Question: Found something related [Why aren't application downloads routinely done over HTTPS?](https://security.stackexchange.com/questions/18853/why-arent-application-downloads-routinely-done-over-https)

---

This is a question about general security from a noob. I couldn't find anything relevant about this topic via my Google searches. Google prefers to display actual application problems with java & ssl/https/downloads.

**Why does Oracle still offer its official JDK (Java Development Kit) archives via plaintext HTTP?**

I'm genuinely curious, because IT tech (Twitter, Google, Facebook, Github, ..., cool stuff) seems to be advancing towards HTTPS end-to-end encryption, so that if we trust in CAs (see below), we should have good guarantee that the software (or code) downloaded from these sites is original., Java and othter communities around JVM seem active, and yet, the company paying the development of the official JVM cannot afford to upgrade its website with downloads to SSL/TLS.

I'm very curious about this in general, because people on Internet seems to write a lot about bugs in crypto software (like Heartbleed and others which I forgot) and yet, many people and companies not actually engaged in software engineering download and run code that can be very easily infected by malicious MITM (and now we almost certainly know that certain powerful entities actually do this).

**How much can we rely on Certificate Autorities?** AFAIK, some of them are in countries, where single entity (gov) can covertly do whatever it wants on their machines.

Answer: 
On the mobile side, unless you specifically asked your provider for it, IPs are ***normally*** private (NATed) which makes it quite difficult to reach from outside that network.

With the wifi connection, again your connection gets NATed by your router, making the device unreachable directly too.

Finally note that an IP address is a publicly available information and not an attack vector by itself.
An IP alone is not enough for hacking your phone. And while it doesn't slow an attacker down, the same time it does absolutely nothing to help attacking you. 

IP addresses are no secrets, quite the opposite. It's just necessary for any (internet) connection to work. And even if this particular software wouldn't show the address, there are plenty opportuninties to get your IP. 

Just don't worry about it.