From 7dc1677aac2058a628a66a7c0dc3d0dd708a0657 Mon Sep 17 00:00:00 2001
From: Zach Wasserman <zach@fleetdm.com>
Date: Fri, 15 Jan 2021 09:04:45 -0800
Subject: [PATCH] Update InsecureTransport comment

---
 pkg/update/update.go | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkg/update/update.go b/pkg/update/update.go
index 7740040172..3e69a58f8e 100644
--- a/pkg/update/update.go
+++ b/pkg/update/update.go
@@ -36,7 +36,8 @@ type Options struct {
 	// ServerURL is the URL of the update server.
 	ServerURL string
 	// InsecureTransport skips TLS certificate verification in the transport if
-	// set to true.
+	// set to true. Best to leave this on, but due to the file signing any
+	// tampering by a MitM should be detectable.
 	InsecureTransport bool
 	// RootKeys is the JSON encoded root keys to use to bootstrap trust.
 	RootKeys string