Altering the updater to employ https in place of existing plaintext http would be fantastic and simple initial step. It is really great reward if Additionally, it checks new exe's signature, but in first put, it shouldn't enable everyone on the way to intercept requests so conveniently.