#GNU documentation is excellent, love it:
"#Substitute URLs can be either #HTTP or #HTTPS. HTTPS is recommended because communications are encrypted; conversely, using HTTP makes all communications visible to an eavesdropper, who could use the information gathered to determine, for instance, whether your system has unpatched security vulnerabilities."