- hide SMT-offline CPUs, like top(1) does - mirror distfile; upstream redirects http->https but hostname isn't in the cert