Source: https://alien.slackbook.org/blog/your-feedback/
Hi Eric,
Hope you're doing ok.
Do you know why http://www.slackware.com is not using HTTPS?
Regards. Marco
HTTPS is overkill for a site that only serves static content. Also you will notice that many repository servers offer HTTP because adding SSL encryption adds a load to the server when it needs to serve a lot of content in parallel.
Hee Eric. Thanks for your answer. I was under the assumption that all sites should use HTTPS nowadays.
I understand now that since packages are signed, HTTPS is not "really" necessary. Some interesting discussion about it here:
https://askubuntu.com/questions/352952/are-repository-lists-secure-is-there-an-https-version
Still HTTPS offers more security and as I understand it the extra server load is minimal nowadays, especially with modern hardware.
The slackware.com site does not offer Slackware core packages anyway. It hosts my own repository but for that, multiple https mirrors are also available.
Refs:
Keep calm, nobody cares about Slack ...
... security by marginality