Switched to HTTPS due to Sparkle Security vulnerability

[xu-cheng]

See sparkle-project/Sparkle#720

[codykrieger]

As far as I'm aware, gfxCardStatus shouldn't be vulnerable, because all http requests to gfx.io are redirected to https before any content is served. But this is still a good change. Thanks!

[xu-cheng]

all http requests to gfx.io are redirected to https

FYI, this is where MITM attack can be performed. i.e. Instead of redirect to https, an attacker can redirect it to anything.

Thanks for merging.

[codykrieger]

Ah, good point. I was only considering the appcast being modified, not being redirected somewhere else entirely.

[xu-cheng]

Also kinda wonder any chance for a new release?

[zachriggle]

A new release would be wonderful <3

[aidantwoods]

Any chance at a new release, looks like the update still occurs over http making every user with auto update enabled vulnerable to remote code execution by a network attacker :(

I was going to submit a PR myself, but this is kinda nuts that it was fixed a year ago and not yet released...