[throwuxiytayq]

Huh? Are you really saying that downloading configuration files over HTTP is fine? (I’m really struggling to find a charitable interpretation)

[diffeomorphism]

Of course it is. If you want security, you should secure the files (i.e., signatures, public key, whatever), not the carrier pigeon used to send them.

[chgs]

I think their argument is it shouldn’t download any configuration via any connection.

[homero]

No it's that HTTP means nothing

[homero]

Of course it's fine. You sign the files