I saw VLC (Windows) gets updates from an unencrypted URL: HTTP, not HTTPS! Do you think there's a risk for a man-in-the-middle attack?