Petition: Stop bundling crapware with Java
change.org
change.org
Oracle's attempt is pretty lame in comparison to the methods of their tech peers. Apple, Microsoft and Google ship entire mobile operating systems filled with software to collect data and have built vast app stores filled with spyware that does not offer the user a chance to opt out.
But what makes Oracle's acts so lame is that the actually respect enterprise and don't bake the spyware in. Their peers, on the other hand, push BYOD.
Oracle has the right to bundle whatever crap-ware they want. If that sullies their reputation or draws out alternatives, that's a good thing.
My problem is that as of now, they don't.
I'm not a huge fan of maintaining installed software, though -- if you have a silent auto-updater, that's not bad, but otherwise you're going to be either annoying people with frequent updates, or supporting (often accidentally) scores of old versions all the time.
What else is there besides Java that can run in the browser and do audio recording, MIDI input, realtime audio DSP, etc.? Obviously not everyone wants fancy audio capabilities in the browser, but I imagine there are plenty of other "niche" capabilities that other people need that are impossible in the browser w/o Java.
I do get a sense now that we're going to see the Java security hole largely closed (thanks to browser limitations and Oracle fixes), but the damage has certainly been done.
Similarly, I think Java's worst nightmare scenario wouldn't be end users deciding they don't like it. (Heck, like with Flash most of them don't even know when they're using it.) It would be some massive headline-making Java-related security breach at a Fortune 500 company convincing IT departments around the world to start thinking that it's time to migrate to a less risky platform.
Sorry, but techie's opinions are overrated. iOS and mobile video brought Flash down a few notches, not us.
At the time that looked like a big gamble but with hindsight the gamble has paid off for everybody but Adobe and Flash developers.
You really have no idea what you're talking about. Killing Java would be a ridiculous thing to do. You live in such a bubble.
The whole community is full of de facto "standards" and half baked libraries which are usually results of someone's summer project.
The language in and of itself is alright (although massively outdated compared to more modern alternatives like C#), but the virtual machine and the nature of the ecosystem make me want to blow my brains out on daily basis. Don't even get me started on the recent security debacle.
I don't know a lot about these new *.js technologies but if they are right tools for the job, then yes, I wouldn't have anything against using them where appropriate.
Sometimes the JVM isn't the right tool; Java the language is often the wrong tool. But when you need to write large, high-performance, backend software, the JVM is pretty much the only rational choice. C/C++ is too expensive effort-wise, in development, in maintenance and in monitoring. Erlang is awesome, but it's too slow for some things. .Net is not robust on non-windows platforms (I'm not sure about this, but this is the common perception). Go is slower than Java, lacks the huge ecosystem, and also doesn't provide all the JVM goodies like runtime instrumentation and profiling, hot code swapping, good monitoring etc. Rust is too immature (and won't give you those benefits either). So, pretty often, the JVM is the only choice and you think it's time to kill it?
I'm kinda curious to get you started on the security debacle, actually.
Do you ship Java software that runs client-side? Spring is usually for server-side; if you're just on the server side, though, how has the security debacle affected you?
I generally agree about the ecosystem (yup, just gotta avoid most of it) and the core language (though the clunkyness is somewhat mitigated by IDE facilities for auto-generating code).
But I mostly spend my time on either client-side JavaScript or server-side Java, and it's the JavaScript side that drives me crazy -- in the JVM, things just work. I've hit runtime bugs maybe twice in 14 years working with Java on the server side, and one of those was on the AS/400 (!), and unless I'm doing something stupid, it's fast.
I'd say their ham-handed approach to security and their contentment to sit with their thumbs up their arses, while vulnerabilities whose magnitude compare favorably with the US national debt are being exploited widely is more than enough reason to hate Java.
At least Microsoft has the good sense to issue OOB patches when something serious enough comes up!
The current state of Java means that running the browser plugin paints a huge bullseye on your back. It got bad enough that the freaking department of homeland security recently issued a warning to disable the plugin for your own good.
Do you have any idea how ubiquitous java is in the enterprise? Everywhere uses java.
Have you ever worked on anything that needs to be scalable, extensible and maintainable?
Scalability, maintainability, and extensibility are not unique to Java.
If you're talking about Java, you're talking about the browser plugin. It all executes on the same VM.
You can't simply declare it off limits given the massive and repeated security issues surrounding it, combined with its ubiquity (especially for countries not ending in "America" - Clientside java is very popular in European banks.)
I can't see how this makes any more sense than "If you're talking about Visual Studio, you're talking about Mac OS X. It all executes on the same processor." Yes, they both share the same underlying technology, but they are hardly indistiguishable — you can certainly talk about one without addressing the other. You could delete the browser plugin from every computer on the planet and it wouldn't make normal Java apps work any better or worse. The plugin depends on the Java platform, but the Java platform is not in any way dependent on the plugin.
> You can't simply declare it off limits given the massive and repeated security issues surrounding it
I'm not declaring it "off-limits" — I'm suggesting that it is irrelevant to the discussion here. Yes, there are security issues with it, but since nobody here is saying "I think the Java browser plugin is a boss idea," you're either arguing with nobody or trying to denigrate the JVM as a client and server technology based on the fact that it isn't suitable for embedding in a browser. I can't see any way that the Java plugin is really relevant. Similarly, if I went and wrote a terrible plugin to allow Ruby "applets," bringing up that plugin as a criticism of Ruby in other contexts would not be productive.
Modern VM design, vastly superior flagship language, pretty solid on the side languages* too, better platform support (Thanks Xamarin!), and best yet it's Free. Like really Free, not Oracle-style "Here's the source code so you can maybe hack on our implementation a bit but if you try doing anything we don't like we'll sue your ass" 'free'.
* Not really a great Lisp for the platform yet, but I prefer F# to Scala. Much cleaner syntax, 'feels' more functional.
I don't know why this is being downvoted. It's true that the JVM is one of the things in the Java ecosystem that is looked upon as a massive success.
And it's also true that the CLR really is technically superior to the JVM on a whole slew of points. It has runtime-level support for generics (meaning C# lets you do all sorts of nice things with them that Java doesn't support). It has user-defined value types. It supports coroutines (i.e., 'yield'). It supports anonymous functions and closures. For those who just can't leave pointers alone, it even has unsafe blocks. And so on.
So while it's definitely not "proven" in a sense that will impress your average PHB, in terms of technical merit I don't think there's really any comparison. Mono wins hands-down.
This is kind of tongue in cheek, but seriously... NodeJS is relatively new (since 2009) and it's gained a LOT of traction... it isn't the perfect solution, but then again nothing is. I like Mono and have used it, they've worked through a lot of the earlier issues, and it's pretty decent at this point... IIRC it's the core of the Unity tools, as well as having Xamarin tools available to support the majority of mobile platforms.
Is there anyone here with experience developing for Mono on Linux and Mac? What's it like in reality?
Compared to most other open source platforms, OTOH, I don't think it feels like one's been relegated to a language underclass at all. Of course you don't get the benefit of working in the operating system's official first-class language like you do on Windows, but in fairness that's a privilege that you never get to enjoy when working in most languages - including Java, Python, Ruby, and so forth.
As far as why it's less popular outside of Windows, I'm inclined to think that's mostly down to social effects. Java's got the Linux enterprise development space so wrapped up right now that I suspect trying to pivot to Mono would be a bit like trying to push a glacier. Businesses aren't in the habit of rewriting millions of lines of code on a whim.
That said, I've used MonoDevelop in Windows and OS X and it works pretty damn well. The Mono project has done a great job mirroring the .NET API and runtime.
(And also, doesn't Mono just replace the hypothetical threat of a lawsuit from Oracle with the hypothetical threat of a lawsuit from Microsoft?)
Tail calls, value types, easier direct calls to C to process large regions of data without copying (e.g. lapack): there are many things which could benefit non-Java languages on the JVM like Clojure and Scala that are taking too long with Oracle stewardship (as they did with Sun's as well). Maybe these things are in fact too hard to implement for small or unfunded groups?
I hope not, I think it's high time.
How hard is it to discern even our sleep habits? We put them on the charger beside the bed at night and tune in to Pandora. If our phones can't tell if we're sleeping around or alcoholics already, it won't be long until they can.
Like most petitions this one is a distraction. It keeps our energy focused on the wrong part of a larger issue and one where any leverage we have cannot create fundamental change.
Yeah, we carry devices that are spying on us. Why do they spy? To sell us more stuff. They don't try to hide that fact. Your fearmongering is off topic here, and fairly irrelevant elsewhere too.
They spy because they can. They spy because the companies involved believe that the data they collect has value. They spy because the companies involved believe that the data they collect might have even more value in the future.
The companies involved aren't in the business of selling you stuff. They sell data about you to others. Sure that might be a retailer of Hello Kitty backpacks with scenes of unicorns shitting rainbows. It might be a presidential campaign. It might be a government - and in that case, the value exchanged might be trade privileges rather than cash.
Large commercial ventures willing to harm many people for the sake of profit are not unknown to history e.g. the East India Company and International Association of the Congo. Likewise, industries adopting standard practices which do so - e.g. tetra-ethyl lead.
I may be wrong. But I don't think that just because I live in the US corporations have any more respect for my human dignity than they do for the citizens of Honduras or Pakistan or Albania.
Until then, your statements are nothing more than FUD.
One big reason they spy because there are a lot of webdevs who either have no idea or do not care about PII. Why would someone put a link on their website, to Facebook or Twitter for example, basically giving them all of their extremely valuable web logs for free? These companies make big bucks from those unnecessary "live links" and go to great lengths to avoid questions about why they "need" to be live (and they don't).
You're thinking of this type of consequences: http://online.wsj.com/article/SB1000142405270230445860457748...
The problem is this type of consequences: http://www.newcreditrules.com/newcreditrulescom/2009/01/bewa...
Secret formulas deciding our credit limits and insurance premiums because spying gives them information is the problem. Not the information that we might pay more for a hotel room.
Oracle is not the poster child for spyware.
That's some great FUD. In fact I think I've heard it somewhere before..
Isn't this the reason that RMS refuses to carry a phone?
You can care about it or not, but saying it's false is kinda bold.
I'm certain that the apps that have "tracked my GPS history" have done so with my consent and knowledge.
I use Google Play for my music, so there's no doubt that my playlist and playcounts are on someone else's server somewhere. I also know that at least one Google engineer has seen my playlists because I had to ask for help with an issue with the service before surrounding tag edits.
"Looked at who I have in my address book" - sure. I use an Android device so all of my contacts are backed up on a Google server. I somehow doubt that anybody is rifling through that information.
My response to all of the above is "So what"?
There are APIs to pull that information, but they require my consent to do so (the permissions before apps are downloaded, and those can be restricted anyways with the aid of something like LBE Privacy Guard).
Malware and apps that surreptitiously access this data are rare.
If the petition were asking Oracle to establish a nonprofit that could support Java and offering to pay the first $10,000 toward it, I'd have a quite different reaction. But this seems to me no different from agitating for "free healthcare" without even mentioning who might pay for it, just, "it should be free!"
Anyway, as someone who regularly writes software for artists and designers with Java, I lately find myself avoiding JVM-based workflow on the client-side. It's just too much of a hassle for anyone I work with.
I mean, what the hell are they thinking anyway? That we're going to be so awed by it just because it's rammed down our throats? Nobody is ever going to use JavaFX any more than they're going to use Silverlight. They should get over it already.
Second, Java is the basis for a lot of very expensive Oracle software. Does the Java updater work differently on their machines?
I trust both companies well enough to install software downloaded from their servers. But I don't want a pointless installer that tries to trick me into crapware. So Ninite is the clear winner there.
Seriously though, we'd lose all our Ninite Pro customers if we pulled any crap with our installations. Since the free version is our marketing department we'd be idiots to mess that up too.
I think this is extra worse than normal bundling, because its a friggin platform! A basis for applications, it smells as bad as Microsoft asking to install a toolbar during the OS install.
[1] http://winsupersite.com/windows-8/microsoft-cheapens-windows...
So this is way different than having a couple of banner ads showing up inside the app only when the app is running and you can uninstall the app in five seconds.
You enter an app who's purpose is to allow you to purchase videos or music, and then complain that there are ads there?
Seriously, how worse stuff can get?
I imagine a future.
A bright future.
A future where everyone sees data, with Google Glasses like technology and beyond.
And thus, where they have ads in front of them all the time, you arrive home, look at your daughter in the crib, and suddenly your entire vision is plastered with a semi-transparent ad for diapers, and you blink, it goes away, and another shows up, a ad for automatic cribs with quad core processor and capable of singing and telling stories on its own.
Seriously, Canonical is a company, and they have to pay their bills like the rest of us. The Amazon search isn't "spyware," it's nothing but an additional search lens, and you can turn it off.
I believe ORCL wants to drive off all their nuisance D and E customers, which is all the riffraff not paying them $50m/yr. After taking over Sun, they've moved all the good stuff behind a paywall, jacked the cost of legacy products and of supporting them, added onerous contracts with stiff penalties. For example, if you ever drop support, there's a big fine to rejoin. Another example is if you're an OEM they make it very very hard to simply sell their stuff. My $work is an OEM that also uses several products ORCL bought that used to be okay, but now we're getting off them before the sleaze and expense kills us.
So Java is probably one of those standalone business units they need but hope it will make a little profit of its own. The first attempt to monetize, sue GOOG, didn't go so good if you recall.
Does anyone remember if Sun at any time bundled adware or other forms of crapware, esp. using deceptive tactics?
Note: I have no problem with Java on the server or client, just the applet and browser plugin model.
Commission collections and ethics aside, I actually cannot understand the venom towards Ask (its search results). I believe in keeping web searches open with multiple choices made available to users, so I actively support all viable alternatives (meaning I use Ask, Blekko, ddg, lycos, yahoo (bing) among others instead of Google for regular everyday searches). Ask search results are very much comparable to Google's, i.e., the search is not "inferior" as claimed.
As for ads, google's adsense ads are just as much in-your-face as the others (ymmv), so don't think this point is such a big thing either as claimed.
On google I saw no ads, and the links on the first page of results usually contain the search term.
On Ask there are ads, and they look very much like search results - there's no coloured background to identify them as such - and the search results contain irrelevant links to other Ask properties like "Can I Copy From Youtube? | Ask Jeeves" and "How Memory Stick | ask.co.uk/how"
Personally I won't be switching from Google to Ask.
I'll admit we might see different things - let me know if you'd like screenshots.
[1] http://www.google.co.uk/search?q=cuda+device+to+host+memory+... [2] http://uk.ask.com/web?q=cuda+device+to+host+memory+copy
Good show. I checked your links on Maxthon [my IE without the IE baggage] and on Firefox (default browser with ABP add-on) for comparison.
1. On FF I have ABP installed, but there were no ads on Maxthon either for Ask. Is it due to "search bubble" or something else? Not sure. However, I too use uk.ask.com for my searches like you, so the 'bubble' should be the same for me as well. Hmmmm.
2. I got those two false positives also. But the rest of the search results were similar between both search engines (SO, rice.edu, stanford.edu, sourceforge, NVIDIA). I'll admit that I would have simply filtered those two anomalies visually and not given it a second thought. But wouldn't you say, search-for-search, the landing pages were pretty similar in the results returned (barring those two stupidities)?
And here's what I see on Google: http://imgur.com/nalUhES
Ask: http://i.imgur.com/rX72PDd.png
Google: http://i.imgur.com/Q0BusaH.png
FWIW, I'd definitely recommend looking into other alternative search engines like those I mentioned earlier. Usually my opera's speed dial default engine is dogpile [http://www.dogpile.com] that curates Google, Yahoo and Yandex results into one search result on one page. Definitely also worth looking into if you're interested.
I use Bing often, as I love Bing's homepage. Oh! those panoramic pictures. You got to give it to them. They definitely got that UX right. ;-)
Edit: Blekko and DDG are quite fab. And for an old contender, Lycos quite literally, rocks! Try them.
You can't really split Ask in half and talk about the quality of its search results vs the ethics of the company.
2) You can set Java update mode to manual.
3) Chrome (and possibly another browser) asks permission before using Java on any page, so I consider it a low-risk vector for drive-bys.
If you have to ask the average user for permission to update, updates won't get done. It's that simple.
Oracle should take a page from Chrome's book, here. Update silently in the background, and then notify if a restart or a relaunch is required to effect the change.
When I need to deliver an app written in Java to the end user I just include my own JRE. You have to do it pretty much anyway in order to guarantee that your app works regardless of quirks of particular system/installation.
Because, I'll tell you what, I sure didn't get any crapware when I typed `sudo apt-get install openjdk-7-jdk`.
Either way, it'd be a nice way to give Oracle the middle finger about this.
https://confluence.atlassian.com/display/JIRAKB/OpenJDK+is+n...