8 ms·

JDK 10 Early Access Release Notes

58 points by javinpaul 9y ago

lvh 9y ago
As you can tell from the relnotes, there are a lot of removals. Fortunately, they're all following a pretty reasonable deprecation procedure, but I still can't shake what happened with Jigsaw and JDK9. Software broke. That didn't happen (regularly) before unless that software was doing patently silly things. This was different: _most_ software broke. Here's hoping that doesn't turn into a pattern.
- rhencke 9y ago
  I do wonder about this. Granted, Java 9 (and 10) are not LTS releases - we'll have to wait for 11 for that. (http://www.oracle.com/technetwork/java/eol-135779.html http://www.oracle.com/technetwork/java/eol-135779.html) But, Java 8 will stop receiving public updates next year, and pretty much everywhere I've looked, folks are sticking on Java 8. I am hoping I'm wrong, but I wonder if we will see Java 8 be forked, and live on, by community effort, as the cost to maintain it would be lower than the cost of risking moving to Java 11. For a lot of businesses, I don't think the reality has set in yet, and I don't think they're going to realize what situation they're in until Java 8 hits EOL.
  - pjmlp 9y ago
    There are companies still deploying Java 1.4 into production in 2018, just because they don't want to touch their beloved servers. This is nothing new.
    - PhaseBlue 9y ago
      Granted this is an extreme case but large, complex critical systems need a certain amount of stability and upgrades across Java releases are not quite as easy as just touching the servers.
    - lvh 9y ago
      Would you agree that the breakage between 1.4 and 1.5, 1.5 and 1.6, 1.6 and 1.7, 1.7 and 1.8 is not comparable to the breakage that Jigsaw alone introduced between 1.8 and 1.9?
      - pjmlp 9y ago
        Yes, I do agree. However stuff like JDBC interface changes comes up as breaking changes in previous releases. In what concerns Java 9, Mark Reinhold keeps doing presentations about how all Java relevant frameworks and tools are already Java 9 compliant. Including many that they validated against in Maven repositories. Last presentation I saw was at FOSDEM. So it appears to be a major issue to anyone wanting to migrate Java 9 without updating the frameworks as well, having some kind of special case library, or using APIs that were always documented as internal.
        lvh 9y ago
        The QA outreach page [0] suggests maybe about half the projects are ready. The ones that aren't include Netty and SLF4J. Those aren't small projects. Is that page outdated or does "JDK9 ready" not really mean "JDK9 ready"? EDIT: Maybe it's outdated; SLF4J and Netty do claim to be JDK9-ready. [0]: https://wiki.openjdk.java.net/display/quality/Quality+Outreach https://wiki.openjdk.java.net/display/quality/Quality+Outrea...
  - vbezhenar 9y ago
    Honestly I never needed any java updates on server side. I'm sure that they are fixing something important, but I've yet to encounter any bugs. My recent projects should run on Win32 and given that they dropped support, I won't migrate from Java 8 even if it won't be updated.
    - jarym 9y ago
      You may not have encountered any bugs but what about the vulnerabilities they’re fixing - do you not care to have those fixes?
      - vbezhenar 9y ago
        Can you provide examples of those vulnerabilities? All vulnerabilities I'm aware of are from Java applet technology and not applicable to server applications. The only vulnerability that I can remember is something about parsing float, but even that was very low risk.
        slrz 9y ago
        All those TLS/SSL implementation vulnerabilities with fancy names like POODLE, for example. https://www.oracle.com/technetwork/topics/security/poodlecve-2014-3566-2339408.html https://www.oracle.com/technetwork/topics/security/poodlecve... There's a lot more but it of course depends on the subset of the JDK that you're using. Look over the release notes for historical JDK updates.
        vbezhenar 9y ago
        I don't use TLS and even if I would use it, I would use nginx frontend. My subset is fairy common, Spring+JDBC, sometimes Hibernate, sometimes pure servlets, but basically all interaction between outer world is via HTTP interface implemented in Tomcat.
        toyg 9y ago
PedroBatista 9y ago
Looks like a lot of housekeeping is taking place. I just wish they implemented a native and full code hot-reload support on the jvm, instead of relying on external tools/hacks that work sometimes. That alone would single-handedly improve productivity by an order of magnitude.
- pjmlp 9y ago
  Native will come, just slow and steady. 10 is already an improvement over 9 in what concerns supported AOT platforms. "Project Metropolis" http://mail.openjdk.java.net/pipermail/discuss/2017-September/004336.html http://mail.openjdk.java.net/pipermail/discuss/2017-Septembe... Otherwise there are alternatives like ExcelsiorJET.
- vbezhenar 9y ago
  I agree wholeheartedly. Using jrebel is so much of a productivity boost, but I want to avoid proprietary tools as much as possible.
  - severino 9y ago
    There're some open source alternatives, such as this one, with less features, though: http://dcevm.github.io/ http://dcevm.github.io/ However, I couldn't make it work with my current project when I tried some years ago. I haven't tried again since.
- electrotype 9y ago
  That gets my vote too. JRebel works well, but we need an official and free tool.
tmd83 9y ago
Beyond housekeeping could only find one real big changes that is parallel full GC for G1. That's a big one in controlling the worst case.
- AlphaSite 9y ago
  Doesn’t java 10 add ‘var’ to the language?
  - pjmlp 9y ago
    Yes, just the initial support. There are some additional ergonomic improvements planned for 11, like using them in lambda parameters.
    - tmd83 9y ago
      I might have missed it but didn't find that in the release note. Could there be language changes that are not part of this release note?
      - pjmlp 9y ago
        You can find them on the JEP list and JDK Jira. This is a pre-release, I imagine until the actual release they will properly update them.
zng00 9y ago
Sexy as always
malft 9y ago
> The clear passwords present in jmxremote.password file will now be over-written by their SHA3-512 hash by the JMX agent I must be misreading this. As far as I can tell the ability to read the new format was added in the same version. Did someone forget about forwards compatibility in the jvm?
- ptx 9y ago
  Also it introduces a race-condition (according to the release notes) where changes made to the file will be lost while it's being converted. Also they don't say anything about iterating the hash, in which case the password can be recovered anyway with rainbow tables, so what's the point of hashing it?
ptx 9y ago
If anyone other than me was concerned that the "system property to disable JRE last usage tracking" was something like the enabled-by-default telemetry of .NET Core[1] (which made me give up on it in disgust), it's apparently[2] not – it's just some (commercial add-on) logging feature. [1] https://github.com/dotnet/cli/issues/3093 https://github.com/dotnet/cli/issues/3093 [2] https://docs.oracle.com/javacomponents/usage-tracker/overview/ https://docs.oracle.com/javacomponents/usage-tracker/overvie...

58 points by javinpaul 9y ago

lvh 9y ago

As you can tell from the relnotes, there are a lot of removals. Fortunately, they're all following a pretty reasonable deprecation procedure, but I still can't shake what happened with Jigsaw and JDK9. Software broke. That didn't happen (regularly) before unless that software was doing patently silly things. This was different: _most_ software broke. Here's hoping that doesn't turn into a pattern.

rhencke 9y ago
I do wonder about this. Granted, Java 9 (and 10) are not LTS releases - we'll have to wait for 11 for that. (http://www.oracle.com/technetwork/java/eol-135779.html http://www.oracle.com/technetwork/java/eol-135779.html) But, Java 8 will stop receiving public updates next year, and pretty much everywhere I've looked, folks are sticking on Java 8. I am hoping I'm wrong, but I wonder if we will see Java 8 be forked, and live on, by community effort, as the cost to maintain it would be lower than the cost of risking moving to Java 11. For a lot of businesses, I don't think the reality has set in yet, and I don't think they're going to realize what situation they're in until Java 8 hits EOL.
- pjmlp 9y ago
  There are companies still deploying Java 1.4 into production in 2018, just because they don't want to touch their beloved servers. This is nothing new.
  - PhaseBlue 9y ago
    Granted this is an extreme case but large, complex critical systems need a certain amount of stability and upgrades across Java releases are not quite as easy as just touching the servers.
  - lvh 9y ago
    Would you agree that the breakage between 1.4 and 1.5, 1.5 and 1.6, 1.6 and 1.7, 1.7 and 1.8 is not comparable to the breakage that Jigsaw alone introduced between 1.8 and 1.9?
    - pjmlp 9y ago
      Yes, I do agree. However stuff like JDBC interface changes comes up as breaking changes in previous releases. In what concerns Java 9, Mark Reinhold keeps doing presentations about how all Java relevant frameworks and tools are already Java 9 compliant. Including many that they validated against in Maven repositories. Last presentation I saw was at FOSDEM. So it appears to be a major issue to anyone wanting to migrate Java 9 without updating the frameworks as well, having some kind of special case library, or using APIs that were always documented as internal.
      - lvh 9y ago
        The QA outreach page [0] suggests maybe about half the projects are ready. The ones that aren't include Netty and SLF4J. Those aren't small projects. Is that page outdated or does "JDK9 ready" not really mean "JDK9 ready"? EDIT: Maybe it's outdated; SLF4J and Netty do claim to be JDK9-ready. [0]: https://wiki.openjdk.java.net/display/quality/Quality+Outreach https://wiki.openjdk.java.net/display/quality/Quality+Outrea...
- vbezhenar 9y ago
  Honestly I never needed any java updates on server side. I'm sure that they are fixing something important, but I've yet to encounter any bugs. My recent projects should run on Win32 and given that they dropped support, I won't migrate from Java 8 even if it won't be updated.
  - jarym 9y ago
    You may not have encountered any bugs but what about the vulnerabilities they’re fixing - do you not care to have those fixes?
    - vbezhenar 9y ago
      Can you provide examples of those vulnerabilities? All vulnerabilities I'm aware of are from Java applet technology and not applicable to server applications. The only vulnerability that I can remember is something about parsing float, but even that was very low risk.
      - slrz 9y ago
        All those TLS/SSL implementation vulnerabilities with fancy names like POODLE, for example. https://www.oracle.com/technetwork/topics/security/poodlecve-2014-3566-2339408.html https://www.oracle.com/technetwork/topics/security/poodlecve... There's a lot more but it of course depends on the subset of the JDK that you're using. Look over the release notes for historical JDK updates.
        vbezhenar 9y ago
        I don't use TLS and even if I would use it, I would use nginx frontend. My subset is fairy common, Spring+JDBC, sometimes Hibernate, sometimes pure servlets, but basically all interaction between outer world is via HTTP interface implemented in Tomcat.
        toyg 9y ago

PedroBatista 9y ago

Looks like a lot of housekeeping is taking place. I just wish they implemented a native and full code hot-reload support on the jvm, instead of relying on external tools/hacks that work sometimes. That alone would single-handedly improve productivity by an order of magnitude.

pjmlp 9y ago
Native will come, just slow and steady. 10 is already an improvement over 9 in what concerns supported AOT platforms. "Project Metropolis" http://mail.openjdk.java.net/pipermail/discuss/2017-September/004336.html http://mail.openjdk.java.net/pipermail/discuss/2017-Septembe... Otherwise there are alternatives like ExcelsiorJET.
vbezhenar 9y ago
I agree wholeheartedly. Using jrebel is so much of a productivity boost, but I want to avoid proprietary tools as much as possible.
- severino 9y ago
  There're some open source alternatives, such as this one, with less features, though: http://dcevm.github.io/ http://dcevm.github.io/ However, I couldn't make it work with my current project when I tried some years ago. I haven't tried again since.
electrotype 9y ago
That gets my vote too. JRebel works well, but we need an official and free tool.

tmd83 9y ago

Beyond housekeeping could only find one real big changes that is parallel full GC for G1. That's a big one in controlling the worst case.

AlphaSite 9y ago
Doesn’t java 10 add ‘var’ to the language?
- pjmlp 9y ago
  Yes, just the initial support. There are some additional ergonomic improvements planned for 11, like using them in lambda parameters.
  - tmd83 9y ago
    I might have missed it but didn't find that in the release note. Could there be language changes that are not part of this release note?
    - pjmlp 9y ago
      You can find them on the JEP list and JDK Jira. This is a pre-release, I imagine until the actual release they will properly update them.

zng00 9y ago

Sexy as always

malft 9y ago

> The clear passwords present in jmxremote.password file will now be over-written by their SHA3-512 hash by the JMX agent I must be misreading this. As far as I can tell the ability to read the new format was added in the same version. Did someone forget about forwards compatibility in the jvm?

ptx 9y ago
Also it introduces a race-condition (according to the release notes) where changes made to the file will be lost while it's being converted. Also they don't say anything about iterating the hash, in which case the password can be recovered anyway with rainbow tables, so what's the point of hashing it?

ptx 9y ago

If anyone other than me was concerned that the "system property to disable JRE last usage tracking" was something like the enabled-by-default telemetry of .NET Core[1] (which made me give up on it in disgust), it's apparently[2] not – it's just some (commercial add-on) logging feature. [1] https://github.com/dotnet/cli/issues/3093 https://github.com/dotnet/cli/issues/3093 [2] https://docs.oracle.com/javacomponents/usage-tracker/overview/ https://docs.oracle.com/javacomponents/usage-tracker/overvie...