[ITsmeagain1]

Sierra update is 731MB. See https://support.apple.com/kb/DL1956?viewlocale=en_US&locale=... BTW... not sure why the downloaded file is actually downloaded on _http_

[lumisota]

Apple's signing the updates anyway; HTTP will be much more performant.

[kalleboo]

HTTP probably helps admins of large networks cache downloads for their 5000 computers that are all updating at once (if they're not running Apple's update cache server)

[willstrafach]

This is also how Apple’s cache server works, otherwise it would need to break the TLS connection, and that is not an improvement.

I have personally looked at the accompanying connections and it looks like Apple sends hashes over a proper TLS connection. Updates are also signed as another layer of security.