Oracle is responsible for 95+% of every single commit going to OpenJDK, which has the exact same license and situation as the goddamn linux kernel, GPL2. Do you also sweat a lot about accidentally installing red hat linux? If not, you have zero reason to worry.
How is amazon compiling and repackaging the exact same thing somehow different?
See my other comment about Adoptium vs. OpenJDK vs. Oracle JDK: https://news.ycombinator.com/item?id=37571143
The licensing risk of using open source software, that is mostly being written by Oracle, from Amazon is less.
Amazon's open source reputation is that they'll screw over maintainers with their rebranded forks, but not go after users of open source.
Oracle publishes updates for latest release until the next release.
Then they drop maintenance of that branch, and RedHat picks it up (at least they did for 8, 11 and 17) and keep supporting/backporting fixes, with the help of other vendors and the community.
So when you are using 8/11/17 from RedHat/Adoptium/Corretto/you name it, you are actually using what RedHat provides to its customers as LTS, unless they have some private build, which I seriously doubt.
I wasn't able to find out what exactly Oracle does for their private LTS releases, do they use the public maintenance branch as a base of their private branch? Or do they continue their own private branch independently from what the community maintains? That would mean that the older the branch is (say jdk11u) the more differences there are between Oracle JDK and what you get from RedHat/Adoptium/...
On top of that Amazon provides support for Corretto on AWS, if you are using e.g. EC2 you get it as part of the fees, not exactly free, but cheap, considering you already pay for the VMs.
I appreciate any corrections/clarifications.
This is changing every now and again. For example, the Oracle JDK builds for JDK 21 will be offering free updates for three years (https://www.oracle.com/java/technologies/downloads/)
> and keep supporting/backporting fixes, with the help of other vendors and the community. So when you are using 8/11/17 from RedHat/Adoptium/Corretto/you name it, you are actually using what RedHat provides to its customers as LTS, unless they have some private build, which I seriously doubt.
This is where things get complicated, and given that there are all done by companies that fund their Java operations by selling support -- just as Oracle does -- clearly they don't offer their paid service for free. What you get for free is some backports from the mainline, i.e. only the intersection of the old and current JDK is maintained. Now, I believe that Red Hat specifically offers the same builds as they do to customers, that is not what you want if you really care about a fully maintained JDK. And that is for the following reason: If you're stuck on an old version, that probably means you're using some aspect of the JDK that's been removed or else you'd be using a new version. But the only things we remove are things that aren't widely used. This means that the fix you need is probably not the same as one some other customer who is stuck on the old version needs. If you're not a customer, your issue will not be fixed because no one offers original work on old releases for free.
Of course, if your software is heavily maintained, the safest, most secure, and cheapest option is to always use the current version rather than an old one. Once you get used to doing that, it's also the easiest.
But Oracle also backports commits to older JDKs, e.g. Java 8 is supported for 2030, though that is paid.
The main takeaway is that it is still a singular project where bugfixes definitely, but even most custom features find their way eventually back to mainline (e.g. it was the case that Microsoft made some specific feature for their usecase, that was later merged).
https://inside.java/2023/09/19/the-arrival-of-java-21/
Oracle provides roughly 3/4 of the commits and fixed issues. It's a majority, but there are other significant players (always surprised to see SAP higher then Google and Amazon).
At least it's not clear to me, I'm still on "Oracle is evil, go as far as you possibly can from them". I would genuinely be happy to be able to confidently say that "this particular project of Oracle is safe for me to use", though.
There was a good comment on one similar threads: oracle is thought as this litigious monster because they provide DRM-free, no phoning home solutions to companies. This is very important for these customers, as you just simply can’t shut down a country’s hospital system because Google or whatever managed to falsely flag it as some malware and now you try to grab onto any form of human contact from their support, without success.
But every sufficiently big company is only after money, so to make some form of profit they do have to actually enforce their contracts somehow, here comes the inspection - which sure suck, but there is no other way around it given the previous limitation. And sure, some higher management can easily have fked up and used some feature that was not part of their plan, and they desperately want to cover up their mishandling, and Oracle “kindly” offers them the option to forget about the fee for that plus option, if you subscribe to this other service of ours for X years, we are good; and higher management couldn’t be happier.