point out there's an https mirror now