Let's have a chat about Java licensing, says unsolicited Oracle email | Hacker News Reader

Let's have a chat about Java licensing, says unsolicited Oracle email

theregister.com

61 pointsrntn63 comments

Before all the FUD comments appear:

- OpenJDK is the reference implementation, it has the same license as the linux kernel, and almost all of the “alternative” JDKs you might have used are all repackaged OpenJDKs with minimal patches. OracleJDK is also like that.

- Java is completely free and libre. You can choose to pay for it the same way you can seek out Red Hat for a paid support license. The kernel/OpenJDK itself is completely open-source.

- OracleJDK itself has a “freemium” model, where you can use the latest LTS release freely, until the next one comes along (plus one year).

- Open JDK is being developed like 90+% by developers employed by Oracle

Companies using the OpenJDK should be fine[1]. If you're using the OracleJDK with LTS though, you'll need to pay up.

I wonder how Oracle knows which contacts to email. Does the Oracle Java SE phone home?

1 - https://medium.com/@javachampions/java-is-still-free-3-0-0-o...

> I wonder how Oracle knows which contacts to email.

Track downloads by IP, map IP to company network, call that company. The same way they're using for VirtualBox.

> Does the Oracle Java SE phone home?

Never heard of that and I doubt it.

They senza email to people in their cms (if you have other contracts) or browsing your web site... sending to the wrong people of course especially if your web sito is not in English.

Received a mail for VirtualBox 10 days ago.

This happened at my former workplace for the VirtualBox Extension Pack, so legal told IT to just block their domain all together and to scan for it being installed. We instead used VMWare since we had site licensing for it.

What point is there in using OracleJDK over OpenJDK?

I've seen a few reasons in big-corps. To list 2:

1. Old version, and security updates are still required

There's some critical piece of legacy software that has only been tested and observed to work on an old version of the JVM (e.g Oracle JDK 8).

The cost of decommissioning the software OR upgrading and re-testing on a later JDK OR switching to the OpenJDK (without security updates...) is perceived to be more expensive or in breach of company policy versus paying licensing fees.

2. Use of proprietary or deprecated APIs

Either company code or that of a library dependency has reliance on proprietary or undocumented Oracle (or Sun) APIs and toolkits that aren't supported in OpenJDK.

The chances that the existing team members, or the current army of "Spring Boot Microservice Developers" will be able to rationalise or unwind this code in a reasonable time frame is slim.

Though to be fair I haven't seen #2 in some time now.

Some people feel it's more "original" or "pristine" build. Oracle develops Java, surely they know better how to build it and surely they'll patch it before others.

Though at that point I wouldn't touch anything Oracle with a long pole.

It used to have some differences in UI and text rendering because those components could not be open sourced. Now they are effectively the same for the current version, but obviously older versions may differ in the number of security or performance fixes that get Back ported.

Don't know about now, but many versions ago, Android Studio, just doesn't not start in OpneJDK. It is mainly the UI my guess is. It requires one to install OracleJDK to work. Don't know if it is still the case or not. For most headless stuff, I would image there shouldn't be any difference.

not everything runs on OpenJDK.

I wonder what the handful of exceptions are. There can't be many, but maybe they are Enterprise applications.

I've posted one example in the other reply to my post.

Do you have examples? I haven't seen any in a decade and now OpenJDK is almost the same as any vendor JDK, with small exception of bugfixes that might be included in given vendor JDK before it is merged back to OpenJDK repo.

I had the displeasure of working with Cisco ASDM software, which specifically didn't work with it. Maybe that's different now, but back then even their purported 'openJRE' versions were garbage.

> I wonder how Oracle knows which contacts to email.

It's oracle. They know how to get hold of people. Their business model has involved sending threatening letters/emails to people to try to get them to cough up additional license fees since at least the early 90s. It used to be "let's talk about your oracle license to check you aren't running it on more cores than you told us about", now they have just changed to threatening people about JDK licensing. On the database side, for some time their tendency to threaten/harass their customers has been so bad that if you're in tech leadership you'll find there is a cottage industry of consultants who cold-call you offering to help you with your oracle license audit[1] just because its so common and unpleasant for businesses to have Oracle audit their license usage trying to squeeze more cash out of you.

[1] Whether or not you have an audit or indeed use oracle products at all.

Although it doesn’t look like they still do, they used to require an account and email address in order to download the Oracle JDK.

Even got some spam emails for Oracle Cloud as a result!

Alternatively, you can downgrade to a version before the license changed, ie: JDK 8u202 and earlier.

And then get hacked through one of the tons of known vulnerabilities in that version.

That is what firewalls and isolated networks are for. No need to make everything accessible to the world wide web unless you are out to be pwned.

Nobody should talk to Oracle without their company lawyer present. I am sure Oracle has a variety of shady techniques to determine the version of Java you are running.

Oracle's modus operandi is why I try to be vigilant against installing their VirtualBox extensions.

It seems like the kind of trap in which one could easily ensnare himself.

I'm genuinely curious what kinds of companies pay for Java SE, other than out of goodwill. Do some of them have frequent problems with the VM, for example?

From what I understand, a Java SE Universal Subscription (which should be the one at 180$ /year per employee) gives you the right to use GraalVM Enterprise [1], which has a number of feature not available in the Community Edition [2]. This may be worth something to some, although it may be cheaper to use Oracle Cloud which gives you the same right.

(This is assuming that I understood the things correctly, which is not a given at all with Oracle)

[1] https://www.oracle.com/java/graalvm/ [2] https://www.oracle.com/a/ocom/docs/graalvm_enterprise_commun...

I believe everything in Graal is now free to use, as of a month ago or so

You can use Graal Enterprise for free, since a few months ago.

Ah good to know, although I am a bit wary of a license from Oracle that is not a standard open source one :-) (The FAQ says it is free also for commercial use, so I will investigate)

I imagine one case is those that outsourced app development to some consulting firm, get the software back complete with 1y licence (+licence admin fee for the consultant's trouble, naturally) and then just renew it when prompted because of course. Or it's not supplied with one, but when contacted by Oracle the only negative thought they have is directed it at the consulting firm (grr why didn't they tell us about this).

My guess would be ones where the cost of internal processes to change to a different JRE/JDK is more expensive than the cost of Oracle's license. Or where incentives are misaligned enough that it appears that way for whoever has to make the decision.

Probably some overlap with companies using Oracle's Database.

If your company is selling a product and you want to package the JRE with it, you have to pay for the license

But couldn't you package an OpenJDK JRE build with your product instead of using the Oracle JRE, and thus not need to pay anything?

Probably yes, depending on the license of OpenJDK, but if you want Oracle JRE, you have to pay

Buy why you would want OracleJDK instead of OpenJDK? Those are nearly identical.

Also is this the case if you use jlink (and/or jpackage)?

BTW. JRE is no more since JDK 9, and Oracle doesn't offer it (but other vendors do) - so in case of Oracle builds one hase to use jlink or package whole JDK.

My guess would be you have some kind of safety net by having a company to turn to in case of issues, you probably can request new features, you may have better performances (since the implementation is different) etc...

Not saying what is best/worst, it's mostly a matter of opinion / contracts in the end.

The implementation isn't different, so there shouldn't be any performance difference - the Oracle JDK is a lightly modified build of OpenJDK.

That only applies if you're using a commercial distribution. You can always use a free distribution like Eclipse Temurin or Amazon Corretto for most of the usecases.

it is strange why anyone would pay for the oracle jre when you can pick from one of many implementations that are free. There are some tiny differences in the oracle jdk but just try to swap them out, it should be pretty easy

Why not just auto-download the openjdk?

"Hi there, it seems that you are using a computer. You owe us money"

Oracle must really be desperate.

They are not desperate, from what I recall that is their modus operandi for quite long time.

It’s hard to tell from the article, but it sounds like these are all people who have existing licence deals with oracle for Java, and this is about getting them to pay more.

Yeah it seems like this communication is maybe more targeted towards non-tech businesses where they wouldn’t necessarily know if the solicitation or inquiry applies to them, since “Java” is and has been bundled with tons of desktop and server software for decades. A tech-focused company would be better-informed and possibly already using openJDK, possibly allowing then to safely ignore or respond with a polite “fuck off”.

I think the OracleJDK costs $15/month/employee [0]. Can this be right? This costs more than Windows.

Is the idea that only people who really need oracle will run it so they just jack the price up? This is very different from when I worked in Java and the jre was free. I can’t think of any reason to build in java if this is the price of the runtime.

[0] https://www.oracle.com/java/technologies/java-se-subscriptio...

It's only the price for oracle's build, which is naturally the version they push. The source is still open, so there's plenty of third-party builds which are actually free. It's effectively an ignorance tax (which is ethically dubious at best), or a very expensive support contract (both of which fit into Oracle's MO nicely).

It’s more than an ignorance tax as most organizations (mine included) won’t install software without support. Even though the JRE doesn’t really have much support activity, (I’ve never experienced any bugs or done anything other than update in 25 years).

Anyone smart just uses one of the many different OpenJDK versions, which are free and open source. (I personally use Eclipse Temurin.) OracleJDK is a trap for enterprises that don’t have a connection between the decision makers and the license payers.

This is really great marketing for Microsoft and .Net

Modern .Net doesn't really have a similar concept to the Java Platform anyway. The Windows-only .Net Framework did, but the last major release of that was back in 2019 (it still gets security updates, but not feature).

These days .Net applications are fully self-contained, cross-platform, with everything you need in the bin. Unlikely Microsoft could go after people similarly even if they wanted to.

I definitely feel bad for Java developers, Oracle has ruined Java's reputation and made companies more careful around it even if they may not be impacted.

As a Java developer I'm quite pleased, happy with Oracle's stewardship. Tired of the articles and commenters on articles that use FUD to smear Oracle. Guess Microsoft and Amazon are really worried about Oracle Cloud's rise, Java gets stronger and .net still sucks.

Hmm, Java is more open than ever, and the development of the JVM is more vibrant than ever. For over 99% of people, OpenJDK (or any other similar distribution) is all they will ever need.

As a Java developer, I am certainly much happier now than I was 15 years ago when Sun couldn't invest more in Java development.

Disclaimer: I work for Oracle, but not on Java/JVM.

This is a lot of FUD around Java with no substance at all. If you're afraid of the platform owners being in your way you should go with Java and not with Microsoft.

The JDK is under the same GPL 2.0 license as Linux, which is a rock solid way to ensure nobody can ever make it less open source. Several big players are contributing to Java and due to it being GPL licensed everything is open source.

For the .NET ecosystem it's still 99% Microsoft with virtually no others contributing. And it's only MIT licensed so anybody picking it up in the future can do so without contributing back to open source.

Oracle JDK 8 includes something called Web Start, which was a cool way of having a client Java executable that would be updated when you reloaded it from a web link. It used to be a real pain to manage updating clients in client-server apps before everything went web. I worked for a shop that had a complex GUI deployed this way. Web Start is not open source, and some of the free reimplementations didn't work. (OpenJDK does not include it).

To be clear:

OpenJDK refers to different things. One of the things it refers to is an open source repository. (a git repo, to oversimplify things). It also refers to a 'packaging' - more on that later.

OpenJDK (the repo) is source code, not something ready-to-install or distributable on its own. It's open source. Anybody can 'package' it - compile it, wrap an installer around it, put that on a website. Make some arrangement about keeping it up to date (which may involve putting in the license click-through: Hey, you're on your own). Lets call that a 'packaging' of the OpenJDK project.

Packagings come in many flavours. They are all effectively identical, in that it's just a different party running the build script and sticking it on their website. Some _do_ add tweaks (generally, in the form of backports of security patches) but they either don't or these tweaks are in such exotic areas you are extremely unlikely to run into them.

Some versions are blessed by oracle as 'LTS' - Long Term Support. In theory this is a made up thing that only applies to one of the 2 packagings oracle releases. In practice every packaging that makes a distinction between support duration follows oracle's LTS schedule.

The common packagings:

* Oracle JDK - this is a __commercial__ offering, for all versions, though there is a 'developer release' that costs nothing, but __only__ for the most recent version. The concept of a long-term version applies partly to the actual commercial license (in that _all_ versions enjoy long support, with LTS versions longer) - and doesn't apply at all to the dev release, in that the day a new release of OpenJDK (the source repo) shows up is the day the dev release of the previous version ceases to be supported. LTS version or not. * Oracle's OpenJDK - this is a free release for developers that does not engage in LTS anything. The day the source repo has a new major version is the day the old OpenJDK version is no longer supported regardless of LTS. __Hence, do not use this, even though it is the most popular, unless you really know what you are doing__. * Adoptium is a packager that follows the LTS schedule, and is run with FOSS ideas. This should be your default choice. * Azul is a commercial entity that offers a boatload of packagings. Including JREs (JDKs without the dev parts, e.g. without a compiler) which aren't really a thing anymore. * Amazon offers corretto, which is a packaging that they explicitly test on AWS servers. Free, and follows the LTS schedule.

In general I strongly recommend you get Adoptium or for AWS-specific interactions perhaps Corretto (but adoptium runs just fine on EC2 if you prefer this).

If you do that, this 'java licensing' thing is completely irrelevant to you.

Adoptium now called Eclipse Temurin and it seems a de-facto open source Java distro nowadays. I used to choose other distros, in particular Azul and Liberica (because Adoptium didn't run JCK tests at that time), but today I think there's no reason to choose anything but Temurin if you don't need paid support. They have docker images, including alpine one and arm64 one (not alpine arm64 sadly), they have macports package, what else one could wish.

"de-facto open source Java distro" ?

You mean "open source build for Java", because OpenJDK is open source, here: https://github.com/openjdk/jdk

One can build JDK themselves, it is not that hard.

JDK is a set of multiple artifacts: JVM, compiler, standard library, other tools (keytool, etc).

That's why I call it "distro". Matter of terminology, I guess.

But all of those are in OpenJDK repo, so is de facto open source, just like linux kernel. You can't call a deb package with kernel as de-facto opensource, because that is just a package not the source.

Especially that they do basically no development at all on said sources. It is almost completely financed by Oracle.

It definitely feels like things have coleasced around Termurin. I am under the impression Red Hat and Azul, etc, contribute, even though they have their own offerings.

There have been a lot of really interesting developments in Java over the past few years, however I'm reluctant to actually build anything on the language because of the company attached to it. I don't think I've ever read about anything coming from Oracle which wasn't on-the-surface bad or something that at least makes me side eye them.

https://news.ycombinator.com/item?id=36600512

These articles are FUD with zero relevance to basically anyone. They build on fear/hate of Oracle, without any news content.

Feel free to play with the language, it has improved a lot and the ecosystem around the whole platform is absolutely flourishing. Even if Java - the language - itself is not your thing, there are many high quality JVM languages that can make use of the fantastic ecosystem.

I've had these from Docker too, assume they just blast out to companies hoping to get some incriminating replies.

Well, one of reasons why I rather dodge the big-O.

I wonder if this strategy came after they failed the case against Google...

Reply on news.ycombinator.com