Hacker News Reader

Comment by JoshuaAshton | Hacker News Reader

The majority of people don't download the JDK via this method (eg. a package manager) and will miss that big box about a license change.

Edit: Plus even if they aren't you still have the general mindset of "next next install close" where people are so normalized to getting something like that, to test or deploy it would be very easy to miss - given the license of the previous versions it would be an expectation that you would also be able to use the next version for commercial use also.

Although Oracle are perfectly within their rights to change the license, that doesn't mean it's not a dick move and a scummy thing to do.

View on HN

Anyone installing JDK via a package manager would be installing the GPL version.

Absolutely not. We are installing via a package manager the Oracle issued RPM for example. I would have missed the licensing story if Joda was not writing an article about it.

How is that possible? Are you going to the Oracle download page and downloading the RPMs? Are you specifically adding a repository that includes Oracle software?

There are certainly no default repositories that include this code. The whole point (and it's been this way for years) is that you can't download the Oracle jdk without clicking through a license.

It's fairly common to automate that stuff away, and not just for Oracle.

For example, if agreeing to TOS was neccessary, Let's Encrypt could no longer be "totally automated". Therefore certbot has an "--agree-tos" option, present in oh so many ansible repositories.

How do you automate that? You need some kind of cookie to download JDK and you're getting it by clicking a button. The only way to automate it is to simulate "agree" click.

I'm not saying I'd write an "I Agree" bot, but I've certainly written scrapers of comparable or greater complexity, and I'd be quite surprised if there was nobody that did this.

If you haven't written a bot, but you habitually download the JRE/JDK from Oracle's website, accepting the license manually each time, is there really a difference? How many people are rereading the license each time they do this? I would guess the number of people that do this is roughly a rounding error above 0.

Writing an "I Agree" bot without checking out what the license was...

Entering a contract without checking out who the customer was ...

Curl lets you keep a cookie jar around, for example, so yes, it's pretty simple. It's also a terrible idea, but doesn't seem to stop people.

You'd have to update the URL anyway because the v8 JDK hasn't changed, from what I remember. So those scripts wouldn't be affected.

New JRE/JDK gets released -> somebody from our company goes and downloads the RPM after accepting the license -> she uploads the RPM into our internal repository -> somebody from another department changes the build scripts to use the new JRE/JDK -> few minutes later we are running the dev clusters with the new JRE/JDK.

In this process the person who downloads the new RPM (aka me) has to be 100% sure that the new JDK is ok to be used. Which I completely missed (my bad) I was wondering about the GPL stuff a bit but I was thinking that Oracle came to their senses and started to distribute the JRE/JDK under a license that is better than the previous one. Again, my bad that I paid attention more to the performance improvements, modules, ZGC etc. than to the license changes. This is why I was surprised when I saw the article from Joda (his real name is Stephen?) and also upvoted, sent around to all my Java peers to be aware that this is absolutely, 100%, pure fuckery that Orcle just dumped on us.

Sounds like your company needs a better processes on how proprietary code is distributed internally. Most companies have a review process for thins like this.

The download page [1] has a large bold warning that the license terms have changed. What else would you like them to do?

[1] - https://www.oracle.com/technetwork/java/javase/downloads/jdk...

Hmmm. At most you're mad because the bright yellow warning box that tells you specifically to re-read the license because it changed is not clear enough for you, even though apparently being sure about exactly that is your job.

I'm not sure you can blame Oracle for this. They could I guess give you a tl;dr summary in the box. But, how long would it take you to study the new situation? A few minutes?

I am not mad. I am thankful. And yes I am a ignorant engineer who cares more about features than legal crap. The only thing I am 100% sure is that I am not alone.

If you don't care about all aspects of your software, including security, ethics, and legality, you are not an engineer. Engineering implies professionalism.

It's debatable whether there are any true software engineers (we're certainly not licensed like traditional engineers), but all software professionals should be concerned about licenses. It's part of the job, as are all ethical considerations of your work.

The new Java has telemetry. Oracle will be coming for you. One of the reasons we don't run it is so we don't send them telemetry from prod... Nor so that we have a risk of the telemetry send breaking prod.

They won't be coming for you. What prevents you from blocking outgoing telemetry?

It's not just telemetry.

It's also social media.

Online surveys.

Everybody and your servers needs to keep mum about it or otherwise you'll get a call.

You think I'm making this up? I've worked at two places where we were in contact with Oracle police because they thought we used (more of) their software.

These are likely biz dev / sales reps trying to drum up extra business, not lawyers. Calls and emails are easily ignored. I do it every day.

You ignore it, they move on to the next sucker. The people responding are the ones they'll work with.

Reply on news.ycombinator.com