It also seems positively weird that Apple's support pages and this security update aren't delivered via https.