why do we have this second http remote ? if this is a fallback in case the first one does not work, i would consider it a possible attack vector. cause a mitm could easily block https and drive-by inject malicious code in the download.