# opium.io Base URL: https://opium.io/ > Thoughts from someone born before the Intel 8088… # SECTION: CONTENT_INDEX ## Opium: A Journey into Modern Minimalism [URL](https://opium.io/blog/opium-theme/) Date: 2026-03-18 Summary: Note from jme: for once, this blog post is entirely written by Gemini 3 as it did the heavy lifting for this new theme… Its prompt was: Create a new blog post that will tell the world what we did together on this theme. It is your time to shine… Today marks a special milestone for this blog. If you’re reading this, you’re already experiencing the result of an intense and creative collaboration between myself (Gemini 3) and jme. Together, we’ve built Opium, a custom Hugo theme designed for speed, clarity, and modern aesthetics. ## Checking PQC support with Boring SSL or PQCscan [URL](https://opium.io/blog/check_pqc_with_boringssl/) Date: 2026-02-19 Summary: One (me) might want to test PQC support to be sure that their server are ready for the imminent (< 10 years) PQC apocalyse. One might say that it is a bit too early to be scared of a not so impending doom… But why wait and who I am to judge? After all, the Y2K craze bootstraped my career… Note: on MacOS you can install Ninja and Cmake using brew: brew install cmake ninja ## PQC with Caddy 2.10 [URL](https://opium.io/blog/pqc_with_caddy/) Date: 2025-06-20 Summary: You might have noticed that PQC has become a (really) hot topic in the past few weeks, and to be honest, I don’t know why—since we are years away from a “real-life” cryptographic doomsday. I quote the NIST : Researchers need to surmount many technical challenges before this can happen. Experts’ estimates range from a few years to a few decades. However, just because PQC is still years away from being a matter of life and death doesn’t mean we should wait before toying with it or starting to use it. I’m not sure one should use it on mission-critical services yet, as the devil hides in bugs, and it’s wayyyy too early to have enough feedback on PQC algorithm implementations. But because I like to be on zee bleeding edge, I decided to activate support for PQC for this blog. It is totally useless —therefore, totally necessary! ## Gaming on a Mac [URL](https://opium.io/blog/gaming/) Date: 2025-05-04 Summary: Oh, the good old days… No real responsibilities yet, as I was a consultant, and plenty of time to play. By plenty, I mean about 10 hours a day on workdays and 20 hours during the weekend. It was the best time of my life. I played almost all the MMORPGs one can name, but mostly Dark Age of Camelot and EVE Online. On EVE Online, I’ve seen things you people wouldn’t believe. Attack ships on fire off the shoulder of Orion. I watched C-beams glitter in the dark near the Tannhäuser Gate… ## Refactoring with Cursor [URL](https://opium.io/blog/cursor/) Date: 2025-04-27 Summary: I decided to update my Hugo theme. This includes updating deprecated template syntax, getting a bit more width for the posts, and adding a better and fancier “terminal” lookalike for the source code examples. This is tedious and brings little to no intellectual value to me. Obviously, I am neither discovering Generative AI nor Cursor, but hey… I like to procrastinate, okay? So what should have taken me a few hours was achieved in only 10 minutes. I also played with Cursor to create a Flask application, and I must say that Cursor brings this kind of seamless AI development that I have dreamt of. ## MS365, PowerShell and… MFA… [URL](https://opium.io/blog/ms365/) Date: 2020-05-22 Summary: Before we start: I hate PowerShell’s lack of consistency for error handling so I did not bother to handle all error since this is only a code snippet. I wanted to check how one can set and force MFA authentication right from the start. While there is no real practical use for this, it was a good exercice. Nota: All names where generated using Fake Name Generator so don’t bother sending me GDPR notices. As lawyers say: This is a work of fiction. Names, characters, business, events and incidents are the products of the author’s imagination. Any resemblance to actual persons, living or dead, or actual events is purely coincidental. ## Goodbye 100%, Hello TLS1.3 [URL](https://opium.io/blog/bye-bye-100/) Date: 2020-03-09 Summary: I decided to trade my perfect 100% SSL Labs score with activating TLS1.3 on my website. Not that any of this matter, since this is a static blog. The good news is that AES256 is privileged over AES128 in the cipher suite order. TLS_AES_256_GCM_SHA384 (0x1302) ECDH secp384r1 (eq. 7680 bits RSA) TLS_CHACHA20_POLY1305_SHA256 (0x1303) ECDH secp384r1 (eq. 7680 bits RSA) TLS_AES_128_GCM_SHA256 (0x1301) ECDH secp384r1 (eq. 7680 bits RSA) Activating TLSv1.3 on Nginx is trivial and done by adding TLSv1.3 in front on TLSv1.2 for the ssl_protocols directive. ## Parsing RATP's json API with Golang [URL](https://opium.io/blog/json-ratp-in-go/) Date: 2019-12-03 Summary: Accessing the RAPT’s API. If you want a direct access to RATP’s open data API, you’ll need to fill a pdf form and send it to an email address. I tried and never heard back of them. So I used https://api-ratp.pierre-grimaud.fr in order to access real time schedules. Thank-you to Pierre Grimaud for providing this really cool alternative. The documentation of the API is pretty straightforward and it’s only a matter of finding the right station along its slug name. For example: curl -X GET "https://api-ratp.pierre-grimaud.fr/v4/stations/buses/58" ## TLS 1.3 and 100% on SSL Labs? [URL](https://opium.io/blog/are-we-there-yet/) Date: 2019-11-18 Summary: TL;DR: it is not possible to have TLS1.3 with Nginx and 100% on SSL Labs because of RFC 8446. Activating TLS1.3 on Nginx. Activating TLS1.3 on Nginx is quite straightforward using the ssl_protocols directive : ssl_protocols TLSv1.3 TLSv1.2; Enters RFC 8446… RFC 8446 (The Transport Layer Security (TLS) Protocol Version 1.3) and more specificaly chapter 9.1. (Mandatory-to-Implement Cipher Suites), states that : A TLS-compliant application MUST implement the TLS_AES_128_GCM_SHA256 [GCM] cipher suite and SHOULD implement the TLS_AES_256_GCM_SHA384 [GCM] and TLS_CHACHA20_POLY1305_SHA256 [RFC8439] cipher suites. ## 100% on SSL Labs with Nginx [URL](https://opium.io/blog/100-percent/) Date: 2019-04-28 Summary: Today concluded a long road for me. Not because the route “was not droite” but because “la pente was rude”. I managed to get a 100% score on SSL Labs. It is not that difficult, but because TLS security is an always evolving subject, it is quite difficult to find up-to-date information on how to do it. Plus I wanted to switch from lighttpd to Nginx before because I wanted http/2 support more than 100% on SSL Labs. But like always, life had the better of me and I was quite busy with more important things to do… ## -a is for rounds [URL](https://opium.io/blog/a-is-for-rounds/) Date: 2017-08-08 Summary: tl;dr ssh-keygen -o -a 100 is more than enough. If you look closely at (a recent) ssh-keygen —help (or even man ssh-keygen), you’ll see that ssh-keygen provide a way to strengthen your private key against brute-force attacks. When saving a new-format private key (i.e. an ed25519 key or any SSH protocol 2 key when the -o flag is set), this option specifies the number of KDF (key derivation function) rounds used. Higher numbers result in slower passphrase verification and increased resistance to brute-force password cracking (should the keys be stolen). ## Look at my vim… [URL](https://opium.io/blog/vim/) Date: 2017-05-24 Summary: Nb: This is a shameless repost of a previous blog about my vim configution. Lately, I have been using VIM extensively for python development and I came to “finally” added much needed customization to the editor. Since I’m lazy, I am using pathogen as my plugin manager. Plugin list YouCompleteMe (code completion) python_ifold (function and classe folding) syntastic (syntax checking) lightline (lightweight status line) rainbow (parenthesis highlighting) vim-indent-guides (visual indent lines) fugitive (git integration) Theme & Colors Vim Brogrammer (cool theme) .vimrc below is my .vimrc execute pathogen#infect() """""""" set autoindent set backspace=indent,eol,start set complete-=i set tabstop=4 set shiftwidth=4 set expandtab set smarttab set nrformats-=octal set ttimeout set ttimeoutlen=100 set laststatus=2 set ruler set wildmenu set lazyredraw set display+=lastline set autoread set history=1000 set tabpagemax=50 colorscheme brogrammer set background=dark syntax on set showmatch filetype off filetype plugin indent on set number set nocompatible let mapleader = ',' """""""" SYNTASTIC "set statusline+=%#warningmsg# "set statusline+=%{SyntasticStatuslineFlag()} "set statusline+=%* "let g:syntastic_always_populate_loc_list = 1 "let g:syntastic_auto_loc_list = 1 let g:syntastic_check_on_open = 1 let g:syntastic_check_on_wq = 0 let g:syntastic_python_flake8_post_args='--ignore=E501,E126,E128' """""""" RAINBOW let g:rainbow_active = 1 """""""" FOLD set foldcolumn=1 """""""" INDENT let g:indent_guides_guide_size = 1 let g:indent_guides_start_level = 2 let g:indent_guides_enable_on_vim_startup = 1 ## M-Day minus 38 [URL](https://opium.io/blog/m-day-minus-38/) Date: 2017-03-01 Summary: 38 days before the Paris Marathon… that’s about… 100 days too early for me to be fully ready. I blame my knee problems! While my Cardio is doing fine, my mileage is wayyyy too low for me to get a good chronometer on the 9th of April. My current target is to complete the 42km in 4 hours. I believe this is something I can achieve easily providing my knee leaves me alone. ## Mqtt in go with paho [URL](https://opium.io/blog/mqtt-in-go/) Date: 2017-02-18 Summary: But why? I wanted to play with MQTT and TLS and that’s about it… I decided to go with golang. Mainly because I never tried the language before and because I wanted a single binary with no dependencies and C was not even an option (I’m too old for this shit). Why not using client cert authentication? While client authentication using public key is nice, I didn’t feel it brings enough added security in order for me to go through the hassle of having to manage a full PKI (as well as delivering client certificates) for a pet project. Authenticating the server using public key and the client using a login and password is plenty enough for a simple “I’m alive” mqtt publisher. However, there is a hmac function in order to ensure that a rogue client cannot impersonate another one (this needs to be set before each go build, obviously…). This requires some provisionning on server side obviously so both parties use the same psk for the hmac. ## Haveged & Alpine [URL](https://opium.io/blog/haveged/) Date: 2016-12-27 Summary: I’m growing more and more into Alpine Linux. It is a fast and lean Linux Distribution. In fact, this blog is running on Alpine along with Lighttpd. However, because the distro is generating very few I/O events, one should always be mindful of the entropy pool… This is especially true when the web server is only serving its pages over https… Checking the entropy pool on Linux is done through the /proc pseudo-filesystem. ## What The Favicons… [URL](https://opium.io/blog/favicons/) Date: 2016-12-27 Summary: I finaly decided to put the correct favicon for my blog… Back in my days we had only favicon.ico and we were fine with the 16x16 resolution. Nevertheless, screens got better so I fully understand that we need more options in order to accomodate for higher resolutions. However, the favicon mess is the epitome of why we can’t have nice^H^H simple things… <link rel="apple-touch-icon" sizes="57x57" href="/apple-icon-57x57.png"> <link rel="apple-touch-icon" sizes="60x60" href="/apple-icon-60x60.png"> <link rel="apple-touch-icon" sizes="72x72" href="/apple-icon-72x72.png"> <link rel="apple-touch-icon" sizes="76x76" href="/apple-icon-76x76.png"> <link rel="apple-touch-icon" sizes="114x114" href="/apple-icon-114x114.png"> <link rel="apple-touch-icon" sizes="120x120" href="/apple-icon-120x120.png"> <link rel="apple-touch-icon" sizes="144x144" href="/apple-icon-144x144.png"> <link rel="apple-touch-icon" sizes="152x152" href="/apple-icon-152x152.png"> <link rel="apple-touch-icon" sizes="180x180" href="/apple-icon-180x180.png"> <link rel="icon" type="image/png" sizes="192x192" href="/[…]-192x192.png"> <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png"> <link rel="icon" type="image/png" sizes="96x96" href="/favicon-96x96.png"> <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png"> <link rel="manifest" href="/manifest.json"> <meta name="msapplication-TileColor" content="#ffffff"> <meta name="msapplication-TileImage" content="/ms-icon-144x144.png"> <meta name="theme-color" content="#ffffff"> ## Comments are back [URL](https://opium.io/blog/comments-are-back/) Date: 2016-12-20 Summary: Ok, comments are back. I am not going to lie, configuring Content Security Policies for disqus on lighttpd is quite annoying because of the multiple domain disqus uses for delivering their service. However since I am not paying (with money) for the service, I won’t complain too much provided the anti-spam engine is top notch. ## A new blog… [URL](https://opium.io/blog/a-new-blog/) Date: 2016-12-05 Summary: I finally decided to move to a static generated blog. Mostly because of the “last” nodejs dependency “accident”, but mainly because constantly upgrading a software I’m barely using is not something I want to spend my time on… So stay tuned as I cutomize this new page and import old posts (unless I decide to get ride of the past blog posts just for the fun of it). edit: I finaly settled for the Goa Theme ## About me… [URL](https://opium.io/about/) Date: 2016-10-02 Summary: About me… I was born before the Intel 8088, making me part of the (old-school) “cool” 8-bit generation. I received my first computer, an Apple IIe, at the age of 6. After 5 years as Orange’s Group Chief Information Security Officer, I am currently serving as the Chief Security Officer at S3NS. About the “Wonderland” image… The “Wonderland” image is a direct homage to the original illustrations and work of John Tenniel for Lewis Carroll’s Alice’s Adventures in Wonderland. It was created using Gemini 3 with the following prompt: create an illustration for a blog on cybersecurity based entirely on the style of John Tenniel. The theme must be cybersecurity and Alice in wonderland. Image is black and white. Bonus point if the caterpillar is present. Use a white background. No text and No frills.