Allowing these type of programs to autonotify of updates and self-update should be considered bad practice and a high security risk. Why risk a malicious MITM-

Allowing these type of programs to autonotify of updates and self-update should be considered bad practice and a high security risk. Why risk a malicious MITM-ed update? The keepass site should just provide portable zips and off-site hashes and sigs for verification.