14 ms·

Java is still available at zero-cost

175 points by lemming 8y ago

bradleyjg 8y ago
The TL;DR is that Red Hat and IBM are going to take over from Oracle as primary maintainers of java 8 (in the form of openjdk) after January 2019. That is likely to last through at least 2022. Going forward Oracle will be primary maintainers of openjdk for each new version of java for six months. Every third version (starting with 11) the hope and expectation is that RH, IBM, et al will take over after those six months are up and continue to support those versions for at least several years.
- adamson 8y ago
  That's such a weird arrangement from a people perspective, but if that works out, it bodes pretty well for the longevity of Java
- flukus 8y ago
  That sounds like a disaster, the developers at oracle no longer have any personal incentive when it comes to producing quality, maintainable software because it is no longer a problem they have to deal with. Because they're not feeling any personal pain from bad decisions they will no longer learn from them. This is close to the consultancy business model that's been at the root of so much bad software.
  - MBCook 8y ago
    What makes you say that? The Oracle JDK IS the Open JDK, only with a few extra features. At least that’s my understanding. A shared code base. If they do a terrible job of sticking a feature in they’re going to have to keep handling it until it’s cleaned up or removed.
didip 8y ago
I am not well-verse in Java world and curious about one thing. The valuable part of Oracle JDK is the GC. For example G1 is only going to be available on OpenJDK 9. What if there's a new GC being developed, will OpenJDK have the new GC?
- kevinherron 8y ago
  There is a new GC being developed (ZGC), and it's available as part of OpenJDK under GPL license. See this thread from earlier today: https://news.ycombinator.com/item?id=17875944 https://news.ycombinator.com/item?id=17875944
- pgwhalen 8y ago
  Yes. http://openjdk.java.net/jeps/333 http://openjdk.java.net/jeps/333
- MBCook 8y ago
  My understanding is that Open JDK is where all Java language development takes place now. It’s only some special enterprise features that aren’t part of the language itself that are restricted to the paid version of the Oracle JDK.
  - jerven 8y ago
    Were (past tense) there is nothing in Oracle JDK 11 that is not in OpenJDK 11.
    - MBCook 8y ago
      Oh, I thought there might still be some high end EE stuff. Thanks for the clarification.
- tveita 8y ago
  G1 works fine on OpenJDK 8, you just have to pass the command line parameters to enable it. It was made the defaultin OpenJDK 9.
roenxi 8y ago
Up until around 2008, clock speed was increasing rapidly and the bottleneck to systems performance kept changing. Software was being obsoleted in a mater of years. Then things started changing; evidenced perhaps by Windows upgrades suddenly becoming a lot less relevant and Apple starting to steamroll more modular computer builders like Dell. Mark my words, there will come a day where continuously upgrading software will start to have a clearly higher cost than old, boring and stable. 2018 to me is the first year that a software platform can have had a true decade to stabilise in an environment that isn't constantly shifting and changing at a hardware level. Maybe trends like in graphics cards will shake things up, but I believe the advantage is going to move to stable, slow upgrading, well supported platforms with large bases of well trained developer. Reducing LTS windows will be a disadvantage for the Java ecosystem.
- bognition 8y ago
  The drive to move quickly with software wasn't to keep up with ever changing hardware, it was to respond quickly to the market. Treat every release like an experiment. The more experiments you can run the more likely you are to understand and solve the needs of your users. Why would someone pick software that get feature releases and bug fixes on a yearly cycle when similar software is available that has weekly or daily releases.
  - Barrin92 8y ago
    >The more experiments you can run the more likely you are to understand and solve the needs of your users. There is an interesting chapter for this in Donella Meadows thinking in Systems Oscillations! A single step up in sales causes inventory to drop. The car dealer watches long enough to be sure the higher sales rate is going to last. Then she begins to order more cars to both cover the new rate of sales and bring the inventory up. But it takes time for the orders to come in. During that time inventory drops further, so orders have to go up a little more, to bring inventory back up to ten days’ coverage. Eventually, the larger volume of orders starts arriving, and inventory recovers—and more than recovers, because during the time of uncertainty about the actual trend, the owner has ordered too much. She now sees her mistake, and cuts back, but there are still high past orders coming in, so she orders even less. In fact, almost inevitably, since she still can’t be sure of what is going to happen next, she orders too little. Inventory gets too low again. And so forth, through a series of oscillations around the new desired inventory level. As Figure 33 illustrates, what a difference a few delays make! Faster is not always better, especially in systems with delays. By reacting to initial cues prematurely you can easily end up in permanent disarray that simply turns into a chaotic feedback loop. It is often worthwile to upgrade patiently, so one can actually gauge long-term effects instead of reacting to noise. Changing the consumer experience is a conversation.
mevile 8y ago
Java moving to 6 month release cycles is good. OpenJDK is good. RedHat providing long term support is good. All of this is good. Where I'm worried this fails is with dependencies. Also in the context of developing plugins for other Java projects. For example building a plugin for IntelliJ and the different versions of IntelliJ users may have.
- sbov 8y ago
  Is this a major concern? Isn't this part of why Java works to maintain backwards compatibility?
- koolba 8y ago
  Java has legendary backwards compatibility and has had that since the first public release. That’s not going anywhere.
  - unscaled 8y ago
    This changed somewhat starting with Java 9. Quite a few libraries broke down due to deprecated classes finally being removed and the version format change. Java also has a considerable class of libraries and tools that tends to break on every major release: mocking frameworks, dependency injection libraries, annotation processors and everything heavily relying on bytecode generation. I'd say most Java projects contain at least one of these, so migrating to a newer Java is not just a matter of installing a new JDK and changing your JAVA_HOME.
    - MBCook 8y ago
      Java nine is sort of a special situation because they finally turned off something that people were never supposed to do in the first place and they been warning people about for a very long time. My entire career has been as a Java developer, I’ve never had an issue updating Java to a newer version causing breakage. Upgrading third-party tools, like maven or various other things, can certainly do that. But I haven’t had it happen with Java.
  - rhencke 8y ago
spydum 8y ago
what worries me most is the muscle memory of developers downloading Oracle jdk from oracle. If Oracle keeps is dark patterns, thousands of developers will be using the commercial tool and on the hook for license fees.
- sdinsn 8y ago
  That is not how it works. You can download the Oracle JDK and use it forever, commercially, for free. You just won't get updates backported to your version unless you pay for long term support.
  - spydum 8y ago
    Find that in writing. Everything I read says jdk 8 is the last free Oracle jdk.
    - deleted 8y ago
      [deleted]
    - kjeetgill 8y ago
      Then read the article you're commenting on?
      - spydum 8y ago
        I did. Here is the money quote: Firstly, it is not clear that there will be an Oracle JDK that is $free to download. Despite my best attempts, I could not get 100% clarity on this point, but see also this tweet.
        MBCook 8y ago
        Oracle has never announced that they’re charging for their JDK. In all the talk over this stuff over the last few years they’ve never said that. They’ve been quite clear that it will still be free to download. The only change is that free security patches will now be limited to six months after a release.
scarface74 8y ago
Just for comparison.... Microsoft supports .Net Core LTS releases for three years.... https://www.microsoft.com/net/support/policy https://www.microsoft.com/net/support/policy
- flukus 8y ago
  Did they learn the definition of "long term support" from phone manufacturers? .net 1.1 (I looked this up when I had to install it earlier this week...) was supported for 10 years until 2013 and as part of Windows Server 2003 (32 bit) it was supported until 2015 so it looks like they're going backwards too.
  - scarface74 8y ago
    .Net Core (open source) and .Net Framework (Windows Only) have different support policies. .Net Framework has a much longer support lifecycle. https://support.microsoft.com/en-us/help/17455/lifecycle-faq-net-framework https://support.microsoft.com/en-us/help/17455/lifecycle-faq...
- MBCook 8y ago
  How frequently do they release LTS releases? The six months security patch limit would be a DISASTER in Java world if releases still happened every 2 to 3 years like they used to. Everyone would be stuck with large periods were no security patches were available without paying. But that’s not happening here. Yes you’re limited to six months of free security patches, but a new version comes out every six months. So you can stick with Oracle and never paid a dime is long as you stay reasonably up to date.
  - scarface74 8y ago
    How frequently do they release LTS releases? It’s in the link.
drivingmenuts 8y ago
Maybe it's time to start moving away from Java?
- projektir 8y ago
  I'm curious what your preferred alternative to Java is?
  - scarface74 8y ago
    .Net Core. It’s maintained by a company that actually knows how to support a platform.
    - MBCook 8y ago
      Because Java has had such a terrible support record. And it’s not like Oracle has any products they support. Microsoft has quite a history of creating and then abandoning different APIs and technologies. This is all pointless hyperbole. This isn’t that big change in the Java ecosystem. It’s not like it’s going to cost $20 to run Java at all. The price is for running Oracle’s Java... that’s older than six months... that you want security updates for. You can run a different JVM, you can get the security patches from someone else, you can go without them. You can pay someone other than Oracle. Free options still exist.
      - scarface74 8y ago
        Microsoft is known for s lot of things, but breaking backwards compatibility and short term support aren’t two of them.
        Skinney 8y ago
        Microsoft broke backwards compatibility when they introduced generics in .NET 2.0. Java, on the other hand, is still getting flac for refusing the break backwards compatibility to introduce reified generics.
exabrial 8y ago
Adoptopenjdk! Azul! OpenJRE! J9! choice is a great thing!
sleepychu 8y ago
What does this mean for me as an engineer who writes Java every day?
- agibsonccc 8y ago
  Use openjdk instead. By default on linux, that's what will continue to happen. You won't really be impacted by this.
  - MBCook 8y ago
    There’s no need to use Open JDK. If that’s your preference or you have some other reason (like the fact it’s probably pre-installed in a Linux distribution) there’s nothing wrong with it. But there’s absolutely no need for a developer to switch off of Oracle unless you absolutely cannot move to Java 9 or newer.
    - jerven 8y ago
      Java 9 is already no longer supported. If you haven't moved yet go directly to 11. As after 11 there are no features in OracleJDK that are not in OpenJDK I would think moving to the vendor supported (Open)JDK on your linux system is the smart default thing to do.
  - wiradikusuma 8y ago
    how's the performance compared to Oracle's (in Linux)?
    - agibsonccc 8y ago
      They are the exact same. Oracle moved the core bits to openjdk long ago. See: https://jaxenter.com/green-interview-jdk-binaries-137078.html https://jaxenter.com/green-interview-jdk-binaries-137078.htm...
- MBCook 8y ago
  Basically nothing. If you can run Java 9 or newer (because you don’t have dependency issues) then you can continue to run the Oracle JDK and just upgrade for security patches.
littlesheephtpt 8y ago
Boy, that Ask.com toolbar must be super lucrative.
- FactolSarin 8y ago
  Java: malware the moment you click install!
  - bitmapbrother 8y ago
    The irony is that you probably use Windows - the world's most insecure, malware, virus and ransomware ridden OS in the world.
TJSomething 8y ago
Where is this is going to leave GraalVM and JIT for ARM? I believe both of those are exclusive to Oracle. And I was kind of excited to use GraalVM.
- kjeetgill 8y ago
  GraalVM has two versions, CE and EE. EE is closed but CE is open.
pejrich 8y ago
If Java is open and free, then why did Android decide to rewrite Java? I notice a lot of companies seem to avoid Java so there must be some sort of a catch.
- agibsonccc 8y ago
  You're a long time out of date at this point. Google merged openjdk a long time ago for their base JVM. https://www.theregister.co.uk/2015/12/30/android_openjdk/ https://www.theregister.co.uk/2015/12/30/android_openjdk/
  - pjmlp 8y ago
    They didn't fully merged OpenJDK, just selected parts of it, across multiple Android versions. Compatibility is still kind of broken. It isn't possible to guarantee that any random Java library is usable on Android.
    - agibsonccc 8y ago
      Yes not all of it - there are still android specific bits yet. Enough of it is openjdk though.
      - pjmlp 8y ago
        And given how updates work....
- realusername 8y ago
  Android is quickly moving away from Java to make Kotlin the default language nowadays, it's probably in part due to the Java lawsuit (and in part to add language features quicker without changing the VM).
  - pjmlp 8y ago
    They aren't rewriting the Java parts. Kotlin just gets an additional library to make some SDK usage a bit easier.
MBCook 8y ago
I have a friend working at a company that is having “very important” discussions about this. They need to keep up with security patches (for obvious reasons) but the six month limit has them scared. The consensus seems to be that they don’t believe they can keep up with an upgrade schedule that fast and are thus forced to pay for support from someone or hope that the community backports security fixes far enough for the rate at which they feel comfortable upgrading. It doesn’t sound like they actually know what their upgrade rate would be, but they’re sure that it’s much slower than six months.
- agibsonccc 8y ago
  What's being missed here is there is a whole slew of vendors that support openjdk. Those patches will come from red hat, ibm, azul,.. as well.
  - MBCook 8y ago
    The question is for how long. Three months? Six months? A year? The community will provide updates, but it this point no one knows what the eventual pattern will be which makes planning based on it difficult.
    - agibsonccc 8y ago
      Not sure that's relevant either. Within the target environments you're still looking at 5 to 10 years just for red hat: https://access.redhat.com/articles/1299013 https://access.redhat.com/articles/1299013 Azul publishes this as well: https://www.azul.com/products/azul_support_roadmap/ https://www.azul.com/products/azul_support_roadmap/ Cursory google searching is all it takes to find these things.
- peanutz454 8y ago
  I am not sure I completely understand the implications of this. But, if OpenJDK is the reference implementation, and as long as someone is going to maintain Java 11, there really isn't much to worry. I worked for a company that completely relies on Java. They also relied on Apache, so they had on their roles two developers that wrote code for Apache and Tomcat. Making wild guesses here but - if OpenJDK project gets 300 companies with one contributor each to write code for them, they will continue supporting Java 11. Maintaining Java is in some way a responsibility of every company that benefits from it. Or maybe I am so out of touch with technology that I am absolutely wrong.
euske 8y ago
Honest question: How often do people upgrade their production language? Me: once in a decade, maybe. I'm still perfectly happy (and productive) with C# 3.5, Java 7 and Python 2. I'm grudgingly moving forward because the old toolchains are being deprecated now, but my codes aren't significantly improved because of a few fancy idioms available in a new language, and it barely affects the design decisions. Upgrading your library or framework can be more often, but I tend to still be fairly conservative. Upgrading your language for production twice a year sounds crazy to me.
- cdoxsey 8y ago
  With Go: every release. Free performance improvements and backwards compatibility. It also doesn't require anything installed on the server, so it's just updating a ci script.
  - bearhall 8y ago
    Same for us for Go. The releases have never caused any trouble and the performance improvements are nice to have. For us it’s just changing one base containers version. That being said we still use mostly Python 2 for our Python services.
    - jkaplowitz 8y ago
      If those Python services are going to last beyond 2020 and there's much risk of attackers probing for security vulnerabilities, I suggest you plan a transition to Python 3 during the remaining ~2-year support lifespan of Python 2. It's a lot easier of a transition than it used to be. Any other support replacement language would of course also work to keep you secure, but honestly might be more transition work. If you're a low-value target running unimportant stuff on an airgapped machine, this might not matter.
  - eftychis 8y ago
    Go is kind of special, as it is new relatively and the initial implementation of every feature is usually the most basic possible. Thus, every new version there is space for a lot of improvements. What I mean: the garbage collector is/was for all intents and purposes Dijkstra's late 70s ('78) tricolor algorithm. They eliminated re-scanning of the stack on Go 1.7 by adding a hybrid write barrier which is 90's work (found the proposal: https://github.com/golang/proposal/blob/master/design/17503-eliminate-rescan.md https://github.com/golang/proposal/blob/master/design/17503-...). So Go is by no means state-of-the-art performance wise. That is not bad and has its benefits, one of them being that you can improve with every release.
adamson 8y ago
> Build OpenJDK yourself. [...] I suspect this not a very realistic choice for most companies. Are they saying that most firms don't have the ability to build software themselves, or is this a situation particular to Java where they don't backport security patches and most firms aren't on the latest major?
- MBCook 8y ago
  Right now I would expect that basically every company using Java is using the official Oracle version. They’ve never had to worry that they can’t get security patches for the version released 14 months ago. Practically everyone can use OpenJDK as a drop in replacement. But right now we don’t know how long security patches will continue for each release. I would hope most firms are on Java 8 now. It wouldn’t surprise me to see people who are still on six or seven. Nine/ten had a compatibility break (by removing access to internal packages that no one was supposed to be using). Many companies haven’t upgraded because of that. Lots of very popular Java libraries weren’t ready or depended on other libraries that weren’t ready, so upgrading may have been difficult even if you wanted to. That seems to be a one time thing though. At this point I don’t see why companies shouldn’t be able to upgrade relatively frequently to the latest major release.
needle0 8y ago
Nice idea on clarifying what the word "free" means in this context (gratis, not libre) by prefixing it with a dollar sign. This is the first time I saw this, is this usage widespread?
- medgno 8y ago
  I've never seen it either and found it to be immediately clear. I wonder what similar prefixes could be used for "libre not gratis" and "libre and gratis". I know that "Free" could stand in for the second, but it's more ambiguous than "$free" was in this article.
- MBCook 8y ago
  After I knew what they meant it made sense, initially I wondered if it was a version of that old programmer joke of a shell variable. Like $DIETY.
hyperpallium 8y ago
Java is still available at zero-price
no_wizard 8y ago
One could argue that LTS software is just a trap (and a particularly lucrative one). I know that this is likely a couple factors that allow me to say this namely 1. I can rule over our dependency and technology choices with an iron fist if need be 2. I live in on post 3.6+ Python as our main language and for anyone with good CD/CI you can always run your tests against the master branch and latest dev builds at least one or two versions ahead Okay so with that said, I feel like LTS versions of software are a trap for this reason. You end up in situations where there is so much pain with upgrading that you end up spending more either more time slogging through incompatibilities in the upgrade pipeline the longer you put it off the worst this gets, or you end up in situations where you have to maintain a forked Verizon’s if the code base while you upgrade things or you have to do a lot of monkey patching and work around to just get things running (famously this is the approach GitHub used to upgrade from different versions of Rails) The alternative is to pay money to companies that will maintain the version of what you are using, but even then you inevitably have to move forward and that leads to nasty vendor lock in I personally believe that having a robust CD/CI platform and a well tested code base allows you to by pass this whole charade. We always have our code tested against the next next incremental release in testing, the next versions dev branch and a rolling git pull and build that tests our code base. We really do expect things to break but it lets us plan with our working code quite accurately to avoid this problem altogether and now we largely update pretty close to release cadence. I don’t know if this helps anyone but I suggest doing software development in this fashion will save you a ton of headache. Being up to date with rolling release strategies has helped our productivity immensely because we can think about our dependencies and we have really whittled down to just a few core ones l. At a certain point we also formed some of the smaller ones and find maintaining those ourselves has been a flawless experience
- cwyers 8y ago
  Not upgrading your dependencies in-line with upstream is a form of perverse technical debt -- perverse because most technical debt is incurred to get new features/releases quicker, whereas the technical debt from not upgrading is incurred to simply stay where you are.
  - 8y ago
ToFab123 8y ago
On a scale from 1 - 10 it gonna suck 15 when the tech you rely on is being bought by Oracle.
- afroboy 8y ago
  Actually Java got saved by Oracle, and Java 8 would never happened under Sun management. let's say Java got mush mush better under Oracle. i know how hard the truth is by telling someone Oracle did something good but actually it did.
  - iamcreasy 8y ago
    I didn't keep up when it happened. What happened with Sun?
  - ToFab123 8y ago
    Happy to hear that it is not all bad
tannhaeuser 8y ago
Was RMS right after all? [1]; https://www.gnu.org/philosophy/java-trap.en.html https://www.gnu.org/philosophy/java-trap.en.html
lowry 8y ago
The author exposes his agenda by downplaying Oracle's decisions that impact Java availability to businesses and FUDing other options, e.g. he says that RedHat will push security fixes to OpenJDK first and repackage afterward, as if it was something bad.
wheresvic1 8y ago
Kudos to RH. Here's hoping that we don't have to keep adding JIRA issues to update Java every 6 months. I have enough of this on the Javascript side as it is..

175 points by lemming 8y ago

The TL;DR is that Red Hat and IBM are going to take over from Oracle as primary maintainers of java 8 (in the form of openjdk) after January 2019. That is likely to last through at least 2022. Going forward Oracle will be primary maintainers of openjdk for each new version of java for six months. Every third version (starting with 11) the hope and expectation is that RH, IBM, et al will take over after those six months are up and continue to support those versions for at least several years.

adamson 8y ago
That's such a weird arrangement from a people perspective, but if that works out, it bodes pretty well for the longevity of Java
flukus 8y ago
That sounds like a disaster, the developers at oracle no longer have any personal incentive when it comes to producing quality, maintainable software because it is no longer a problem they have to deal with. Because they're not feeling any personal pain from bad decisions they will no longer learn from them. This is close to the consultancy business model that's been at the root of so much bad software.
- MBCook 8y ago
  What makes you say that? The Oracle JDK IS the Open JDK, only with a few extra features. At least that’s my understanding. A shared code base. If they do a terrible job of sticking a feature in they’re going to have to keep handling it until it’s cleaned up or removed.

didip 8y ago

I am not well-verse in Java world and curious about one thing. The valuable part of Oracle JDK is the GC. For example G1 is only going to be available on OpenJDK 9. What if there's a new GC being developed, will OpenJDK have the new GC?

kevinherron 8y ago
There is a new GC being developed (ZGC), and it's available as part of OpenJDK under GPL license. See this thread from earlier today: https://news.ycombinator.com/item?id=17875944 https://news.ycombinator.com/item?id=17875944
pgwhalen 8y ago
Yes. http://openjdk.java.net/jeps/333 http://openjdk.java.net/jeps/333
MBCook 8y ago
My understanding is that Open JDK is where all Java language development takes place now. It’s only some special enterprise features that aren’t part of the language itself that are restricted to the paid version of the Oracle JDK.
- jerven 8y ago
  Were (past tense) there is nothing in Oracle JDK 11 that is not in OpenJDK 11.
  - MBCook 8y ago
    Oh, I thought there might still be some high end EE stuff. Thanks for the clarification.
tveita 8y ago
G1 works fine on OpenJDK 8, you just have to pass the command line parameters to enable it. It was made the defaultin OpenJDK 9.

roenxi 8y ago

Up until around 2008, clock speed was increasing rapidly and the bottleneck to systems performance kept changing. Software was being obsoleted in a mater of years. Then things started changing; evidenced perhaps by Windows upgrades suddenly becoming a lot less relevant and Apple starting to steamroll more modular computer builders like Dell. Mark my words, there will come a day where continuously upgrading software will start to have a clearly higher cost than old, boring and stable. 2018 to me is the first year that a software platform can have had a true decade to stabilise in an environment that isn't constantly shifting and changing at a hardware level. Maybe trends like in graphics cards will shake things up, but I believe the advantage is going to move to stable, slow upgrading, well supported platforms with large bases of well trained developer. Reducing LTS windows will be a disadvantage for the Java ecosystem.

bognition 8y ago
The drive to move quickly with software wasn't to keep up with ever changing hardware, it was to respond quickly to the market. Treat every release like an experiment. The more experiments you can run the more likely you are to understand and solve the needs of your users. Why would someone pick software that get feature releases and bug fixes on a yearly cycle when similar software is available that has weekly or daily releases.
- Barrin92 8y ago
  >The more experiments you can run the more likely you are to understand and solve the needs of your users. There is an interesting chapter for this in Donella Meadows thinking in Systems Oscillations! A single step up in sales causes inventory to drop. The car dealer watches long enough to be sure the higher sales rate is going to last. Then she begins to order more cars to both cover the new rate of sales and bring the inventory up. But it takes time for the orders to come in. During that time inventory drops further, so orders have to go up a little more, to bring inventory back up to ten days’ coverage. Eventually, the larger volume of orders starts arriving, and inventory recovers—and more than recovers, because during the time of uncertainty about the actual trend, the owner has ordered too much. She now sees her mistake, and cuts back, but there are still high past orders coming in, so she orders even less. In fact, almost inevitably, since she still can’t be sure of what is going to happen next, she orders too little. Inventory gets too low again. And so forth, through a series of oscillations around the new desired inventory level. As Figure 33 illustrates, what a difference a few delays make! Faster is not always better, especially in systems with delays. By reacting to initial cues prematurely you can easily end up in permanent disarray that simply turns into a chaotic feedback loop. It is often worthwile to upgrade patiently, so one can actually gauge long-term effects instead of reacting to noise. Changing the consumer experience is a conversation.

mevile 8y ago

Java moving to 6 month release cycles is good. OpenJDK is good. RedHat providing long term support is good. All of this is good. Where I'm worried this fails is with dependencies. Also in the context of developing plugins for other Java projects. For example building a plugin for IntelliJ and the different versions of IntelliJ users may have.

sbov 8y ago
Is this a major concern? Isn't this part of why Java works to maintain backwards compatibility?
koolba 8y ago
Java has legendary backwards compatibility and has had that since the first public release. That’s not going anywhere.
- unscaled 8y ago
  This changed somewhat starting with Java 9. Quite a few libraries broke down due to deprecated classes finally being removed and the version format change. Java also has a considerable class of libraries and tools that tends to break on every major release: mocking frameworks, dependency injection libraries, annotation processors and everything heavily relying on bytecode generation. I'd say most Java projects contain at least one of these, so migrating to a newer Java is not just a matter of installing a new JDK and changing your JAVA_HOME.
  - MBCook 8y ago
    Java nine is sort of a special situation because they finally turned off something that people were never supposed to do in the first place and they been warning people about for a very long time. My entire career has been as a Java developer, I’ve never had an issue updating Java to a newer version causing breakage. Upgrading third-party tools, like maven or various other things, can certainly do that. But I haven’t had it happen with Java.
- rhencke 8y ago

spydum 8y ago

what worries me most is the muscle memory of developers downloading Oracle jdk from oracle. If Oracle keeps is dark patterns, thousands of developers will be using the commercial tool and on the hook for license fees.

sdinsn 8y ago
That is not how it works. You can download the Oracle JDK and use it forever, commercially, for free. You just won't get updates backported to your version unless you pay for long term support.
- spydum 8y ago
  Find that in writing. Everything I read says jdk 8 is the last free Oracle jdk.
  - deleted 8y ago
    [deleted]
  - kjeetgill 8y ago
    Then read the article you're commenting on?
    - spydum 8y ago
      I did. Here is the money quote: Firstly, it is not clear that there will be an Oracle JDK that is $free to download. Despite my best attempts, I could not get 100% clarity on this point, but see also this tweet.
      - MBCook 8y ago
        Oracle has never announced that they’re charging for their JDK. In all the talk over this stuff over the last few years they’ve never said that. They’ve been quite clear that it will still be free to download. The only change is that free security patches will now be limited to six months after a release.

scarface74 8y ago

Just for comparison.... Microsoft supports .Net Core LTS releases for three years.... https://www.microsoft.com/net/support/policy https://www.microsoft.com/net/support/policy

flukus 8y ago
Did they learn the definition of "long term support" from phone manufacturers? .net 1.1 (I looked this up when I had to install it earlier this week...) was supported for 10 years until 2013 and as part of Windows Server 2003 (32 bit) it was supported until 2015 so it looks like they're going backwards too.
- scarface74 8y ago
  .Net Core (open source) and .Net Framework (Windows Only) have different support policies. .Net Framework has a much longer support lifecycle. https://support.microsoft.com/en-us/help/17455/lifecycle-faq-net-framework https://support.microsoft.com/en-us/help/17455/lifecycle-faq...
MBCook 8y ago
How frequently do they release LTS releases? The six months security patch limit would be a DISASTER in Java world if releases still happened every 2 to 3 years like they used to. Everyone would be stuck with large periods were no security patches were available without paying. But that’s not happening here. Yes you’re limited to six months of free security patches, but a new version comes out every six months. So you can stick with Oracle and never paid a dime is long as you stay reasonably up to date.
- scarface74 8y ago
  How frequently do they release LTS releases? It’s in the link.

drivingmenuts 8y ago

Maybe it's time to start moving away from Java?

projektir 8y ago
I'm curious what your preferred alternative to Java is?
- scarface74 8y ago
  .Net Core. It’s maintained by a company that actually knows how to support a platform.
  - MBCook 8y ago
    Because Java has had such a terrible support record. And it’s not like Oracle has any products they support. Microsoft has quite a history of creating and then abandoning different APIs and technologies. This is all pointless hyperbole. This isn’t that big change in the Java ecosystem. It’s not like it’s going to cost $20 to run Java at all. The price is for running Oracle’s Java... that’s older than six months... that you want security updates for. You can run a different JVM, you can get the security patches from someone else, you can go without them. You can pay someone other than Oracle. Free options still exist.
    - scarface74 8y ago
      Microsoft is known for s lot of things, but breaking backwards compatibility and short term support aren’t two of them.
      - Skinney 8y ago
        Microsoft broke backwards compatibility when they introduced generics in .NET 2.0. Java, on the other hand, is still getting flac for refusing the break backwards compatibility to introduce reified generics.

exabrial 8y ago

Adoptopenjdk! Azul! OpenJRE! J9! choice is a great thing!

sleepychu 8y ago

What does this mean for me as an engineer who writes Java every day?

agibsonccc 8y ago
Use openjdk instead. By default on linux, that's what will continue to happen. You won't really be impacted by this.
- MBCook 8y ago
  There’s no need to use Open JDK. If that’s your preference or you have some other reason (like the fact it’s probably pre-installed in a Linux distribution) there’s nothing wrong with it. But there’s absolutely no need for a developer to switch off of Oracle unless you absolutely cannot move to Java 9 or newer.
  - jerven 8y ago
    Java 9 is already no longer supported. If you haven't moved yet go directly to 11. As after 11 there are no features in OracleJDK that are not in OpenJDK I would think moving to the vendor supported (Open)JDK on your linux system is the smart default thing to do.
- wiradikusuma 8y ago
  how's the performance compared to Oracle's (in Linux)?
  - agibsonccc 8y ago
    They are the exact same. Oracle moved the core bits to openjdk long ago. See: https://jaxenter.com/green-interview-jdk-binaries-137078.html https://jaxenter.com/green-interview-jdk-binaries-137078.htm...
MBCook 8y ago
Basically nothing. If you can run Java 9 or newer (because you don’t have dependency issues) then you can continue to run the Oracle JDK and just upgrade for security patches.

littlesheephtpt 8y ago

Boy, that Ask.com toolbar must be super lucrative.

FactolSarin 8y ago
Java: malware the moment you click install!
- bitmapbrother 8y ago
  The irony is that you probably use Windows - the world's most insecure, malware, virus and ransomware ridden OS in the world.

TJSomething 8y ago

Where is this is going to leave GraalVM and JIT for ARM? I believe both of those are exclusive to Oracle. And I was kind of excited to use GraalVM.

kjeetgill 8y ago
GraalVM has two versions, CE and EE. EE is closed but CE is open.

pejrich 8y ago

If Java is open and free, then why did Android decide to rewrite Java? I notice a lot of companies seem to avoid Java so there must be some sort of a catch.

agibsonccc 8y ago
You're a long time out of date at this point. Google merged openjdk a long time ago for their base JVM. https://www.theregister.co.uk/2015/12/30/android_openjdk/ https://www.theregister.co.uk/2015/12/30/android_openjdk/
- pjmlp 8y ago
  They didn't fully merged OpenJDK, just selected parts of it, across multiple Android versions. Compatibility is still kind of broken. It isn't possible to guarantee that any random Java library is usable on Android.
  - agibsonccc 8y ago
    Yes not all of it - there are still android specific bits yet. Enough of it is openjdk though.
    - pjmlp 8y ago
      And given how updates work....
realusername 8y ago
Android is quickly moving away from Java to make Kotlin the default language nowadays, it's probably in part due to the Java lawsuit (and in part to add language features quicker without changing the VM).
- pjmlp 8y ago
  They aren't rewriting the Java parts. Kotlin just gets an additional library to make some SDK usage a bit easier.

MBCook 8y ago

I have a friend working at a company that is having “very important” discussions about this. They need to keep up with security patches (for obvious reasons) but the six month limit has them scared. The consensus seems to be that they don’t believe they can keep up with an upgrade schedule that fast and are thus forced to pay for support from someone or hope that the community backports security fixes far enough for the rate at which they feel comfortable upgrading. It doesn’t sound like they actually know what their upgrade rate would be, but they’re sure that it’s much slower than six months.

agibsonccc 8y ago
What's being missed here is there is a whole slew of vendors that support openjdk. Those patches will come from red hat, ibm, azul,.. as well.
- MBCook 8y ago
  The question is for how long. Three months? Six months? A year? The community will provide updates, but it this point no one knows what the eventual pattern will be which makes planning based on it difficult.
  - agibsonccc 8y ago
    Not sure that's relevant either. Within the target environments you're still looking at 5 to 10 years just for red hat: https://access.redhat.com/articles/1299013 https://access.redhat.com/articles/1299013 Azul publishes this as well: https://www.azul.com/products/azul_support_roadmap/ https://www.azul.com/products/azul_support_roadmap/ Cursory google searching is all it takes to find these things.
peanutz454 8y ago
I am not sure I completely understand the implications of this. But, if OpenJDK is the reference implementation, and as long as someone is going to maintain Java 11, there really isn't much to worry. I worked for a company that completely relies on Java. They also relied on Apache, so they had on their roles two developers that wrote code for Apache and Tomcat. Making wild guesses here but - if OpenJDK project gets 300 companies with one contributor each to write code for them, they will continue supporting Java 11. Maintaining Java is in some way a responsibility of every company that benefits from it. Or maybe I am so out of touch with technology that I am absolutely wrong.

euske 8y ago

Honest question: How often do people upgrade their production language? Me: once in a decade, maybe. I'm still perfectly happy (and productive) with C# 3.5, Java 7 and Python 2. I'm grudgingly moving forward because the old toolchains are being deprecated now, but my codes aren't significantly improved because of a few fancy idioms available in a new language, and it barely affects the design decisions. Upgrading your library or framework can be more often, but I tend to still be fairly conservative. Upgrading your language for production twice a year sounds crazy to me.

cdoxsey 8y ago
With Go: every release. Free performance improvements and backwards compatibility. It also doesn't require anything installed on the server, so it's just updating a ci script.
- bearhall 8y ago
  Same for us for Go. The releases have never caused any trouble and the performance improvements are nice to have. For us it’s just changing one base containers version. That being said we still use mostly Python 2 for our Python services.
  - jkaplowitz 8y ago
    If those Python services are going to last beyond 2020 and there's much risk of attackers probing for security vulnerabilities, I suggest you plan a transition to Python 3 during the remaining ~2-year support lifespan of Python 2. It's a lot easier of a transition than it used to be. Any other support replacement language would of course also work to keep you secure, but honestly might be more transition work. If you're a low-value target running unimportant stuff on an airgapped machine, this might not matter.
- eftychis 8y ago
  Go is kind of special, as it is new relatively and the initial implementation of every feature is usually the most basic possible. Thus, every new version there is space for a lot of improvements. What I mean: the garbage collector is/was for all intents and purposes Dijkstra's late 70s ('78) tricolor algorithm. They eliminated re-scanning of the stack on Go 1.7 by adding a hybrid write barrier which is 90's work (found the proposal: https://github.com/golang/proposal/blob/master/design/17503-eliminate-rescan.md https://github.com/golang/proposal/blob/master/design/17503-...). So Go is by no means state-of-the-art performance wise. That is not bad and has its benefits, one of them being that you can improve with every release.

adamson 8y ago

> Build OpenJDK yourself. [...] I suspect this not a very realistic choice for most companies. Are they saying that most firms don't have the ability to build software themselves, or is this a situation particular to Java where they don't backport security patches and most firms aren't on the latest major?

MBCook 8y ago
Right now I would expect that basically every company using Java is using the official Oracle version. They’ve never had to worry that they can’t get security patches for the version released 14 months ago. Practically everyone can use OpenJDK as a drop in replacement. But right now we don’t know how long security patches will continue for each release. I would hope most firms are on Java 8 now. It wouldn’t surprise me to see people who are still on six or seven. Nine/ten had a compatibility break (by removing access to internal packages that no one was supposed to be using). Many companies haven’t upgraded because of that. Lots of very popular Java libraries weren’t ready or depended on other libraries that weren’t ready, so upgrading may have been difficult even if you wanted to. That seems to be a one time thing though. At this point I don’t see why companies shouldn’t be able to upgrade relatively frequently to the latest major release.

needle0 8y ago

Nice idea on clarifying what the word "free" means in this context (gratis, not libre) by prefixing it with a dollar sign. This is the first time I saw this, is this usage widespread?

medgno 8y ago
I've never seen it either and found it to be immediately clear. I wonder what similar prefixes could be used for "libre not gratis" and "libre and gratis". I know that "Free" could stand in for the second, but it's more ambiguous than "$free" was in this article.
MBCook 8y ago
After I knew what they meant it made sense, initially I wondered if it was a version of that old programmer joke of a shell variable. Like $DIETY.

hyperpallium 8y ago

Java is still available at zero-price

no_wizard 8y ago

One could argue that LTS software is just a trap (and a particularly lucrative one). I know that this is likely a couple factors that allow me to say this namely 1. I can rule over our dependency and technology choices with an iron fist if need be 2. I live in on post 3.6+ Python as our main language and for anyone with good CD/CI you can always run your tests against the master branch and latest dev builds at least one or two versions ahead Okay so with that said, I feel like LTS versions of software are a trap for this reason. You end up in situations where there is so much pain with upgrading that you end up spending more either more time slogging through incompatibilities in the upgrade pipeline the longer you put it off the worst this gets, or you end up in situations where you have to maintain a forked Verizon’s if the code base while you upgrade things or you have to do a lot of monkey patching and work around to just get things running (famously this is the approach GitHub used to upgrade from different versions of Rails) The alternative is to pay money to companies that will maintain the version of what you are using, but even then you inevitably have to move forward and that leads to nasty vendor lock in I personally believe that having a robust CD/CI platform and a well tested code base allows you to by pass this whole charade. We always have our code tested against the next next incremental release in testing, the next versions dev branch and a rolling git pull and build that tests our code base. We really do expect things to break but it lets us plan with our working code quite accurately to avoid this problem altogether and now we largely update pretty close to release cadence. I don’t know if this helps anyone but I suggest doing software development in this fashion will save you a ton of headache. Being up to date with rolling release strategies has helped our productivity immensely because we can think about our dependencies and we have really whittled down to just a few core ones l. At a certain point we also formed some of the smaller ones and find maintaining those ourselves has been a flawless experience

cwyers 8y ago
Not upgrading your dependencies in-line with upstream is a form of perverse technical debt -- perverse because most technical debt is incurred to get new features/releases quicker, whereas the technical debt from not upgrading is incurred to simply stay where you are.
- 8y ago

ToFab123 8y ago

On a scale from 1 - 10 it gonna suck 15 when the tech you rely on is being bought by Oracle.

afroboy 8y ago
Actually Java got saved by Oracle, and Java 8 would never happened under Sun management. let's say Java got mush mush better under Oracle. i know how hard the truth is by telling someone Oracle did something good but actually it did.
- iamcreasy 8y ago
  I didn't keep up when it happened. What happened with Sun?
- ToFab123 8y ago
  Happy to hear that it is not all bad

tannhaeuser 8y ago

Was RMS right after all? [1]; https://www.gnu.org/philosophy/java-trap.en.html https://www.gnu.org/philosophy/java-trap.en.html

lowry 8y ago

The author exposes his agenda by downplaying Oracle's decisions that impact Java availability to businesses and FUDing other options, e.g. he says that RedHat will push security fixes to OpenJDK first and repackage afterward, as if it was something bad.

wheresvic1 8y ago

Kudos to RH. Here's hoping that we don't have to keep adding JIRA issues to update Java every 6 months. I have enough of this on the Javascript side as it is..