Hacker News Reader

Comment by paradite | Hacker News Reader

Is this actually a trap? The "trap" page has a huge warning section that clearly tells you license has substantially changed and how to get open JDK, and what license it has.

> With JDK 11 Oracle has updated the license terms on which we offer the Oracle JDK. The new Oracle Technology Network License Agreement for Oracle Java SE is substantially different from the licenses under which previous versions of the JDK were offered. Please review the new terms carefully before downloading and using this product.

> Oracle also offers this software under the GPL License on jdk.java.net/11

https://www.oracle.com/technetwork/java/javase/downloads/jdk...

This information is either deliberately or accidentally missing in the post. If we assume the author did his research before writing this piece, I can only believe this was done with purpose.

View on HN

Not everybody reads warnings. Many will go to that page and just go straight to the download. In addition, the warning doesn't say "not for commercial use" - you have to click through and read a long legalese to find it. Oracle could still choose to make it clearer...

Many people are very used to clicking through Oracle's tedious licensing maze to download previous JDKs.

It's just another license to ignore. I'll personally do whatever I want regardless of what is in the EULA.

Oracle is notorious for auditing compliance with their database licenses, and shaking down their users for extra money in the event the auditors find something even slightly questionable. There are external consultants that make a pretty good living just preparing companies to withstand those audits.

They haven't been doing that with JDK licenses, so far -- as long as Java had licenses which didn't allow for this kind of gamesmanship. But now that the license has changed, it's a completely legitimate thing to get worried about.

Not sure where you live or what sort of company you work for but in my country & our company we cannot just have a fuck all attitude towards software licenses.

The USA and I've been doing it for two decades, honestly copyrights and licenses are not important to me. I have taken a fuck all attitude without consequence and will continue to do so forever.

Haha the plethora of GPL violations that exist without consequence sort of illustrate your point quite well.

You think if Oracle's legal team is after your company you get a free get out of license violation card?

Haha, I’m not playing that game because I’m lawsuit averse but I’m not surprised people are successful at it. This JDK includes telemetry so it just got a lot more dangerous to play but otherwise I’d guess license violations are pervasive at small shops.

even at big ones.

Though it "sounds bad", this is a wonderfully practical approach. Why waste a lot of time with this BS?

Because it’s a good way to get yourself sued

Unless you're a very large firm, it's actually not. They'll negotiate with you long before lawyers are involved.

The moral argument that code should not be restrained by artificial license, like we treat ideas, is a strong one but not made clearly here.

If code was treated more like ideas or recipes we'd all still have jobs.

If you believe that strongly enough, civil disobedience through ignoring licenses is one approach. No one should risk more than they're willing to lose on the position because you will lose if it's costing someone else enough.

It's not an act of civil disobedience. I just flat out give a shit. Also apparently I don't need to.

That won't work if your company goes through due diligence or ends up getting a licenses review from Oracle. You'll have to settle up then and it won't be cheap.

The Oracle license police live for situations like this.

p.s., If it's just personal use you are within the terms of the license.

There's no "long legalese."

The new license (https://www.oracle.com/technetwork/java/javase/terms/license...) is very clear. It states in plain English: "Further, You may not: use the Programs for any data processing or any commercial, production, or internal business purposes other than developing, testing, prototyping, and demonstrating your Application;".

How is that not clear?

This entire article is just pure FUD. Oracle has stated over and over and over how the new licensing model works. It's clear to anybody who spends a couple of minutes reading the documentation.

If you want to claim that 2000+ word terms are not legalese then so be it. Suffice it to say, I disagree. What is needed here is a summary in the warning box on the main page. Something like "Do not download this unless you want to pay us".

> How is that not clear?

You'd think it's clear, and yet I've joined projects where software with such terms was included in production builds because "it was downloaded with npm so it's open source."

Huge difference legally between running:

    npm install package

And having a user certify that they read a license agreement. I'll leave it to lawyers to talk about whether a user actually agrees to a license when they run "npm install", but Oracle's site at least requires the user to accept the license agreement by physically clicking a button. And I've worked at a lot of companies that drill into you that you do not click that button without approval from legal.

But you've had approval from legal the last 27 times you downloaded the Oracle JDK.

I get your point, but npm has the same issue even if you didn't accept the license. I mean, if you didn't accept the license that it comes with, then what license gives you a right to use it at all?

IMO, there's an argument that you implicitly license others in making your code available in a package manager such as NPM which requires no authentication or license clickthrough to incorporate code in your project, unlike the .net or other PMs where license terms are presented and require click-through agreement.

Not saying anyone should stake any bets on that argument winning, just that it wouldn't likely be summarily dismissed in court and would at the very least factor into the damages calculation.

Will be interesting to see if any cases like this ever get adjudicated and precedent set.

What implicit license, though? GPL? BSD? Something else? I feel like developers have a tendency to gloss over these things as if all FOSS licenses are the same, but they really aren't.

What's unclear to me is how I would be running afoul of the licensing terms if I used the non-free version of the JDK to develop Java software. Because "developing, testing, prototyping, and demonstrating [my] Application" is exactly what I'd be using the JDK for.

Not a lawyer, but my assumption is that the clause state you can develop an application, but cannot run it in production/sell it.

Easy loophole, infinite open beta, continuous integration, rolling release. At which point, with which release would it turn from beta to commercial full gold master? Slippery Slope that. A better wording would be "if you make money, we want a cut, or you get a cut, got it?"

Not a lawyer either, but the license says that the "Programs" (meaning the JDK) may only be used for these purposes. Once I write my application, it will be running on the JRE, not the JDK.

Iirc there is no jre in 11, just jdk, also Oracle is not dumb they likely have a clause covering your "loophole". Finally why would you develop on Oracle jdk and run on open. Seems like an easy way to get bugs.

Ah. I wasn't aware there was no separate JRE.

The majority of people don't download the JDK via this method (eg. a package manager) and will miss that big box about a license change.

Edit: Plus even if they aren't you still have the general mindset of "next next install close" where people are so normalized to getting something like that, to test or deploy it would be very easy to miss - given the license of the previous versions it would be an expectation that you would also be able to use the next version for commercial use also.

Although Oracle are perfectly within their rights to change the license, that doesn't mean it's not a dick move and a scummy thing to do.

Anyone installing JDK via a package manager would be installing the GPL version.

Absolutely not. We are installing via a package manager the Oracle issued RPM for example. I would have missed the licensing story if Joda was not writing an article about it.

How is that possible? Are you going to the Oracle download page and downloading the RPMs? Are you specifically adding a repository that includes Oracle software?

There are certainly no default repositories that include this code. The whole point (and it's been this way for years) is that you can't download the Oracle jdk without clicking through a license.

New JRE/JDK gets released -> somebody from our company goes and downloads the RPM after accepting the license -> she uploads the RPM into our internal repository -> somebody from another department changes the build scripts to use the new JRE/JDK -> few minutes later we are running the dev clusters with the new JRE/JDK.

In this process the person who downloads the new RPM (aka me) has to be 100% sure that the new JDK is ok to be used. Which I completely missed (my bad) I was wondering about the GPL stuff a bit but I was thinking that Oracle came to their senses and started to distribute the JRE/JDK under a license that is better than the previous one. Again, my bad that I paid attention more to the performance improvements, modules, ZGC etc. than to the license changes. This is why I was surprised when I saw the article from Joda (his real name is Stephen?) and also upvoted, sent around to all my Java peers to be aware that this is absolutely, 100%, pure fuckery that Orcle just dumped on us.

Sounds like your company needs a better processes on how proprietary code is distributed internally. Most companies have a review process for thins like this.

The download page [1] has a large bold warning that the license terms have changed. What else would you like them to do?

[1] - https://www.oracle.com/technetwork/java/javase/downloads/jdk...

Hmmm. At most you're mad because the bright yellow warning box that tells you specifically to re-read the license because it changed is not clear enough for you, even though apparently being sure about exactly that is your job.

I'm not sure you can blame Oracle for this. They could I guess give you a tl;dr summary in the box. But, how long would it take you to study the new situation? A few minutes?

I am not mad. I am thankful. And yes I am a ignorant engineer who cares more about features than legal crap. The only thing I am 100% sure is that I am not alone.

If you don't care about all aspects of your software, including security, ethics, and legality, you are not an engineer. Engineering implies professionalism.

It's debatable whether there are any true software engineers (we're certainly not licensed like traditional engineers), but all software professionals should be concerned about licenses. It's part of the job, as are all ethical considerations of your work.

It's fairly common to automate that stuff away, and not just for Oracle.

For example, if agreeing to TOS was neccessary, Let's Encrypt could no longer be "totally automated". Therefore certbot has an "--agree-tos" option, present in oh so many ansible repositories.

How do you automate that? You need some kind of cookie to download JDK and you're getting it by clicking a button. The only way to automate it is to simulate "agree" click.

I'm not saying I'd write an "I Agree" bot, but I've certainly written scrapers of comparable or greater complexity, and I'd be quite surprised if there was nobody that did this.

If you haven't written a bot, but you habitually download the JRE/JDK from Oracle's website, accepting the license manually each time, is there really a difference? How many people are rereading the license each time they do this? I would guess the number of people that do this is roughly a rounding error above 0.

Writing an "I Agree" bot without checking out what the license was...

Entering a contract without checking out who the customer was ...

Curl lets you keep a cookie jar around, for example, so yes, it's pretty simple. It's also a terrible idea, but doesn't seem to stop people.

You'd have to update the URL anyway because the v8 JDK hasn't changed, from what I remember. So those scripts wouldn't be affected.

The new Java has telemetry. Oracle will be coming for you. One of the reasons we don't run it is so we don't send them telemetry from prod... Nor so that we have a risk of the telemetry send breaking prod.

They won't be coming for you. What prevents you from blocking outgoing telemetry?

It's not just telemetry.

It's also social media.

Online surveys.

Everybody and your servers needs to keep mum about it or otherwise you'll get a call.

You think I'm making this up? I've worked at two places where we were in contact with Oracle police because they thought we used (more of) their software.

These are likely biz dev / sales reps trying to drum up extra business, not lawyers. Calls and emails are easily ignored. I do it every day.

You ignore it, they move on to the next sucker. The people responding are the ones they'll work with.

I think license changes are common enough that the reaction to such a thing is often "yeah, whatever." Most of the time, these sorts of things are not actually that substantial

So they're turning a well known product that was free for decades into an expensive enterprise offering. And you're saying that calling it a "substantially different" license is a warning?

In my book this is not a warning at all. This is clearly an attempt to mislead without breaking any laws.

Reply on news.ycombinator.com