Hacker News Reader

Comment by sgt | Hacker News Reader

This is not new, and as per: https://www.oracle.com/technetwork/java/javase/terms/license... it was put in place in 2017 already. Seeing that the "LICENSE" of Java 8 simply points to their website, it means that they effectively changed it for Java 8 as well.

So that means that even if you're running Java, you have three options: (1) Continue using it illegally, it will probably be a low risk. This is not advisable especially for larger corporates. (2) Purchase JDK license (3) Switch to OpenJDK

View on HN

The situation is confusing but not that confusing.

Java 8 has commercial features that are locked by default. You can unlock them by passing a command line flag that looks like -XX:+UnlockCommercialFeatures, so pretty hard to miss.

If you use those in production, you're meant to pay. But virtually nobody does use them. In fact Oracle open sourced them all for Java 11, perhaps because of that fact.

Now in Java 11 there are two JDKs, that are virtually identical. OpenJDK and Oracle JDK. The latter is the same as the former but commercially supported. If you use it in production at all, you're meant to pay. But the only reason to do that is you want commercial support, from what I understand. There are no longer any special features. If you can support yourself (like most can) you just switch to OpenJDK as part of your Java 11 upgrade.

They have not changed the license for Java 8 users "on the fly", I'm not even sure that's legally possible.

The difference is that OpenJDK N will stop receiving security fixes the moment OpenJDK (N+1) is released. LTS releases are only LTS for Oracle JDK.

So no, OpenJDK by itself is not suitable for production use. To put a Java app in production securely you now need to either pay Oracle or find someone to provide security fixes to OpenJDK beyond what Oracle provides for free.

Security patches will be available for Java 11 via Red Hat, IBM and others (who have promised to do so). And the binaries will be built and made available here https://adoptopenjdk.net/ as well as via other OpenJDK build farms (eg. Azul Zulu).

Is there any path for security updates/LTS for deb based linux distros?..

Pardon me but AFAIK all JDKs are backwards-compatible. Unless you're doing some weird sh*t which exploits JRE bugs (oh, sorry.. features). But that just makes you a bad dev as you tie yourself to the implementation rather than specification. The _unsafe_ part being removed is not bckw_compat, I give you that. But if you're tied to this hole you're doomed to become legacy code maintainer as it's not coming back.

Just upgrade to OpenJDK_v(N+1) whenever it's out. Get rid of Karaf, Liferay or whatever is holding you back. Don't become a legacy app developer.

Thanks for clarifying. I went back to the BCL and it is indeed correct that the commercial features are listed under the supplemental license terms. Excerpt:

THE LICENSE SET FORTH IN THIS SECTION 2 DOES NOT EXTEND TO THE COMMERCIAL FEATURES. YOUR RIGHTS AND OBLIGATIONS RELATED TO THE COMMERCIAL FEATURES ARE AS SET FORTH IN THE SUPPLEMENTAL TERMS ALONG WITH ADDITIONAL LICENSES FOR DEVELOPERS AND PUBLISHERS.

How is this possible? I have an app that runs in the JVM which is also bundled with a JRE in some platforms. Does this mean that I cannot freely distribute it anymore?

Where I work we hit this 4 years ago, the basic outcome was that we could not use the JRE for anything without getting license.

Reply on news.ycombinator.com