6 ms·

Could someone provide a TL;DR on the major patches/benefits that Corretto has over Adopt or other community driven JDK implementations? It is unclear from the d

by hn_20591249 5y ago

Could someone provide a TL;DR on the major patches/benefits that Corretto has over Adopt or other community driven JDK implementations? It is unclear from the documentation but I am assume they have some secret sauce for faster boot for their Firecracker VM instances.

Ironlink 5y ago
According to their user guide, the only patch they have is the branding change: https://docs.aws.amazon.com/corretto/latest/corretto-17-ug/patches.html https://docs.aws.amazon.com/corretto/latest/corretto-17-ug/p... I'll keep using the OpenJDK Docker images.
- iou 5y ago
  They do list the additional patches they do here (for example) https://docs.aws.amazon.com/corretto/latest/corretto-8-ug/patches.html https://docs.aws.amazon.com/corretto/latest/corretto-8-ug/pa...
  - iou 5y ago
    I guess v11 is a better link to share there https://docs.aws.amazon.com/corretto/latest/corretto-11-ug/patches.html https://docs.aws.amazon.com/corretto/latest/corretto-11-ug/p...
    - geofft 5y ago
      Wow, that's awesome - 8 had a handful of custom patches and some backports, 11 had only backports, and 17 has nothing. This is kind of the best possible story for a distribution fork!
      - hueho 5y ago
        In fairness, Java 17 has just been released; it's possible new custom patches will be introduced in future Corretto patch releases. Still, the fact that Corretto 11 had so few backports is encouraging.
- deleted 5y ago
  [deleted]
- vips7L 5y ago
  You probably shouldn’t. Last I checked the OpenJdk docker images use the Debian builds of OpenJdk and there’s been multiple times where they’ve shipped vulnerable builds. [0] You should probably just use the Zulu builds. https://news.ycombinator.com/item?id=19955958 https://news.ycombinator.com/item?id=19955958
gjvc 5y ago
quoting from https://stackoverflow.com/questions/53305934/differences-amazon-corretto-and-openjdk https://stackoverflow.com/questions/53305934/differences-ama... """ To summarize, you have 3 options: - Use OpenJDK for free, but upgrade every 6 months to get updates - Use a paid JDK from Oracle or another vendor - Use Corretto for free, and get free updates for several years """
- nick__m 5y ago
  You also have Zulu from Azul.
  - jpgvm 5y ago
    Which has been a staple of long-term JVM production guys for a long time. You can use their releases free of licensing but can get commercial support if/when you need it.
    - gjvc 5y ago
      And their support is fantastic, even if you are just evaluating the product.
- vbezhenar 5y ago
  From Java 17 you can use Oracle Java 17 LTS for free.
- Macha 5y ago
  Note that this is referring to upstream OpenJDK. Adoptium (formerly AdoptOpenJDK) is equivalent to Cornetto in this comparison
pron 5y ago
Adoptium is not "community driven" (it's made by IBM), and there is only one OpenJDK implementation, the one led and primarily developed by Oracle, with contributions from other companies. What Amazon or IBM do is build the source and distribute the binaries (look at the licence).
- _tom_ 5y ago
  https://news.ycombinator.com/item?id=28821316 https://news.ycombinator.com/item?id=28821316 "...Eclipse Adoptium, built by IBM, which is the only distribution built by a team that isn't involved with the OpenJDK project, isn't very familiar with it, and isn't a member of the OpenJDK Vulnerability team, and so get security patches only after the other vendors have delivered their builds. "
  - jkaplowitz 5y ago
    That's written by the person you're replying to.
- rzzzt 5y ago
  My understanding is that ties between the Eclipse Foundation and IBM are loose enough by now to not call this project an IBM thing. Eclipse did originate at IBM, but that was close to 20 years ago.
  - pron 5y ago
    That may be so, but >90% of the work on this particular Eclipse project is done by IBM. Just as many companies contribute to OpenJDK but it is primarily an Oracle project, and Oracle does most of the work, Adoptium is an IBM project. That, in itself is not good or bad (although it is somewhat bad because, unlike other JDK distributors, IBM is barely involved with OpenJDK and the IBM team that makes the Adoptium builds is not particularly familiar with OpenJDK), but it is certainly not a "community led" distribution -- it is, de facto, an IBM-led one. It did not start out this way, but it has been this way for several years now (they did the same with https://en.wikipedia.org/wiki/Apache_Harmony https://en.wikipedia.org/wiki/Apache_Harmony).
dixie_land 5y ago
I worked at AWS and Corretto came out towards the end of my tenure there. At the time (Java 8), it included in house patches that upstream haven’t or due to politics refused to adopt. Now that I don’t work at Amazon any more I still advocate for the distribution for the LTS model, and the fact that it contains fixes that are only discovered when running in production at the scale of Amazon and AWS.

Ironlink 5y ago

According to their user guide, the only patch they have is the branding change: https://docs.aws.amazon.com/corretto/latest/corretto-17-ug/patches.html https://docs.aws.amazon.com/corretto/latest/corretto-17-ug/p... I'll keep using the OpenJDK Docker images.

iou 5y ago
They do list the additional patches they do here (for example) https://docs.aws.amazon.com/corretto/latest/corretto-8-ug/patches.html https://docs.aws.amazon.com/corretto/latest/corretto-8-ug/pa...
- iou 5y ago
  I guess v11 is a better link to share there https://docs.aws.amazon.com/corretto/latest/corretto-11-ug/patches.html https://docs.aws.amazon.com/corretto/latest/corretto-11-ug/p...
  - geofft 5y ago
    Wow, that's awesome - 8 had a handful of custom patches and some backports, 11 had only backports, and 17 has nothing. This is kind of the best possible story for a distribution fork!
    - hueho 5y ago
      In fairness, Java 17 has just been released; it's possible new custom patches will be introduced in future Corretto patch releases. Still, the fact that Corretto 11 had so few backports is encouraging.
deleted 5y ago
[deleted]
vips7L 5y ago
You probably shouldn’t. Last I checked the OpenJdk docker images use the Debian builds of OpenJdk and there’s been multiple times where they’ve shipped vulnerable builds. [0] You should probably just use the Zulu builds. https://news.ycombinator.com/item?id=19955958 https://news.ycombinator.com/item?id=19955958

gjvc 5y ago

quoting from https://stackoverflow.com/questions/53305934/differences-amazon-corretto-and-openjdk https://stackoverflow.com/questions/53305934/differences-ama... """ To summarize, you have 3 options: - Use OpenJDK for free, but upgrade every 6 months to get updates - Use a paid JDK from Oracle or another vendor - Use Corretto for free, and get free updates for several years """

nick__m 5y ago
You also have Zulu from Azul.
- jpgvm 5y ago
  Which has been a staple of long-term JVM production guys for a long time. You can use their releases free of licensing but can get commercial support if/when you need it.
  - gjvc 5y ago
    And their support is fantastic, even if you are just evaluating the product.
vbezhenar 5y ago
From Java 17 you can use Oracle Java 17 LTS for free.
Macha 5y ago
Note that this is referring to upstream OpenJDK. Adoptium (formerly AdoptOpenJDK) is equivalent to Cornetto in this comparison

pron 5y ago

Adoptium is not "community driven" (it's made by IBM), and there is only one OpenJDK implementation, the one led and primarily developed by Oracle, with contributions from other companies. What Amazon or IBM do is build the source and distribute the binaries (look at the licence).

_tom_ 5y ago
https://news.ycombinator.com/item?id=28821316 https://news.ycombinator.com/item?id=28821316 "...Eclipse Adoptium, built by IBM, which is the only distribution built by a team that isn't involved with the OpenJDK project, isn't very familiar with it, and isn't a member of the OpenJDK Vulnerability team, and so get security patches only after the other vendors have delivered their builds. "
- jkaplowitz 5y ago
  That's written by the person you're replying to.
rzzzt 5y ago
My understanding is that ties between the Eclipse Foundation and IBM are loose enough by now to not call this project an IBM thing. Eclipse did originate at IBM, but that was close to 20 years ago.
- pron 5y ago
  That may be so, but >90% of the work on this particular Eclipse project is done by IBM. Just as many companies contribute to OpenJDK but it is primarily an Oracle project, and Oracle does most of the work, Adoptium is an IBM project. That, in itself is not good or bad (although it is somewhat bad because, unlike other JDK distributors, IBM is barely involved with OpenJDK and the IBM team that makes the Adoptium builds is not particularly familiar with OpenJDK), but it is certainly not a "community led" distribution -- it is, de facto, an IBM-led one. It did not start out this way, but it has been this way for several years now (they did the same with https://en.wikipedia.org/wiki/Apache_Harmony https://en.wikipedia.org/wiki/Apache_Harmony).

dixie_land 5y ago

I worked at AWS and Corretto came out towards the end of my tenure there. At the time (Java 8), it included in house patches that upstream haven’t or due to politics refused to adopt. Now that I don’t work at Amazon any more I still advocate for the distribution for the LTS model, and the fact that it contains fixes that are only discovered when running in production at the scale of Amazon and AWS.