The .cn TLD is can be MITMed by the Chinese government, yes. That's why you need to host your chinese-dissident page in a TLD of any country that hates China (ie, almost any of them). Same for a site that reveals wrongdoings of the NSA. Any point other than ICANN can be avoided by simply chosing a different TLD, and ICANN itself can be secured by pinning TLD keys.

This goes in sharp contrast with the CA cartel model, where you need to trust the sum (rather than alternative) of 400+ entities, some of which are known to be actively engaged in MITM, like CNNIC or Etisalat.

Uhm no, you can't MITM DNSSEC, you can't do anything except a denial of service unless you control one of three entities:

• ICANN
• that particular TLD
• the registrar your victim uses

That is, unless someone is stupid enough to trust some external DNS server, but no reasonable DNSSEC client would use a dumb stub resolver this way.

For me, some extra resiliency against snooping is a bonus rather than a "critical vulnerability".

Hmm yeah.. if this was reliable information, we'd have heard more by now.

It was in the news a couple days ago, reporting a first sighting of 300-400 men in plain (green) uniforms of Russian army. Without distinctions, same as in Crimea.

One mr. Osipovich would have a word with you.

The "rebels" are in a good part active-duty Russian army and special forces personnel with no distinctions, so I wouldn't claim "very little training".

In this case, the same seed was provided. Two copies of the same PRNG are supposed to provide exact same output, I don't see any issue here.

Isn't "longer" and "better" a contradiction here?

He went extinct for your sins.

Like, say, N9, which was received wonderfully even with no marketing at all?

Are there any Indians left you could mooch from during these two winters?