I have been a long time Visor/TotalTerminal user and wanted to try iTerm2 on 10.11 but was concerned with its use of the Sparkle updater framework. I could find no sign through all of my research if confirm if updates are performed through https instead of http and I declined to install it. I also couldn't find a way to contact the anyone to ask, so I'm glad you posted. So? What does it use? Don't you think this may be worth noting on the announcement or changelog?
And what about the risk of parsing file:// and ftp:// and other protocols inside the WebView component What assurances can you give that there is not security flaw on the server that allows replacing XML file?
Why are you concerned with Sparkle? Is it because it's a third party library or whether or not iTerm2 makes HTTPS updates?
It seems a little debugging with LittleSnitch/Charles would glean an answer how the requests are made and what, if anything else is. Perhaps a ticket https://iterm2.com/bugs is warranted.
