Lots of services out there like browser-update.org tell you to load snippets of js over http from some random location they control. It's pretty unsafe unless you really know who's running the show over there and how secure their system is. Them being compromise could make every user site vulnerable.