I've discovered a problem with the account pictures.
It seems that if you're $Configuration['HTTP_METHOD'] variable is set to http and you want to show an external account picture that uses https, http:// is still prepended. Resulting in a link like http://https://www.blah.com/pic.jpg in the img tag.
I've traced this problem to People.Class.User.php, where you use the PrependString function.
While this is perfectly good code for local files, it seems a wrong when you allow external images.
I'm just thinking out loud here, but wouldn't linking images from a https domain to a http domain or the other way around be some kind of no-no and spur unwanted security warnings etc? While I do see the validity of correcting this, I just think it could lead to some nastiness.
if you are linking in an image from https to a http domain like me, this is true. The other way around though should still be possible if you choose to allow external avatars.
Doing a quick search through the code points me to the fact that it's related to the Configuration['HTTP_METHOD'] setting which fixed to either http:// or https:// based on the configuration settings and appears fixed to that as set by the host. I found it in two files: within library/framework/functions.php and library/people/people.class.user.php ...
A quick search reveals that this is similar to another core bug that was never addressed fully and could probably use a patch. Stand by, someone else may have a proper temporary patch to address this. Mark should hopefully find this and include it into the core for the next expected release.
Now you have to change profiles settings - correct links into SQL table "LUM_User", columns "Icon" and" Picture". It's not elegant solution, but works.