[opensuse-support] HTTPS for package downloads?

I'm wondering what the pros and cons are when using HTTPS for package downloads in openSUSE. By default, all repos are added as HTTP. When adding an additional repo, for example multimedia:apps[1], the link will be HTTPS since websites redirect to that nowadays. I suppose zypper and YaST aren't vulnerable to something like CVE-2019-3462[2][3], and load balancing works over both HTTP and HTTPS, right? So, is one better than the other? regards [1] https://download.opensuse.org/repositories/multimedia:/apps/openSUSE_Tumblew... [2] https://justi.cz/security/2019/01/22/apt-rce.html [3] https://www.cvedetails.com/cve/CVE-2019-3462/