Hacker News Reader

Comment by Am_I_Right | Hacker News Reader

Yeah, right. As if I'm ever going to allow anything Java-related on anything I manage again.

"This application requires JRE #" -- end-user Googles JRE # and downloads/installs it.

End-user organization gets sued by Oracle lawyers for 10K site licenses for JRE #. Sure, they COULD have downloaded OpenFerretMongrelAsphalt JRE Pi, but yet, here we are...

View on HN

Yep. It’s safest to classify using Oracle software as a business risk. After a due diligence evaluation it may be an acceptable risk, but you darned well better research it before assuming everything will be fine.

Isn't the recommended way of distributing Java applications nowadays to bundle a custom JRE with it? Wasn't project jigsaw especially created to be able to just bundle libraries and/or classes the application requires instead of the whole JRE?

Yes. The official stance of the OpenJDK organization is that there is no such thing as a "JRE" anymore, and applications are expected to use jlink or similar to bundle a customized Java runtime.

The distributions that matter here are for the JDK, which simply provides the "full" Java runtime along with developer tools such as javac and jlink.

Yup, you go and explain that to, say. Ubiquiti. Their network management software still requires end-users to download JRE v8 (and noothing else: it won't work). And, once end-users do that, they get sued by Oracle. But, serves them right, right?

Install OpenJDK's v8 JRE instead.

sudo apt-get install openjdk-8-jre-headless -y on ubuntu. Works fine with UniFi Controller. (what do you think they use on the cloud key?)

Yeah I can all hear the millions of people being sued for downloading JRE. Where are they?

Similarly the VirtualBox plugin package Trojan horse.

What is that?

VirtualBox is GPL2, but the 'extension pack' is under a personal use and evaluation license that doesn't cover commercial use. You're supposed to buy an Enterprise license for that.

The extension pack covers "Support for USB 2.0 and USB 3.0 devices, VirtualBox RDP, disk encryption, NVMe and PXE boot for Intel cards." according to the website.

My understanding of those (thus maybe wrong) is, that they are built on too of third party licensed code and patents. Thus opensourcing is hard and would require reimplementation. Thus choice is this model or nothing. One could also create those modules as open source versions, but there doesn't seem to be enough interest by independent folks ...

There most certainly is a world of options between "all open source" and "aggressively litigious jerks".

https://www.theregister.com/2019/10/04/oracle_virtualbox_mer...

I don't care too much about it, but I wonder whether the open sourcing of it and the Enterprise license for commercial use requirement are really orthogonal.

Nothing is forcing Oracle to "routinely check log files for downloads of the VirtualBox Extension Pack from nonresidential IP addresses and contact unlicensed users to enforce compliance" (per https://en.wikipedia.org/wiki/VirtualBox#VirtualBox_Extensio...). They could easily just say "this software is free for commercial and non-commercial use."

One could also make it not ‘free to download but we might sue your enterprise if it’s used on your network’.

The choice is not ‘this model or nothing’, Oracle is about the only company this aggressive.

Please see these Reddit posts:

(Apr 2018) - https://old.reddit.com/r/sysadmin/comments/8ffcg3/oracle_is_...

(Sep 2019) - https://old.reddit.com/r/sysadmin/comments/d1ttzp/oracle_is_...

You don't have to like (or use) Java or Oracle to recognize the JVM is an incredible platform to build upon.

> OpenFerretMongrelAsphalt

Ignorance is bliss, I guess. Your loss.

It went from Java to OpenJDK, to Eclipse Temurin (formerly OpenJDK from Eclipse Adoptium) or something. If that doesn't seem like a big mess to use I don't know what to tell you

If you follow Java & ecosystem at least a bit you needed to read one or two blog posts from reputable community members to figure out what the situation is and what to use.

To compare I find a licensing situation on mid-size (50+ direct dependencies) or larger project much harder to comprehend - you need to figure out what licenses are used, if they can be used at all due to the requirements and company's policy, if they are compatible with each other and what's required for distribution.

It is confusing from the outside though, trying to decide if you should use Java from your distro, from Oracle, Azul, Amazon Corretto, AdoptOpenJDK, Eclipse Temurin, or Red Hat OpenJDK. Which ones have might have builds for your various platforms, what support they might offer, how closely they track OpenJDK, etc.

One good example is what is meant by "LTS". You get different answers to that question depending on which JDK it is.[1]

I don't remember another language where it was ever this confusing.

[1] More detail: https://www.javacodegeeks.com/2019/07/long-term-support-mean...

I mean, just picking the best Linux distro for you or your company's particular use case is more confusing than this.

Linux was like that almost from day one, so it's expected. It's much less expected for a language.

The JVM isn't a language. Kotlin, Scala, Clojure, and Java are languages. I'm quite pleased there are an abundance of options when picking a runtime. Yes, Oracle has not been a good steward, so having numerous open and free alternatives is a positive thing.

Oracle bas been and continue to be a good steward. Who finished the open-sourcing of OpenJDK to the point where it is feature-equivalent to their OracleJDK? Who pays for 98%+ of developers actually working on OpenJDK, on which other companies build their tiny modifications to create a “new” runtime? Who finances GraalVM and other top-notch research?

You can hate oracle all you want for some of their other segments, but they are insanely good at managing the Java ecosystem and we should be thankful for that.

This is a very valid counter-argument and perhaps I've been influenced by Oracle's general reputation, as well as not fully understanding who is responsible for the various open-source builds. I agree that the JVM is a fantastic platform and if it's Oracle putting in most of the work and the funding then I take my statement back.

That's true, but a little pedantic. If you look at it from the lens of "I've picked a language (java), now I need to build and run/deploy things", it's a confusing ecosystem. There's good arguments for why things are the way they are. But there's not really a good argument that it's straightforward and simple.

You are not making a coherent argument. Once you have decided you're building your server app in Java, it is MORE difficult to evaluate and decide Ubuntu, Debian, Red Hat, CentOS, etc. than it is to pick a runtime. Whether it has been like that "from day one" to use your term, is irrelevant. Secondly, having choice is GOOD. Yes it adds a bit of confusion but I'd rather have options than not. If you want some overriding authority to make all the decisions for you, go build on iOS.

Why is the comparison to operating systems and not other development languages?

Lol, you just can't leave this alone. Choosing a JVM is about 99% less confusing than the last 20 years of .NET Framework/Core/Mono mess and all its sub-projects (ASP.NET, Silverlight, WinFX, etc). At least in Java if you target v.11 you know to install JDK 11 (or higher). Meanwhile if you write C# v8 you need .NET Framework 4.8 to run it. Or maybe .NET Core 3 - which is now called .NET 5. Then over in Python land you've got IronPython, Jython, Pypy, plus the need to keep v2 as "python" on most Linux'es and "python3" for running/building new stuff. Don't forget virtual environments so you can pip install one version of a certain package while keeping it separate from a different installed version of that same package elsewhere. Java is super simple by comparison.

https://stackoverflow.com/a/38506668

https://docs.microsoft.com/en-us/dotnet/core/dotnet-five

Just simply issue pkg-manager install openjdk and that’s it. Most vendors are just repackages of upstream, and you more than likely don’t need n years of support.

Most other languages don't offer long term support.

You can't run an old version of Python and continue to get security and performance backported fixes. Same thing with GO or Ruby or Swift.

I can't remember what Microsoft does for .Net, but I suspect you also need to always be on the newest CLR to get updates.

I think this is one of the major differences with the JVM, in a way, it has more options and vendors which should be a good thing, but it seems to mostly confuse people.

https://dotnet.microsoft.com/platform/support/policy/dotnet-...

Dotnet LTS versions have three years of support. LTS versions come out every two years, so there is a year of overlap.

The non-LTS (which they call Current) have 18 months of support.

This isn't how Java works anymore. The developers are supposed to be packaging the JVM with their application.

No, they're not. It's a silly idea with a pretty specific target audience. Most shops don't have time to waste on keeping their customers' JVM up to date by re-releasing their applications with new JVMs.

This feature is mostly useful when you want to ship a particularly stripped down version of the JVM for footprint reasons.

With docker, effectively we're ending up in that world anyway (lamentable though I find it).

For some languages developers package a whole browser for their app.

The JRE hasn't existed since Java 10.

Citation needed. Oracle JRE was free for personal use.

Oracle has proven themselves to be a litigious organization. You're not wrong that there are probably safe ways to interact with their organization's products but why bother when there are alternatives from companies that don't have such dirty legal histories?

But is use in a commercial environment personal use?

Reply on news.ycombinator.com