7 ms·

Timely or topical, considering that O is now auditing Java. https://www.theregister.com/2022/03/22/oracle_starts_to_include_java/ https://www.theregister.com/2

Timely or topical, considering that O is now auditing Java. https://www.theregister.com/2022/03/22/oracle_starts_to_include_java/ https://www.theregister.com/2022/03/22/oracle_starts_to_incl... If you're not familiar with O, or wondering why an innocuous statement like the above strikes fear into people, it's not about just licensing Java. It's about their extortionate tactics and how they try to catch you in gray areas due to ambiguous wording in their terms and conditions, and demand fees for violating them.

zibzab 5y ago
Friendly reminder that if you install virtualbox with guest services at work, Oracle lawyers will eventually demand a huge sum from your company.
- notreallyserio 5y ago
  I did a tiny amount of searching to verify this but came up empty handed. Guest additions (what I think you meant) is GPLv2, so it should be free for use.
  - dspillett 5y ago
    > Guest additions (what I think you meant) is GPLv2 It is presumably referring to “VirtualBox 6.1.32 Oracle VM VirtualBox Extension Pack”: > Support for USB 2.0 and USB 3.0 devices, VirtualBox RDP, disk encryption, NVMe and PXE boot for Intel cards. > The Extension Pack binaries are released under the VirtualBox Personal Use and Evaluation License (PUEL). ref: https://www.virtualbox.org/wiki/Downloads https://www.virtualbox.org/wiki/Downloads
    - rrego 5y ago
      The difficulty in distinguishing the two is likely intentional. At my previous org, Oracle sent a spreadsheet of IPs to my company's compliance department which they claimed were using the extension pack and so violated their license agreement. They demanded proof of the license. The vast majority including I, only ever used guest additions (GPL).
      - dspillett 5y ago
        > The difficulty in distinguishing the two is likely intentional. That would not surprise me. Back when we were considering virtualisers many years ago, the issue was one of the reasons² I recommended against vbox despite using it at home - it felt a bit too dark-patterny¹ for my tastes. We went with a VMWare tool instead. [1] though I'm not sure the term “dark pattern” had been coined, or if it had it was in my vocab, at that point [2] another being Oracles general behaviour at the time - this was after their purchase of Sun and therefore Virtual Box.
- maicro 5y ago
  I consider the reminder friendly, but definitely not what it implies... Any source on this? By guest services, you mean the additional "click this to install some custom stuff in the running VM so it works better" step? And if so, just after doing that, or VirtualBox in general?
- crad 5y ago
  Have run into this multiple times with them in multiple companies. For those asking, it's about the "VitualBox 6.1.32 Oracle VM VirtualBox Extension Pack" - it's free to install but phones home and they reach out after a year or two of use and attempt to coerce you into paying for a license. Just ensure everyone has uninstalled it and tell them to go pound sand.
- severino 5y ago
  What exactly are "guest services" in VirtualBox?
  - spicybright 5y ago
    I think it refers to extra integration features like window resizing, clipboard read/write, drag-n-drop files between guest and host, etc.
    - severino 5y ago
      Then he is wrong. That's GPL, you can get it installed straight from your distros's repo.
    - fletchowns 5y ago
      Those features are from VirtualBox Guest Additions. VirtualBox Extension Pack, on the other hand, provides support for USB 2.0 and USB 3.0 devices, VirtualBox RDP, disk encryption, NVMe and PXE boot for Intel cards.
kaba0 5y ago
That article is just fud. OpenJDK any version is free to use for whatever reason, period. If you use OracleJDK (which is pretty identical so unless you need support, go with OpenJDK), then you previously had to pay, but Oracle recently made the last version of it free to use. I mean, it really can’t get easier and freer. It is the same model as with Red Hat linux and fedora, hell, it is even more permissive as you can use the latest Red Hat version free of charge until the next one comes around (+1 year)
- belter 5y ago
  When a company Licensing is so complicated, that there are whole companies whose business case, is to help you negotiate with Oracle, it should make for pause and caution: "Oracle Java Release 17 Is it Free Again?" https://www.softwareone.com/en/blog/all-articles/2021/09/20/oracle-java-release-17 https://www.softwareone.com/en/blog/all-articles/2021/09/20/...
  - cogman10 5y ago
    The company licensing around OracleJDK is complicated. OpenJDK remains licensed under GPL. The only thing complicated here is that people seem to think that OracleJDK IS OpenJDK, it is not nor has it ever been. OracleJDK is no different than Azul's JDK. It's a JDK vendored and supported by Oracle. The long and short answer is, so long as you are using a JDK vendored by your operating system or a docker image that doesn't explicitly say "oracle jdk" you are and continue to be safe. There's no sneak lawyer trap that's going to spring. I've seen these claims ever since oracle bought sun and have yet to see oracle act in bad faith with their sun acquired open source software.
    - belter 5y ago
      This is the long version, regularly updated over the years. "Java Is Still Free 3.0.0 (Oct 2021)": https://medium.com/@javachampions/java-is-still-free-3-0-0-ocrt-2021-bca75c88d23b https://medium.com/@javachampions/java-is-still-free-3-0-0-o...
- bitcharmer 5y ago
nikanj 5y ago
In the past the curse was “May you be recognized by people in high places”, nowadays it's "May Oracle learn of your existence". Nothing worse than learning that Joe Random from 3rd level techsupport installed Virtualbox, and now your entire organization is about to get audited by Oracle.
btbuilder 5y ago
They were already doing some Java license auditing. Last year we were contacted about some small usage of Oracle JDK 8 they detected via auto-update checks from our corp IPs. Our usage of Oracle Java 8 is classed as free still, and we pay Azul for the rest of our Java usage. I highly recommend Azul if you are looking for a vendor.
axus 5y ago
I use Corretto primarily to avoid Oracle.
- chrisseaton 5y ago
  Do you realise it’s still mostly Oracle code you’re running?
- pjmlp 5y ago
  While using code that is mostly written by Oracle employees. It is incredible how people keep missing the picture about OpenJDK main contributer.
  - wbillingsley 5y ago
    I don't think it's Oracle's coders that people worry about so much as its sales model and lawyers. Particularly, that it makes it too easy for end-users to stumble into using components that do not come under its open source licence. This makes it a headache for organisations and users, because it is very difficult for an organisation to police "you can use X, but you musn't pass Y command-line flag that could invoke a non-free part" and other actions that could create a liability for the organisation (and a disciplinary row for the employee) It's a little like deciding you're going to set up a sweet shop, give out free samples, and lay landmines one foot either side of the entrance. If they historically used a model more similar to JetBrains or other companies that have a commercial open source product (where the program looks for a licence key in order to activate the non-free features, or where there is a completely separate install process for free and non-free versions) I expect they wouldn't face the same regular criticism. It's the 'Surprise! Lawyers!" aspect that people find stressful and unattractive. With JDK builds, this separation of free and non-free product is what the community has essentially provided: if you install something like Adoptium Eclipse Temurin, you can be a bit more confident it hasn't bundled non-free programs that could create a financial liability alongside it. You could try to track which Oracle downloads are what, but they've changed their licence from time to time, so some people find it easier simply to differentiate by what organisation provided the packaged JDK.
deleted 5y ago
[deleted]
- deleted 5y ago
  [deleted]

zibzab 5y ago

Friendly reminder that if you install virtualbox with guest services at work, Oracle lawyers will eventually demand a huge sum from your company.

notreallyserio 5y ago
I did a tiny amount of searching to verify this but came up empty handed. Guest additions (what I think you meant) is GPLv2, so it should be free for use.
- dspillett 5y ago
  > Guest additions (what I think you meant) is GPLv2 It is presumably referring to “VirtualBox 6.1.32 Oracle VM VirtualBox Extension Pack”: > Support for USB 2.0 and USB 3.0 devices, VirtualBox RDP, disk encryption, NVMe and PXE boot for Intel cards. > The Extension Pack binaries are released under the VirtualBox Personal Use and Evaluation License (PUEL). ref: https://www.virtualbox.org/wiki/Downloads https://www.virtualbox.org/wiki/Downloads
  - rrego 5y ago
    The difficulty in distinguishing the two is likely intentional. At my previous org, Oracle sent a spreadsheet of IPs to my company's compliance department which they claimed were using the extension pack and so violated their license agreement. They demanded proof of the license. The vast majority including I, only ever used guest additions (GPL).
    - dspillett 5y ago
      > The difficulty in distinguishing the two is likely intentional. That would not surprise me. Back when we were considering virtualisers many years ago, the issue was one of the reasons² I recommended against vbox despite using it at home - it felt a bit too dark-patterny¹ for my tastes. We went with a VMWare tool instead. [1] though I'm not sure the term “dark pattern” had been coined, or if it had it was in my vocab, at that point [2] another being Oracles general behaviour at the time - this was after their purchase of Sun and therefore Virtual Box.
maicro 5y ago
I consider the reminder friendly, but definitely not what it implies... Any source on this? By guest services, you mean the additional "click this to install some custom stuff in the running VM so it works better" step? And if so, just after doing that, or VirtualBox in general?
crad 5y ago
Have run into this multiple times with them in multiple companies. For those asking, it's about the "VitualBox 6.1.32 Oracle VM VirtualBox Extension Pack" - it's free to install but phones home and they reach out after a year or two of use and attempt to coerce you into paying for a license. Just ensure everyone has uninstalled it and tell them to go pound sand.
severino 5y ago
What exactly are "guest services" in VirtualBox?
- spicybright 5y ago
  I think it refers to extra integration features like window resizing, clipboard read/write, drag-n-drop files between guest and host, etc.
  - severino 5y ago
    Then he is wrong. That's GPL, you can get it installed straight from your distros's repo.
  - fletchowns 5y ago
    Those features are from VirtualBox Guest Additions. VirtualBox Extension Pack, on the other hand, provides support for USB 2.0 and USB 3.0 devices, VirtualBox RDP, disk encryption, NVMe and PXE boot for Intel cards.

kaba0 5y ago

That article is just fud. OpenJDK any version is free to use for whatever reason, period. If you use OracleJDK (which is pretty identical so unless you need support, go with OpenJDK), then you previously had to pay, but Oracle recently made the last version of it free to use. I mean, it really can’t get easier and freer. It is the same model as with Red Hat linux and fedora, hell, it is even more permissive as you can use the latest Red Hat version free of charge until the next one comes around (+1 year)

belter 5y ago
When a company Licensing is so complicated, that there are whole companies whose business case, is to help you negotiate with Oracle, it should make for pause and caution: "Oracle Java Release 17 Is it Free Again?" https://www.softwareone.com/en/blog/all-articles/2021/09/20/oracle-java-release-17 https://www.softwareone.com/en/blog/all-articles/2021/09/20/...
- cogman10 5y ago
  The company licensing around OracleJDK is complicated. OpenJDK remains licensed under GPL. The only thing complicated here is that people seem to think that OracleJDK IS OpenJDK, it is not nor has it ever been. OracleJDK is no different than Azul's JDK. It's a JDK vendored and supported by Oracle. The long and short answer is, so long as you are using a JDK vendored by your operating system or a docker image that doesn't explicitly say "oracle jdk" you are and continue to be safe. There's no sneak lawyer trap that's going to spring. I've seen these claims ever since oracle bought sun and have yet to see oracle act in bad faith with their sun acquired open source software.
  - belter 5y ago
    This is the long version, regularly updated over the years. "Java Is Still Free 3.0.0 (Oct 2021)": https://medium.com/@javachampions/java-is-still-free-3-0-0-ocrt-2021-bca75c88d23b https://medium.com/@javachampions/java-is-still-free-3-0-0-o...
bitcharmer 5y ago

nikanj 5y ago

In the past the curse was “May you be recognized by people in high places”, nowadays it's "May Oracle learn of your existence". Nothing worse than learning that Joe Random from 3rd level techsupport installed Virtualbox, and now your entire organization is about to get audited by Oracle.

btbuilder 5y ago

They were already doing some Java license auditing. Last year we were contacted about some small usage of Oracle JDK 8 they detected via auto-update checks from our corp IPs. Our usage of Oracle Java 8 is classed as free still, and we pay Azul for the rest of our Java usage. I highly recommend Azul if you are looking for a vendor.

axus 5y ago

I use Corretto primarily to avoid Oracle.

chrisseaton 5y ago
Do you realise it’s still mostly Oracle code you’re running?
pjmlp 5y ago
While using code that is mostly written by Oracle employees. It is incredible how people keep missing the picture about OpenJDK main contributer.
- wbillingsley 5y ago
  I don't think it's Oracle's coders that people worry about so much as its sales model and lawyers. Particularly, that it makes it too easy for end-users to stumble into using components that do not come under its open source licence. This makes it a headache for organisations and users, because it is very difficult for an organisation to police "you can use X, but you musn't pass Y command-line flag that could invoke a non-free part" and other actions that could create a liability for the organisation (and a disciplinary row for the employee) It's a little like deciding you're going to set up a sweet shop, give out free samples, and lay landmines one foot either side of the entrance. If they historically used a model more similar to JetBrains or other companies that have a commercial open source product (where the program looks for a licence key in order to activate the non-free features, or where there is a completely separate install process for free and non-free versions) I expect they wouldn't face the same regular criticism. It's the 'Surprise! Lawyers!" aspect that people find stressful and unattractive. With JDK builds, this separation of free and non-free product is what the community has essentially provided: if you install something like Adoptium Eclipse Temurin, you can be a bit more confident it hasn't bundled non-free programs that could create a financial liability alongside it. You could try to track which Oracle downloads are what, but they've changed their licence from time to time, so some people find it easier simply to differentiate by what organisation provided the packaged JDK.

deleted 5y ago

[deleted]

deleted 5y ago
[deleted]