Hacker News Reader

Comment by politelemon | Hacker News Reader

Timely or topical, considering that O is now auditing Java.

https://www.theregister.com/2022/03/22/oracle_starts_to_incl...

If you're not familiar with O, or wondering why an innocuous statement like the above strikes fear into people, it's not about just licensing Java. It's about their extortionate tactics and how they try to catch you in gray areas due to ambiguous wording in their terms and conditions, and demand fees for violating them.

View on HN

Friendly reminder that if you install virtualbox with guest services at work, Oracle lawyers will eventually demand a huge sum from your company.

I consider the reminder friendly, but definitely not what it implies... Any source on this? By guest services, you mean the additional "click this to install some custom stuff in the running VM so it works better" step? And if so, just after doing that, or VirtualBox in general?

I did a tiny amount of searching to verify this but came up empty handed. Guest additions (what I think you meant) is GPLv2, so it should be free for use.

> Guest additions (what I think you meant) is GPLv2

It is presumably referring to “VirtualBox 6.1.32 Oracle VM VirtualBox Extension Pack”:

> Support for USB 2.0 and USB 3.0 devices, VirtualBox RDP, disk encryption, NVMe and PXE boot for Intel cards.

> The Extension Pack binaries are released under the VirtualBox Personal Use and Evaluation License (PUEL).

ref: https://www.virtualbox.org/wiki/Downloads

The difficulty in distinguishing the two is likely intentional. At my previous org, Oracle sent a spreadsheet of IPs to my company's compliance department which they claimed were using the extension pack and so violated their license agreement. They demanded proof of the license.

The vast majority including I, only ever used guest additions (GPL).

> The difficulty in distinguishing the two is likely intentional.

That would not surprise me. Back when we were considering virtualisers many years ago, the issue was one of the reasons² I recommended against vbox despite using it at home - it felt a bit too dark-patterny¹ for my tastes. We went with a VMWare tool instead.

[1] though I'm not sure the term “dark pattern” had been coined, or if it had it was in my vocab, at that point

[2] another being Oracles general behaviour at the time - this was after their purchase of Sun and therefore Virtual Box.

Have run into this multiple times with them in multiple companies.

For those asking, it's about the "VitualBox 6.1.32 Oracle VM VirtualBox Extension Pack" - it's free to install but phones home and they reach out after a year or two of use and attempt to coerce you into paying for a license. Just ensure everyone has uninstalled it and tell them to go pound sand.

What exactly are "guest services" in VirtualBox?

I think it refers to extra integration features like window resizing, clipboard read/write, drag-n-drop files between guest and host, etc.

Then he is wrong. That's GPL, you can get it installed straight from your distros's repo.

Those features are from VirtualBox Guest Additions.

VirtualBox Extension Pack, on the other hand, provides support for USB 2.0 and USB 3.0 devices, VirtualBox RDP, disk encryption, NVMe and PXE boot for Intel cards.

They were already doing some Java license auditing. Last year we were contacted about some small usage of Oracle JDK 8 they detected via auto-update checks from our corp IPs.

Our usage of Oracle Java 8 is classed as free still, and we pay Azul for the rest of our Java usage. I highly recommend Azul if you are looking for a vendor.

In the past the curse was “May you be recognized by people in high places”, nowadays it's "May Oracle learn of your existence". Nothing worse than learning that Joe Random from 3rd level techsupport installed Virtualbox, and now your entire organization is about to get audited by Oracle.

That article is just fud. OpenJDK any version is free to use for whatever reason, period.

If you use OracleJDK (which is pretty identical so unless you need support, go with OpenJDK), then you previously had to pay, but Oracle recently made the last version of it free to use. I mean, it really can’t get easier and freer. It is the same model as with Red Hat linux and fedora, hell, it is even more permissive as you can use the latest Red Hat version free of charge until the next one comes around (+1 year)

When a company Licensing is so complicated, that there are whole companies whose business case, is to help you negotiate with Oracle, it should make for pause and caution:

"Oracle Java Release 17 Is it Free Again?"

https://www.softwareone.com/en/blog/all-articles/2021/09/20/...

The company licensing around OracleJDK is complicated. OpenJDK remains licensed under GPL.

The only thing complicated here is that people seem to think that OracleJDK IS OpenJDK, it is not nor has it ever been.

OracleJDK is no different than Azul's JDK. It's a JDK vendored and supported by Oracle.

The long and short answer is, so long as you are using a JDK vendored by your operating system or a docker image that doesn't explicitly say "oracle jdk" you are and continue to be safe. There's no sneak lawyer trap that's going to spring. I've seen these claims ever since oracle bought sun and have yet to see oracle act in bad faith with their sun acquired open source software.

This is the long version, regularly updated over the years.

"Java Is Still Free 3.0.0 (Oct 2021)":

https://medium.com/@javachampions/java-is-still-free-3-0-0-o...

> That article is just fud. OpenJDK any version is free to use for whatever reason, period

It literally says that in the very article you claim to be FUD. Have you even bothered to read it? Because it says everything that you did.

You've just done the same. The article is referring to Oracle JDK. OP was referring to Open JDK.

The article literally says organizations are moving from Oracle JDK to OpenJDK.

From HN guidelines:

> Please don't comment on whether someone read an article. "Did you even read the article? It mentions that" can be shortened to "The article mentions that."

That's a great guide-line. I guess it could be generalized to "Don't refer to other commenters, only to the content of their posts".

Note that, confusingly, there is a difference between “Oracle JDK” and “Oracle OpenJDK”. The latter has no restrictions, but only receives updates for six months (until the next major version).

Oracle has a FAQ here: https://www.oracle.com/java/technologies/javase/jdk-faqs.htm...

First, you are muddying things because it’s not a product called OracleJDK vs a product called OpenJDK, it’s “Oracle’s download called (the) JDK” vs “a different download that can only legally be called OpenJDK.” More on that below.

It’s also more confusing than you indicate because you are excluding all historical context. The “regular” JDK everyone installed up until Java 8 was the “JDK downloaded from Oracle” and the open source OpenJDK was, for lack of better words, a knock-off with poor compatibility with a lot of enterprise software but used because you couldn’t include JDK in your distro’s package manager (even though it was completely free to use) because the license wasn’t GPL compatible. So everyone that cared about vendor-approved compatibility downloaded “the JDK” from Oracle as a tarball and used that. Those that were running home software could get away with using “apt install openjdk” instead.

After Java 8, Oracle pulled a huge switcheroo and said everyone should use OpenJDK instead, and their licensed customers could use the Oracle-provided JDK instead. They didn’t put it behind a paywall or even login, and left it available for free.

So if you missed the bit about OpenJDK being officially blessed to use or you continued to just go to Oracle.com to download “the JDK” for commercial use, you were now in violation. Some say Oracle licensing is never confusing by accident and the official recommendation to switch to a previously inferior alternative wasn’t a charitable move.

If you don’t know OpenJDK is what you want, you search for “JDK” and the only entity allowed to use the plain “JDK” moniker is Oracle. Even now, just Googling for “download JDK” gives you Oracle’s JDK (that’s twenty years of PageRank and inbound links pointing to what was once a “free” download - there’s no outranking that!) as the first result.

(Given Google’s IP history with Oracle, they should show “Did you mean OpenJDK?” and include those results too :D)

I use Corretto primarily to avoid Oracle.

Do you realise it’s still mostly Oracle code you’re running?

While using code that is mostly written by Oracle employees.

It is incredible how people keep missing the picture about OpenJDK main contributer.

I don't think it's Oracle's coders that people worry about so much as its sales model and lawyers.

Particularly, that it makes it too easy for end-users to stumble into using components that do not come under its open source licence. This makes it a headache for organisations and users, because it is very difficult for an organisation to police "you can use X, but you musn't pass Y command-line flag that could invoke a non-free part" and other actions that could create a liability for the organisation (and a disciplinary row for the employee)

It's a little like deciding you're going to set up a sweet shop, give out free samples, and lay landmines one foot either side of the entrance.

If they historically used a model more similar to JetBrains or other companies that have a commercial open source product (where the program looks for a licence key in order to activate the non-free features, or where there is a completely separate install process for free and non-free versions) I expect they wouldn't face the same regular criticism. It's the 'Surprise! Lawyers!" aspect that people find stressful and unattractive.

With JDK builds, this separation of free and non-free product is what the community has essentially provided: if you install something like Adoptium Eclipse Temurin, you can be a bit more confident it hasn't bundled non-free programs that could create a financial liability alongside it. You could try to track which Oracle downloads are what, but they've changed their licence from time to time, so some people find it easier simply to differentiate by what organisation provided the packaged JDK.

That is no different with OpenJDK, whose 90% is still mostly provided by Oracle.

This is like going for CentOS to work around Red-Hat doing most of the work.

Reply on news.ycombinator.com