I didn't post it, but I assume s/he was cutting and pasting from their URL bar, and they use HTTPS Everywhere or similar to encourage their browser to always prefer HTTPS connections (which xkcd provides, but to my ongoing annoyance, Amazon does not).
Unfortunately, xkcd (along with NYTimes and probably others) link to CSS/JS resources at http:// URLs, which defeats the security of HTTPS. The next version of Firefox will block mixed content in these cases, and being on the alpha channel, I've had to disable HTTPS Everywhere for these sites.
https://www.eff.org/https-everywhere
One could argue this should be a built-in option these days....