> I hope they sign packages... And defend against attacks that trick you into installing a known-vulnerable version of the plugin (which of course has a valid

> I hope they sign packages... And defend against attacks that trick you into installing a known-vulnerable version of the plugin (which of course has a valid signature, since it was believed to be good at the time of release). And avoid using error-prone package signature algorithms, like the one Android uses that originates from Java and has had several vulnerabilities. And don't send any personally-identifiable or private user information to the server when checking for updates. And... actually, no, just don't distribute software over HTTP, even if signed.