Found something related Why aren't application downloads routinely done over HTTPS?
This is a question about general security from a noob. I couldn't find anything relevant about this topic via my Google searches. Google prefers to display actual application problems with java & ssl/https/downloads.
Why does Oracle still offer its official JDK (Java Development Kit) archives via plaintext HTTP?
I'm genuinely curious, because IT tech (Twitter, Google, Facebook, Github, ..., cool stuff) seems to be advancing towards HTTPS end-to-end encryption, so that if we trust in CAs (see below), we should have good guarantee that the software (or code) downloaded from these sites is original., Java and othter communities around JVM seem active, and yet, the company paying the development of the official JVM cannot afford to upgrade its website with downloads to SSL/TLS.
I'm very curious about this in general, because people on Internet seems to write a lot about bugs in crypto software (like Heartbleed and others which I forgot) and yet, many people and companies not actually engaged in software engineering download and run code that can be very easily infected by malicious MITM (and now we almost certainly know that certain powerful entities actually do this).
How much can we rely on Certificate Autorities? AFAIK, some of them are in countries, where single entity (gov) can covertly do whatever it wants on their machines.