How about an actual plist?
Use https