Hacker News Reader

> Virtual Machine Manager

Do you mean Red Hat's Virtual Machine Manager, AKA virt-manager (https://en.wikipedia.org/wiki/Virt-manager), or Microsoft's Virtual Machine Manager (https://learn.microsoft.com/en-us/system-center/vmm/?view=sc...), or Synology's Virtual Machine Manager (https://www.synology.com/en-global/dsm/feature/virtual_machi...)? I'm guessing the first one?

I use VirtualBox for trying things out or sandboxing, mainly because of the friendly GUI, but wouldn't mind switching to something as friendly that's not Oracle's.

> Be specially careful when installing their extension pack, as it is an evaluation license.

Our company was targeted by Oracle Sales because they detected mere _downloads_ from our IP range. They couldn't prove any installations, but of course wanted the company to pay for commercial licenses.

Im not sure about the details, but in the end I think we bought a couple of licences & then blocked all URLs for the extension pack company-wide.

Is this even legal? After such an intrusion I wouldn't ever want to have anything to do with Oracle.

Hence the blocking of said URLs afterwards.

There are companies that weaponize the use of tracking to the point that just a visit from your IP address can result in leadgen.

For instance Lead Forensics, but there are others in this space as well.

> Is this even legal?

Probably not. But how would you feel about going up against Oracle's legal team to make the point? They, and other large companies, rely on this a lot when deciding upon whether or not to use dubious practises. I think Oracle's main business has become litigious & licensing arse-hole-ary, with everything else in their portfolio existing to support those functions, so they are rather good at it.

> After such an intrusion I wouldn't ever want to have anything to do with Oracle.

This sort of thing is why many people are wary of Oracle. The company has considerable form for this sort of thing and worse.

Happened to me on a VPS also

I had sales drones get me just for downloading VirtualBox as a whole from our IPs. They sent me an email, tagged High Importance even.

"My name is <name> and I am part of Oracle Open Source Linux & Virtualization team. I have got an internal notification from my team that you have shown interest in Oracle Virtual Box... I would like to schedule a time with you to discuss the use cases in your organization, our recent version 7 announcements, and how Oracle can assist you in getting the maximum value from this offering..."

Oh I remember about 10 years ago doing the migration from Oracle JVM to OpenJDK. I think it would have been around the Java 6 period, but there were all sorts of small things that I didn't think would be an issue that ended up cutting us.

The two main ones were a font, which I don't remember exactly which or why but I think it was to generate PDFs and it came bundled with the Oracle JVM so the PDF library defaulted to it. For Open JDK there was an extra setup step to install a RedHat font, but it was confusing when a pdf comes out garbled because you switched your JVM. But I could be mixing up my issues.

I think the other was built in certificates, but it was too long ago now.

Having a fun time at the moment with Java 11 to 17. The application has extensive Lombok, so nothing quite works the same. I've had less pain migrating from Python 2 to 3.

Yeah, Lombok doesn't use standard, supported APIs. They even say in their docs, what they're doing could become incompatible for future java versions at any time. Not java's fault really.

It is for this reason I don't use it (also I don't like too much magic, but that's me).

> I don't like too much magic

Not just you. 'Magic' seems great until newer members of the team have no idea how it works and just use it - then things get painful.

I dislike Spring JPA for the same reason.

It just magically understands your query based upon the name of the function.

There is far too much "magic" going on these days which has a massive learning curve for the newbies, and a headache for everyone else when something stops working because they've changed how the incantation works.

Yeah, I didn't pick it and this is an inherited codebase that I'm trying to bring up to date while I still have overlapping Java 11 support.

I haven't picked it in the past except for a toy project, to experiment with Lombok.

It has some interesting ideas which would be nice if they folded it into Java, but while it's fringe it ends up being a liability.

Yes! Then we could call it "kotlin" :)

Hopefully not.

> val a: Int = 1

I wouldn't want to inflict that on anyone.

You don't need to have the "int" there, though, right? You can just do "val a = 1" [0]

Don't get me wrong, I still pick Java over Kotlin, but I thought ktl had type inference. Even Java has "var a = 1" now. I just wish we had optional named parameters in Java, that's like, my biggest issue with the language.

[0] https://www.oreilly.com/library/view/kotlin-programming-the/...

I took that example from the Kotlin homepage. I've not used Kotlin, but since Scala recommends that you include the type declaration if you know what it is, I assumed that Kotlin did as well. If their example is bad, then apologies!

Optional named parameters and also default values would be great.

The stuff that gets used by the most in this codebase is the `allParameterConstructor` for enums and the `slf4j` annotation. Without those two I could probably remove the Lombok dependency.

> Their VirtualBox license FAQ [1] gives them enough leeway to change future licenses at will. If an exploit is discovered in your old VirtualBox and they've changed the license, you're out of luck.

That only applies to the optional Extension Pack. The base software for host and guest is GPL v2, as described in the FAQ you linked.

----

Will the licensing terms of the VirtualBox base package be changed in the future?

We are not currently planning to do so, but it doesn't really matter. The license that applies to the VirtualBox base package is perpetual and cannot be taken back unless you violate the license. Even if Oracle were to change the license again, this would only affect future versions, and anybody still in compliance would still be permitted to redistribute the existing VirtualBox code under the terms of the GPLv2.

----

> this would only affect future versions,

I think this is what the parent commenter was saying:

> If an exploit is discovered in your old VirtualBox and they've changed the license

I think the point is that the patch for a critical security vulnerability _could_ be gated behind a license change.

Seems unlikely though even for Oracle. If it did happen I expect someone else would come up with a freely licensed fix and that would be shipped by all the distros.

I prefer libvirt/kvm anyway. :)

Not only that.

In past oracle lawyers have send huge bills to companies after someone in their IP range had used virtualbox guest editions (which is not free for commercial use).

> virtualbox guest editions (which is not free for commercial use)

This is false. https://www.virtualbox.org/wiki/Licensing_FAQ says:

> the VirtualBox Guest Additions are licensed under the GPLv2.

You might have been thinking of the VirtualBox Extension Pack, which is an entirely different thing.

But it's pretty hard not to use the Extension Pack.

I don't think I've ever needed an extension pack feature.

You used to very much need it as it improved performance, display resolution and I/O significantly.

Oracle could not milk VirtualBox for money so they used this as a way to extort unknowing commercial users.

How is it hard? It is a separate download and install.

Sure, but it's reasonable for most people to expect an extension they've downloaded from within the app itself might have similar licensing as the app itself.

Even if it isn't reasonable to do so, I suspect most people do indeed do so, and that's exactly what Oracle is counting on.

> from within the app itself

Where in the App does it download the extensions? I know it will download the Guest Additions for you, but those are something completely different.

How? It doesn't add any functionality relevant to most users and you have to download it separately from Virtual Box itself.

It was required (at least used to) to use USB2.0/3.0, RDP compatibility, PCIe passthrough. I remember having to download that, so my guess is either I'm not typical user, or there are two different worlds with respect to how VBox is used.

1: https://docs.oracle.com/en/virtualization/virtualbox/6.0/use...

I think it's extremely uncommon for most people to need either rdp or PCIe passthrough, and I'd guess it's still quite uncommon (though more likely than the previous two) to need usb passthrough.

I have been using Virtual Box for years without needing any of those.

When it finally came down to PCIe pass through to get better 3D support I moved to qemu/kvm, no one forced me to pirate Oracles software for that. Of course qemu/kvm can be an absolute shit show to configure, so I still default to Virtual Box.

You are wrong.

You are confusing the Guest Additions (free, FOSS, included in many distros) and the Extension Pack (commercial/proprietary, freeware for personal/non-commercial use.)

I have had to explain this within the last fortnight; read that.

https://news.ycombinator.com/item?id=36679707

Sorry, I did in fact mean extension pack. The FOSS one have not always been available/complete hence in past a lot of companies had no choice other than using the Oracle guest addition extension pack. Which resulted in situations like this:

https://www.reddit.com/r/sysadmin/comments/d1ttzp/oracle_is_...

No, you are still wrong.

The Guest Additions are capital F Free.

The Extension Pack is not.

There is no such thing as "the Oracle guest addition extension pack." Never has been.

You are conflating 2 totally different separate things, as is that Redditor.

Extension Pack used to include the guest tools almost everyone needed.

Exactly what it was called is not important. The point is that you needed it and Oracle later made it a torpedo cost.

[[Citation needed]]

I think you are wrong.

The Guest Additions (GAs) are not part of the Extension Pack (EP). As far as I can recall, after I think 15 years of using VirtualBox now, the GAs never were part of the EP.

The GAs are FOSS.

The EP is not FOSS. Since VirtualBox 4.0, released December 22, 2010, the core product has been FOSS and the proprietary bits were in the EP and only the EP.

https://www.virtualbox.org/wiki/News_pre_4_3

VirtualBox 2 and 3 had separate freeware PUEL and Open Source editions (OSE), but that is back in the noughties. You are reaching back nearly 15 years here to get to when the product was not all-FOSS.

I think you are confusing the names and the descriptions of the two totally separate add-ons, one of which is a proprietary addon to the hypervisor itself, and the other of which is a FOSS addon to the OS running inside the VM.

Can you expose some more on the licensing issues with migration from Oracle Java to OpenJDK? I will admit that nothing jumps at me from the FAQ, but then it's rather... legalistic one.

>> UTM on Mac

How easy is it to setup directory sharing? Reading https://docs.getutm.app/guest-support/sharing/directory... seems a bit more difficult than VirtualBox

My use case is relatively simple: build some tiny OSes (into ISO image) on Linux VM, then run the ISO on macOS's qemu

UTM uses VirtioFS with Apple's virtualisation backend. Works out of the box with my Ubuntu server guests. You still need to mount the share as described here, but that's it: https://docs.getutm.app/guest-support/linux/#macos-virtiofs

What took me a bit to figure out is that this does not mount a single folder, but a virtual parent folder to which you can add and remove directories without changing the mount. This even works while the VM is running.

For example, mounting

  share /mnt/host virtiofs rw,nofail 0 0

in the guest and then sharing

  ~/Downloads

in UTM will share the Downloads folder as

  /mnt/host/Downloads

When using the QEMU backend, VirtFS is used instead, which does not use such a parent folder and requires restarting the VM to change shares iirc.

license issues apart, virtualbox guest tools for windows are awesome: clipboard sharing, drag and dropping files, network shares, auto window resize, etc just work out of the box.

With KVM/splicetools it is always a pain to setup that.

From oracle, I only use an older version of Virtualbox and in cloud I only use their free VM tier (4 ARM cores & 12GB RAM) because it's the best current "permanent" offer out there. That said, I take care to not invest in to any of their specific cloud guff and just run my own or generally available software & OS on Linux VM's there, which is not too much work to migrate anywhere.

I've seen enough in the past to have zero trust in the company to not start doing more anti-dev stuff.

Out of curiosity since it seems you have a lot of experience in this field, how does UTM compare to VMware Fusion on macOS? I used to run VirtualBox for years but switched to VMware due to recurring performance issues. Trying out VMware was like a breath of fresh air, things that used to take a lot of effort to configure suddenly worked right out of the box. How does UTM fare?