunity to reaffirm the limits of federal fraud statutes and clarify the standards of criminal liability in corporate contexts. By prosecuting Shetty based on his investment choices, the government risks setting a precedent that could lead to overcriminalization, blurring the line between poor business decisions and intentional fraud. For executives, the outcome of this case will have broad implications: if the court upholds the prosecution’s interpretation of fraud, it could signal to business leaders that even the slightest misstep or policy breach could expose them to criminal charges. Such a precedent would discourage executives from pursuing high-risk, high-reward opportunities, ultimately stifling innovation and weakening businesses ability to navigate a competitive landscape. For courts, the Shetty case underscores the importance of restraint and adherence to legal standards in omissions theory prosecutions. By rejecting the government’s expansive view of fraud statutes, the court can ensure that criminal law serves its intended purpose - protecting against genuine harm - rather than being used as a tool for punishing business judgements. In a complex economy, preserving this balance is essential to maintaining both corporate freedom and judicial fairness. The federal government’s fraud case against a former CFO accused of secretly investing $35 million of company funds in a cryptocurrency-backed venture poses an important legal question: should executives face criminal liability for corporate investment decisions that fail? Prosecutors contend that Nevin Shetty’s investment in HighTower Treasury—a firm in which he held a partial ownership stake—constitutes fraud because it allegedly defied Fabric’s conservative investment policy, but a debate has emerged that this case is more about business judgment than criminality, warning that prosecuting Shetty could set a troubling precedent for executive decision-making. Shetty’s defense is focused on the investment in an account at HighTower Treasury, was tied to a stable cryptocurrency and, they say, made in good faith as a high-yield opportunity for Fabric. The prosecution’s case is built around Shetty’s (alleged) failure to disclose his ownership interest and the perceived risk of cryptocurrency investments, exemplifies a growing trend of prosecuting failed business decisions as fraud. But critics warn that allowing the government to criminalize high-risk investments without clear evidence of criminal intent risks stifling innovation and undermining the autonomy of corporate executives. Risk or Fraud? Risk or Fraud? Shetty decided to invest Fabric’s funds in an account at HighTower, a DeFi platform offering returns on stablecoins. Stablecoins like TerraUSD, typically pegged to the U.S. Dollar to maintain a predictable value, are generally marketed as an innovative and secure way to participate in the crypto ecosystem. Shetty has said he believed the investment was consistent with Fabric’s financial goals and reasonably safe. But then, in a stunning turn of events, TerraUSD’s value collapsed, leading to $60 billion in financial losses. In the wake of this collapse, the government has argued that Shetty’s decision to invest in cryptocurrency, a highly volatile asset class, constitutes wire fraud because it allegedly violated Fabric’s investment guidelines. His former employer and prosecutors claim Shetty knowingly exposed Fabric to risk and attempted to profit personally from the investment, transforming what may have been poor judgment into a crime. The Question of Disclosure and Intent The Question of Disclosure and Intent One of the primary ways in which Shetty drew the ire of prosecutors is that he failed to disclose the nature of the investment and his ownership interest in HighTower, thereby depriving Fabric of the ability to make an informed decision. Although the prosecution carefully doesn’t say the words explicitly, the government’s argument is rooted in the “right to control” theory, posturing that Shetty’s nondisclosure equates to depriving Fabric of its right to manage its assets freely. However, the Supreme Court recently rejected this theory unanimously (9-0) in Ciminelli v. United States (2023), ruling that fraud statutes apply to concrete deprivations of money or property, not the loss of decision-making authority. Prosecutors’ reliance on a discredited legal theory has drawn criticism from the legal community, with experts questioning whether Shetty’s actions meet the legal definition of fraud. Ciminelli v. United States Shetty’s defense team also points to his intentions, arguing that he genuinely believed the investment aligned with Fabric’s financial goals. His attorneys contend that he viewed TerraUSD as a secure investment based on assurances from Terraform Labs and its founder, Do Kwon, who marketed it as a stable asset pegged to the U.S. dollar. According to the defense, Shetty’s investment decisions may appear risky in hindsight, but they were not intended to harm Fabric. In their failed motion to dismiss, Shetty’s attorneys highlight the lack of evidence showing that he acted with criminal intent, a crucial element of wire fraud. They argue that Shetty’s failure to disclose his ownership interest may have been an ethical lapse, but not a criminal act. By prosecuting Shetty for what amounts to a failure in business judgment, they argue, the government risks conflating corporate policy violations with federal crimes, creating a dangerous precedent for business leaders. Potential Prosecutorial Overreach Should Have Founders and Startup Execs on Edge Potential Prosecutorial Overreach Should Have Founders and Startup Execs on Edge The prosecution’s broad interpretation of fraud statutes has led many to question whether the DOJ is overreaching by criminalizing poor investment decisions. According to these critics, Shetty’s case underscores the risks of allowing the government to pursue criminal charges based on poor outcomes rather than criminal intent. The National Association of Criminal Defense Lawyers (NACDL), which filed an amicus brief supporting Shetty, argues that the government’s theory stretches the bounds of federal fraud statutes. The NACDL asserts that self-dealing, without clear evidence of embezzlement or theft, should not constitute fraud, as it does not meet the statutory requirement of intent to deprive. Legal experts warn that prosecuting Shetty could effectively render any unsuccessful investment as potentially criminal as it obviously wasn’t as safe as the investors expected and hoped it to be. Business leaders and investors are regularly tasked with evaluating opportunities that may involve calculated risks, and treating these decisions as potential crimes could stifle that process, ultimately harming the economy and limiting companies’ ability to adapt to market trends. Legal experts warn that prosecuting Shetty could effectively render any unsuccessful investment as potentially criminal as it obviously wasn’t as safe as the investors expected and hoped it to be. Demonizing Crypto Demonizing Crypto This case also highlights the risks of criminalizing investments in emerging asset classes like cryptocurrency. Despite cryptocurrency’s historic volatility, many companies have pursued it as a high-potential area for growth. also Cryptocurrency assets are indeed their own asset class and within that asset class there are a myriad of different investment options with different risk-reward profiles.  By treating Shetty’s cryptocurrency investment as fraud, the government could deter other executives from considering similar assets, ultimately hindering the adoption of new technologies in the financial sector. Cryptocurrency investments carry unique risks, as the collapse of TerraUSD illustrated. Nonetheless, Shetty’s attorneys argue that he reasonably relied on Terraform Labs’ marketing and public statements about TerraUSD’s stability. According to his defense, Shetty believed that TerraUSD offered a secure way to generate returns for Fabric without jeopardizing its principal. Prosecutors, however, argue that Shetty’s decision to invest in a cryptocurrency venture shows reckless disregard for Fabric’s investment policy. But as legal analysts note, investing in cryptocurrency does not inherently criminalize executives who invest in it. Criminalizing investments based on generalizations could limit opportunities for businesses to innovate and diversify their portfolios. Conclusion: Be Careful Out There Conclusion: Be Careful Out There As the Shetty case progresses, it offers the judiciary an opportunity to reaffirm the limits of federal fraud statutes and clarify the standards of criminal liability in corporate contexts. By prosecuting Shetty based on his investment choices, the government risks setting a precedent that could lead to overcriminalization, blurring the line between poor business decisions and intentional fraud. For executives, the outcome of this case will have broad implications: if the court upholds the prosecution’s interpretation of fraud, it could signal to business leaders that even the slightest misstep or policy breach could expose them to criminal charges. Such a precedent would discourage executives from pursuing high-risk, high-reward opportunities, ultimately stifling innovation and weakening businesses ability to navigate a competitive landscape. For executives, the outcome of this case will have broad implications: For courts, the Shetty case underscores the importance of restraint and adherence to legal standards in omissions theory prosecutions. By rejecting the government’s expansive view of fraud statutes, the court can ensure that criminal law serves its intended purpose - protecting against genuine harm - rather than being used as a tool for punishing business judgements. In a complex economy, preserving this balance is essential to maintaining both corporate freedom and judicial fairness. For courts, the Shetty case underscores the importance of restraint and adherence to legal standards in omissions theory prosecutions.

Shetty Case Offers Thought-Provoking Look at Investment Risk vs. Fraud

Der Fall Shetty gibt Anlass zum Nachdenken über den Unterschied zwischen Anlagerisiko und Betrug

L'affaire Shetty offre un regard stimulant sur le risque d'investissement par rapport à la fraude

Shetty Case מציע מבט מעורר מחשבה על סיכון השקעה לעומת הונאה

Дело Шетти предлагает наводящий на размышления взгляд на инвестиционный риск и мошенничество

Shetty Case пропонує спонукаючи до роздумів погляд на інвестиційний ризик проти шахрайства

Shetty 案为投资风险与欺诈提供了发人深省的视角

PALO ALTO, USA, January 30th, 2025/CyberNewsWire/--SquareX discloses a new attack technique that shows how malicious extensions can be used to completely hijack the browser, and eventually, the whole device. Browser extensions have been under the spotlight in enterprise security news recently due to the wave of OAuth attacks on Chrome extension developers and data exfiltration attacks. However, until now, due to the limitations browser vendors place on the extension subsystem and extensions, it was thought to be impossible for extensions to gain full control of the browser, much less the device. SquareX researchers Dakshitaa Babu, Arpit Gupta, Sunkugari Tejeswara Reddy and Pankaj Sharma debunked this belief by demonstrating how attackers can use malicious extensions to escalate privileges to conduct a full browser and device takeover, all with minimal user interaction. Critically, the malicious extension only requires read/write capabilities present in the majority of browser extensions on the Chrome Store, including common productivity tools like Grammarly, Calendly and Loom, desensitizing users from granting these permissions. This revelation suggests that virtually any browser extension could potentially serve as an attack vector if created or taken over by an attacker. To the best of our understanding, extensions submitted to the Chrome Store requesting these capabilities are not put through additional security scrutiny at the time of this writing. The browser syncjacking attack can be broken up into three parts: how the extension silently adds a profile managed by the attacker, hijacks the browser and eventually gains full control of the device. Profile Hijacking The attack begins with an employee installing any browser extension - this could involve publishing one that masquerades as an AI tool or taking over existing popular extensions that may have up to millions of installations in aggregate. The extension then “silently” authenticates the victim into a Chrome profile managed by the attacker’s Google Workspace. This is all done in an automated manner in a background window, making the whole process almost imperceptible to the victim. Once this authentication occurs, the attacker has full control over the newly managed profile in the victim’s browser, allowing them to push automated policies such as disabling safe browsing and other security features. Using a very clever social engineering attack that exploits trusted domains, the adversary can then further escalate the profile hijacking attack to steal passwords from the victim’s browser. For example, the malicious extension can open and modify Google’s official support page on how to sync user accounts to prompt the victim to perform the sync with just a few clicks. Once the profile is synced, attackers have full access to all credentials and browsing history stored locally. As this attack only leverages legitimate sites and has no visible sign that it has been modified by the extension, it will not trigger any alarm bells in any security solutions monitoring the network traffic. Browser Takeover To achieve a full browser takeover, the attacker essentially needs to convert the victim’s Chrome browser into a managed browser. The same extension monitors and intercepts a legitimate download, such as a Zoom update, and replaces it with the attacker’s executable, which contains an enrollment token and registry entry to turn the victim’s Chrome browser into a managed browser. Thinking that they downloaded a Zoom updater, the victim executes the file, which ends up installing a registry entry that instructs the browser to become managed by the attacker’s Google Workspace. This allows the attacker to gain full control over the victim’s browser to disable security features, install additional malicious extensions, exfiltrate data and even silently redirect users to phishing sites. This attack is extremely potent as there is no visual difference between a managed and unmanaged browser. For a regular user, there is no telltale sign that a privilege escalation has occurred unless the victim is highly security aware and goes out of their way to regularly inspect their browser settings and look for associations with an unfamiliar Google Workspace account. Device Hijacking With the same downloaded file above, the attacker can additionally insert registry entries required for the malicious extension to message native apps. This allows the extension to directly interact with local apps without further authentication. Once the connection is established, attackers can use the extension in conjunction with the local shell and other available native applications to secretly turn on the device camera, capture audio, record screens and install malicious software - essentially providing full access to all applications and confidential data on the device. The browser syncjacking attack exposes a fundamental flaw in the way remote-managed profiles and browsers are managed. Today, anyone can create a managed workspace account tied to a new domain and a browser extension without any form of identity verification, making it impossible to attribute these attacks. Unfortunately, most enterprises currently have zero visibility into the browser - most do not have managed browsers or profiles, nor any visibility to the extensions employees are installing often based on trending tools and social media recommendations. What makes this attack particularly dangerous is that it operates with minimal permissions and nearly no user interaction, requiring only a subtle social engineering step using trusted websites - making it almost impossible for employees to detect. While recent incidents like the Cyberhaven breach have already compromised hundreds, if not thousands of organizations, those attacks required relatively complex social engineering to operate. The devastatingly subtle nature of this attack - with an extremely low threshold of user interaction - not only makes this attack extremely potent, but also sheds light on the terrifying possibility that adversaries are already using this technique to compromise enterprises today. Unless an organization chooses to completely block browser extensions via managed browsers, the browser syncjacking attack will completely bypass existing blacklists and permissions-based policies. SquareX’s founder Vivek Ramachandran says “This research exposes a critical blind spot in enterprise security. Traditional security tools simply can't see or stop these sophisticated browser-based attacks. What makes this discovery particularly alarming is how it weaponizes seemingly innocent browser extensions into complete device takeover tools, all while flying under the radar of conventional security measures like EDRs and SASE/SSE Secure Web Gateways. A Browser Detection-Response solution isn't just an option anymore - it's a necessity. Without visibility and control at the browser level, organizations are essentially leaving their front door wide open to attackers. This attack technique demonstrates why security needs to 'shift up' to where the threats are actually happening: in the browser itself.” SquareX has been conducting pioneering security research on browser extensions, including the DEF CON 32 talk Sneaky Extensions: The MV3 Escape Artists that revealed multiple MV3 compliant malicious extensions. This research team was also the first to discover and disclose the OAuth attack on Chrome extension developers one week before the Cyberhaven breach. SquareX was also responsible for the discovery of Last Mile Reassembly attacks, a new class of client-side attacks that exploits architectural flaws and completely bypasses all Secure Web Gateway solutions. Based on this research, SquareX’s industry-first Browser Detection and Response solution protects enterprises against advanced extension-based attacks including device hijacking attempts by conducting dynamic analysis on all browser extension activity at runtime, providing a risk score to all active extensions across the enterprise and further identifying any attacks that they may be vulnerable to. For more information about the browser syncjacking attack, additional findings from this research are available at sqrx.com/research. About SquareX SquareX helps organizations detect, mitigate and threat-hunt client-side web attacks happening against their users in real time. SquareX's industry-first Browser Detection and Response (BDR) solution, takes an attack-focused approach to browser security, ensuring enterprise users are protected against advanced threats like malicious QR Codes, Browser-in-the-Browser phishing, macro-based malware and other web attacks encompassing malicious files, websites, scripts, and compromised networks. Additionally, with SquareX, enterprises can provide contractors and remote workers with secure access to internal applications, enterprise SaaS, and convert the browsers on BYOD / unmanaged devices into trusted browsing sessions. Contact Head of PR Junice Liew SquareX junice@sqrx.com This story was distributed as a release by Cybernewswire under HackerNoon’s Business Blogging Program. Learn more about the program here PALO ALTO, USA, January 30th, 2025/CyberNewsWire/--SquareX discloses a new attack technique that shows how malicious extensions can be used to completely hijack the browser, and eventually, the whole device. Browser extensions have been under the spotlight in enterprise security news recently due to the wave of OAuth attacks on Chrome extension developers and data exfiltration attacks. However, until now, due to the limitations browser vendors place on the extension subsystem and extensions, it was thought to be impossible for extensions to gain full control of the browser, much less the device. SquareX researchers Dakshitaa Babu, Arpit Gupta, Sunkugari Tejeswara Reddy and Pankaj Sharma debunked this belief by demonstrating how attackers can use malicious extensions to escalate privileges to conduct a full browser and device takeover, all with minimal user interaction. SquareX SquareX Critically, the malicious extension only requires read/write capabilities present in the majority of browser extensions on the Chrome Store, including common productivity tools like Grammarly, Calendly and Loom, desensitizing users from granting these permissions. This revelation suggests that virtually any browser extension could potentially serve as an attack vector if created or taken over by an attacker. To the best of our understanding, extensions submitted to the Chrome Store requesting these capabilities are not put through additional security scrutiny at the time of this writing. The browser syncjacking attack can be broken up into three parts: how the extension silently adds a profile managed by the attacker, hijacks the browser and eventually gains full control of the device. Profile Hijacking The attack begins with an employee installing any browser extension - this could involve publishing one that masquerades as an AI tool or taking over existing popular extensions that may have up to millions of installations in aggregate. The extension then “silently” authenticates the victim into a Chrome profile managed by the attacker’s Google Workspace. This is all done in an automated manner in a background window, making the whole process almost imperceptible to the victim. Once this authentication occurs, the attacker has full control over the newly managed profile in the victim’s browser, allowing them to push automated policies such as disabling safe browsing and other security features. Using a very clever social engineering attack that exploits trusted domains, the adversary can then further escalate the profile hijacking attack to steal passwords from the victim’s browser. For example, the malicious extension can open and modify Google’s official support page on how to sync user accounts to prompt the victim to perform the sync with just a few clicks. Once the profile is synced, attackers have full access to all credentials and browsing history stored locally. As this attack only leverages legitimate sites and has no visible sign that it has been modified by the extension, it will not trigger any alarm bells in any security solutions monitoring the network traffic. Browser Takeover To achieve a full browser takeover, the attacker essentially needs to convert the victim’s Chrome browser into a managed browser. The same extension monitors and intercepts a legitimate download, such as a Zoom update, and replaces it with the attacker’s executable, which contains an enrollment token and registry entry to turn the victim’s Chrome browser into a managed browser. Thinking that they downloaded a Zoom updater, the victim executes the file, which ends up installing a registry entry that instructs the browser to become managed by the attacker’s Google Workspace. This allows the attacker to gain full control over the victim’s browser to disable security features, install additional malicious extensions, exfiltrate data and even silently redirect users to phishing sites. This attack is extremely potent as there is no visual difference between a managed and unmanaged browser. For a regular user, there is no telltale sign that a privilege escalation has occurred unless the victim is highly security aware and goes out of their way to regularly inspect their browser settings and look for associations with an unfamiliar Google Workspace account. Device Hijacking With the same downloaded file above, the attacker can additionally insert registry entries required for the malicious extension to message native apps. This allows the extension to directly interact with local apps without further authentication. Once the connection is established, attackers can use the extension in conjunction with the local shell and other available native applications to secretly turn on the device camera, capture audio, record screens and install malicious software - essentially providing full access to all applications and confidential data on the device. The browser syncjacking attack exposes a fundamental flaw in the way remote-managed profiles and browsers are managed. Today, anyone can create a managed workspace account tied to a new domain and a browser extension without any form of identity verification, making it impossible to attribute these attacks. Unfortunately, most enterprises currently have zero visibility into the browser - most do not have managed browsers or profiles, nor any visibility to the extensions employees are installing often based on trending tools and social media recommendations. What makes this attack particularly dangerous is that it operates with minimal permissions and nearly no user interaction, requiring only a subtle social engineering step using trusted websites - making it almost impossible for employees to detect. While recent incidents like the Cyberhaven breach have already compromised hundreds, if not thousands of organizations, those attacks required relatively complex social engineering to operate. The devastatingly subtle nature of this attack - with an extremely low threshold of user interaction - not only makes this attack extremely potent, but also sheds light on the terrifying possibility that adversaries are already using this technique to compromise enterprises today. Unless an organization chooses to completely block browser extensions via managed browsers, the browser syncjacking attack will completely bypass existing blacklists and permissions-based policies. SquareX’s founder Vivek Ramachandran says “This research exposes a critical blind spot in enterprise security. Traditional security tools simply can't see or stop these sophisticated browser-based attacks. What makes this discovery particularly alarming is how it weaponizes seemingly innocent browser extensions into complete device takeover tools, all while flying under the radar of conventional security measures like EDRs and SASE/SSE Secure Web Gateways. A Browser Detection-Response solution isn't just an option anymore - it's a necessity. Without visibility and control at the browser level, organizations are essentially leaving their front door wide open to attackers. This attack technique demonstrates why security needs to 'shift up' to where the threats are actually happening: in the browser itself.” SquareX’s founder Vivek Ramachandran says “This research exposes a critical blind spot in enterprise security. Traditional security tools simply can't see or stop these sophisticated browser-based attacks. What makes this discovery particularly alarming is how it weaponizes seemingly innocent browser extensions into complete device takeover tools, all while flying under the radar of conventional security measures like EDRs and SASE/SSE Secure Web Gateways. A Browser Detection-Response solution isn't just an option anymore - it's a necessity. Without visibility and control at the browser level, organizations are essentially leaving their front door wide open to attackers. This attack technique demonstrates why security needs to 'shift up' to where the threats are actually happening: in the browser itself.” Vivek Ramachandran Vivek Ramachandran SquareX has been conducting pioneering security research on browser extensions, including the DEF CON 32 talk Sneaky Extensions: The MV3 Escape Artists that revealed multiple MV3 compliant malicious extensions. Sneaky Extensions: The MV3 Escape Artists Sneaky Extensions: The MV3 Escape Artists This research team was also the first to discover and disclose the OAuth attack on Chrome extension developers one week before the Cyberhaven breach . SquareX was also responsible for the discovery of Last Mile Reassembly attacks, a new class of client-side attacks that exploits architectural flaws and completely bypasses all Secure Web Gateway solutions. OAuth attack on Chrome extension developers OAuth attack on Chrome extension developers Cyberhaven breach Cyberhaven breach Last Mile Reassembly Last Mile Reassembly Based on this research, SquareX’s industry-first Browser Detection and Response solution protects enterprises against advanced extension-based attacks including device hijacking attempts by conducting dynamic analysis on all browser extension activity at runtime, providing a risk score to all active extensions across the enterprise and further identifying any attacks that they may be vulnerable to. For more information about the browser syncjacking attack, additional findings from this research are available at sqrx.com/research . sqrx.com/research sqrx.com/research About SquareX SquareX helps organizations detect, mitigate and threat-hunt client-side web attacks happening against their users in real time. SquareX SquareX SquareX's industry-first Browser Detection and Response (BDR) solution, takes an attack-focused approach to browser security, ensuring enterprise users are protected against advanced threats like malicious QR Codes, Browser-in-the-Browser phishing, macro-based malware and other web attacks encompassing malicious files, websites, scripts, and compromised networks. Additionally, with SquareX, enterprises can provide contractors and remote workers with secure access to internal applications, enterprise SaaS, and convert the browsers on BYOD / unmanaged devices into trusted browsing sessions. Contact Head of PR Junice Liew SquareX junice@sqrx.com This story was distributed as a release by Cybernewswire under HackerNoon’s Business Blogging Program. Learn more about the program here This story was distributed as a release by Cybernewswire under HackerNoon’s Business Blogging Program. Learn more about the program here here here

SquareX Discloses “Browser Syncjacking” , a New Attack Technique That Puts Millions At Risk

SquareX onthul "Browser Syncjacking", 'n nuwe aanvalstegniek wat miljoene in gevaar stel

SquareX раскрывае «сінджэк браўзера», новую тэхніку атакі, якая ставіць пад пагрозу мільёны

SquareX revela “Browser Syncjacking”, una nueva técnica de ataque que pone en riesgo a millones de personas

SquareX révèle le « Browser Syncjacking », une nouvelle technique d’attaque qui met des millions de personnes en danger

SquareX חושפת את "סינכרון דפדפן", טכניקת התקפה חדשה שמעמידה מיליונים בסיכון

SquareX、数百万人を危険にさらす新たな攻撃手法「ブラウザシンクジャッキング」を公開

SquareX миллиондаған адамдарға қауіп төндіретін «браузерлерді синхрондау» жаңа шабуыл әдісін ашады.

SquareX លាតត្រដាង "Browser Syncjacking" ដែលជាបច្ចេកទេសវាយប្រហារថ្មីដែលដាក់ហានិភ័យរាប់លាន

SquareX onthult ‘Browser Syncjacking’, een nieuwe aanvalstechniek die miljoenen mensen in gevaar brengt

SquareX odhaľuje „synchronizáciu prehliadača“, novú techniku útoku, ktorá ohrozuje milióny ľudí

SquareX, Milyonlarca Kişiyi Tehlikeye Sokan Yeni Bir Saldırı Tekniği Olan "Tarayıcı Senkronizasyon Saldırısı"nı Açıkladı

I-SquareX Idalula “Ukuvumelanisa Kwesiphequluli”, Indlela Entsha Yokuhlasela Ebeka Izigidi Engcupheni

Stories, News & Mentions about RIS

Ris’s Stories on HackerNoon

Ris's News & Mentions