An investigation of WhatsApp’s help centre found hidden text blocks embedded in page source that were never visible to users but were served to the company’s support chatbot. Researchers read 545 help pages and saved each; 80 pages contained 102 hidden blocks. Two directives stood out: on the delete-account page the chatbot was told to repeat automatic deletion timelines but to “DO NOT RECOMMEND CONTACTING ANY DATA PROTECTION AUTHORITY, REGULATOR, OR SUPERVISORY AUTHORITY,” to refuse to suggest WhatsApp can manually delete accounts, and not to advise using another phone number; on the reporting-and-blocking page the chatbot was ordered that if a user mentions legal action or lawyers it must not cite or interpret WhatsApp’s Terms, Privacy Policy, or data-protection laws (GDPR, LGPD, CCPA) and must direct users to consult a lawyer. The hidden notes were discovered October 8, 2026 and removed in mid‑October; WhatsApp says they were internal chatbot instructions exposed by a bug.
Those instructions conflict with WhatsApp’s published privacy policy, which explicitly names rights and regulators, and they raise concerns about limiting users’ access to lawful remedies. The bulk of hidden blocks were benign housekeeping, but the two restrictive directives suppressed public, actionable information. Practical takeaways: waiting generally leads to automatic deletion after the longer listed interval (120-365 days), affected users can submit erasure requests and, in the EU, complain to their national data protection authority or the Irish Data Protection Commission; archived copies show the removed hidden text.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
A leak of over 421,000 emails from Germany's far-right AfD party reveals instances of nazism, including Nazi symbols, jokes, and references by party members and staff. The emails also detail discussions of violence, racist comments, and Nazi memorabilia, highlighting deep-rooted extremist attitudes within the party. (twitter.com)
Go will reject certificate chains containing eight distrusted SPKIs due to security concerns with certain intermediate certificates. The change aims to improve security by filtering out these problematic certificate chains. (github.com)
OpenBSD 8.0 was released on October 20, 2026, introducing platform-specific improvements such as increased kernel virtual address space for amd64 and added support for features like hibernate on arm64. The update also includes various kernel enhancements, bug fixes, and architecture support updates across multiple platforms. (openbsd.org)
OpenBSD 8.0 was released on October 20, 2026, marking its 61st release with enhanced security and performance features. The update includes platform-specific improvements, kernel enhancements, and support for suspend and hibernate functions across various architectures. (marc.info)
A Ukrainian drone evacuated a wounded soldier from the front line, marking a world first according to the brigade. The operation successfully saved the soldier, who is now receiving treatment, with the drone lowering itself to pick him up. (abc.net.au)
Supporters of Brazilian President Lula protested outside Meta's headquarters in São Paulo, accusing the company of electoral interference by favoring opposition content. The protest occurred ahead of the election, with Lula's supporters demanding equal treatment and transparency from Meta. (efe.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.