6 ms·

I would be cautious or even distrustful of using anything from Oracle. VirtualBox components come under three different licenses - GPLv2, personal use & evalua

I would be cautious or even distrustful of using anything from Oracle. VirtualBox components come under three different licenses - GPLv2, personal use & evaluation license, and an enterprise license. Their VirtualBox license FAQ [1] gives them enough leeway to change future licenses at will. If an exploit is discovered in your old VirtualBox and they've changed the license, you're out of luck. Be specially careful when installing their extension pack, as it is an evaluation license. We've moved our development to KVM and Virtual Machine Manager on Linux [3] and UTM on Mac [4]. There are other options to run your VM, such as Multipass [5] or VirtualBuddy [6]. On a digressive topic - it was fun migrating our legacy application server stack from Oracle Java (old & poorly considered decision) to OpenJDK, thanks to their license [2]. [1] https://www.virtualbox.org/wiki/Licensing_FAQ https://www.virtualbox.org/wiki/Licensing_FAQ [2] https://www.oracle.com/java/technologies/javase/jdk-faqs.html https://www.oracle.com/java/technologies/javase/jdk-faqs.htm... [3] https://ubuntu.com/blog/kvm-hyphervisor https://ubuntu.com/blog/kvm-hyphervisor [4] https://mac.getutm.app/ https://mac.getutm.app/ [5] https://multipass.run/ https://multipass.run/ [6] https://github.com/insidegui/VirtualBuddy https://github.com/insidegui/VirtualBuddy

kramerger 3y ago
Not only that. In past oracle lawyers have send huge bills to companies after someone in their IP range had used virtualbox guest editions (which is not free for commercial use).
- josephcsible 3y ago
  > virtualbox guest editions (which is not free for commercial use) This is false. https://www.virtualbox.org/wiki/Licensing_FAQ https://www.virtualbox.org/wiki/Licensing_FAQ says: > the VirtualBox Guest Additions are licensed under the GPLv2. You might have been thinking of the VirtualBox Extension Pack, which is an entirely different thing.
  - qwertox 3y ago
    But it's pretty hard not to use the Extension Pack.
    - londons_explore 3y ago
      I don't think I've ever needed an extension pack feature.
      - kramerger 3y ago
        You used to very much need it as it improved performance, display resolution and I/O significantly. Oracle could not milk VirtualBox for money so they used this as a way to extort unknowing commercial users.
    - cowsandmilk 3y ago
      How is it hard? It is a separate download and install.
      - thrawaway3292 3y ago
        Sure, but it's reasonable for most people to expect an extension they've downloaded from within the app itself might have similar licensing as the app itself. Even if it isn't reasonable to do so, I suspect most people do indeed do so, and that's exactly what Oracle is counting on.
        josefx 3y ago
        > from within the app itself Where in the App does it download the extensions? I know it will download the Guest Additions for you, but those are something completely different.
    - josefx 3y ago
      How? It doesn't add any functionality relevant to most users and you have to download it separately from Virtual Box itself.
- lproven 3y ago
  You are wrong. You are confusing the Guest Additions (free, FOSS, included in many distros) and the Extension Pack (commercial/proprietary, freeware for personal/non-commercial use.) I have had to explain this within the last fortnight; read that. https://news.ycombinator.com/item?id=36679707 https://news.ycombinator.com/item?id=36679707
  - kramerger 3y ago
    Sorry, I did in fact mean extension pack. The FOSS one have not always been available/complete hence in past a lot of companies had no choice other than using the Oracle guest addition extension pack. Which resulted in situations like this: https://www.reddit.com/r/sysadmin/comments/d1ttzp/oracle_is_going_after_companies_using_virtualbox/ https://www.reddit.com/r/sysadmin/comments/d1ttzp/oracle_is_...
    - lproven 3y ago
      No, you are still wrong. The Guest Additions are capital F Free. The Extension Pack is not. There is no such thing as "the Oracle guest addition extension pack." Never has been. You are conflating 2 totally different separate things, as is that Redditor.
      - kramerger 3y ago
        Extension Pack used to include the guest tools almost everyone needed. Exactly what it was called is not important. The point is that you needed it and Oracle later made it a torpedo cost.
        lproven 3y ago
        [[Citation needed]] I think you are wrong. The Guest Additions (GAs) are not part of the Extension Pack (EP). As far as I can recall, after I think 15 years of using VirtualBox now, the GAs never were part of the EP. The GAs are FOSS. The EP is not FOSS. Since VirtualBox 4.0, released December 22, 2010, the core product has been FOSS and the proprietary bits were in the EP and only the EP. https://www.virtualbox.org/wiki/News_pre_4_3 https://www.virtualbox.org/wiki/News_pre_4_3 VirtualBox 2 and 3 had separate freeware PUEL and Open Source editions (OSE), but that is back in the noughties. You are reaching back nearly 15 years here to get to when the product was not all-FOSS. I think you are confusing the names and the descriptions of the two totally separate add-ons, one of which is a proprietary addon to the hypervisor itself, and the other of which is a FOSS addon to the OS running inside the VM.
p_l 3y ago
Can you expose some more on the licensing issues with migration from Oracle Java to OpenJDK? I will admit that nothing jumps at me from the FAQ, but then it's rather... legalistic one.
brightlancer 3y ago
> Their VirtualBox license FAQ [1] gives them enough leeway to change future licenses at will. If an exploit is discovered in your old VirtualBox and they've changed the license, you're out of luck. That only applies to the optional Extension Pack. The base software for host and guest is GPL v2, as described in the FAQ you linked. ---- Will the licensing terms of the VirtualBox base package be changed in the future? We are not currently planning to do so, but it doesn't really matter. The license that applies to the VirtualBox base package is perpetual and cannot be taken back unless you violate the license. Even if Oracle were to change the license again, this would only affect future versions, and anybody still in compliance would still be permitted to redistribute the existing VirtualBox code under the terms of the GPLv2. ----
- madsbuch 3y ago
  > this would only affect future versions, I think this is what the parent commenter was saying: > If an exploit is discovered in your old VirtualBox and they've changed the license
- yrro 3y ago
  I think the point is that the patch for a critical security vulnerability _could_ be gated behind a license change. Seems unlikely though even for Oracle. If it did happen I expect someone else would come up with a freely licensed fix and that would be shipped by all the distros. I prefer libvirt/kvm anyway. :)
Etheryte 3y ago
Out of curiosity since it seems you have a lot of experience in this field, how does UTM compare to VMware Fusion on macOS? I used to run VirtualBox for years but switched to VMware due to recurring performance issues. Trying out VMware was like a breath of fresh air, things that used to take a lot of effort to configure suddenly worked right out of the box. How does UTM fare?
happymellon 3y ago
Oh I remember about 10 years ago doing the migration from Oracle JVM to OpenJDK. I think it would have been around the Java 6 period, but there were all sorts of small things that I didn't think would be an issue that ended up cutting us. The two main ones were a font, which I don't remember exactly which or why but I think it was to generate PDFs and it came bundled with the Oracle JVM so the PDF library defaulted to it. For Open JDK there was an extra setup step to install a RedHat font, but it was confusing when a pdf comes out garbled because you switched your JVM. But I could be mixing up my issues. I think the other was built in certificates, but it was too long ago now. Having a fun time at the moment with Java 11 to 17. The application has extensive Lombok, so nothing quite works the same. I've had less pain migrating from Python 2 to 3.
- winrid 3y ago
  Yeah, Lombok doesn't use standard, supported APIs. They even say in their docs, what they're doing could become incompatible for future java versions at any time. Not java's fault really. It is for this reason I don't use it (also I don't like too much magic, but that's me).
  - jarym 3y ago
    > I don't like too much magic Not just you. 'Magic' seems great until newer members of the team have no idea how it works and just use it - then things get painful.
    - happymellon 3y ago
      I dislike Spring JPA for the same reason. It just magically understands your query based upon the name of the function. There is far too much "magic" going on these days which has a massive learning curve for the newbies, and a headache for everyone else when something stops working because they've changed how the incantation works.
  - happymellon 3y ago
    Yeah, I didn't pick it and this is an inherited codebase that I'm trying to bring up to date while I still have overlapping Java 11 support. I haven't picked it in the past except for a toy project, to experiment with Lombok. It has some interesting ideas which would be nice if they folded it into Java, but while it's fringe it ends up being a liability.
misterS 3y ago
> Be specially careful when installing their extension pack, as it is an evaluation license. Our company was targeted by Oracle Sales because they detected mere _downloads_ from our IP range. They couldn't prove any installations, but of course wanted the company to pay for commercial licenses. Im not sure about the details, but in the end I think we bought a couple of licences & then blocked all URLs for the extension pack company-wide.
- benterix 3y ago
  Is this even legal? After such an intrusion I wouldn't ever want to have anything to do with Oracle.
  - krylon 3y ago
    Hence the blocking of said URLs afterwards.
  - jacquesm 3y ago
    There are companies that weaponize the use of tracking to the point that just a visit from your IP address can result in leadgen. For instance Lead Forensics, but there are others in this space as well.
  - dspillett 3y ago
    > Is this even legal? Probably not. But how would you feel about going up against Oracle's legal team to make the point? They, and other large companies, rely on this a lot when deciding upon whether or not to use dubious practises. I think Oracle's main business has become litigious & licensing arse-hole-ary, with everything else in their portfolio existing to support those functions, so they are rather good at it. > After such an intrusion I wouldn't ever want to have anything to do with Oracle. This sort of thing is why many people are wary of Oracle. The company has considerable form for this sort of thing and worse.
- nly 3y ago
  Happened to me on a VPS also
- 3y ago
anta40 3y ago
>> UTM on Mac How easy is it to setup directory sharing? Reading https://docs.getutm.app/guest-support/sharing/directory https://docs.getutm.app/guest-support/sharing/directory... seems a bit more difficult than VirtualBox My use case is relatively simple: build some tiny OSes (into ISO image) on Linux VM, then run the ISO on macOS's qemu
- palinkapika 3y ago
  UTM uses VirtioFS with Apple's virtualisation backend. Works out of the box with my Ubuntu server guests. You still need to mount the share as described here, but that's it: https://docs.getutm.app/guest-support/linux/#macos-virtiofs https://docs.getutm.app/guest-support/linux/#macos-virtiofs What took me a bit to figure out is that this does not mount a single folder, but a virtual parent folder to which you can add and remove directories without changing the mount. This even works while the VM is running. For example, mounting share /mnt/host virtiofs rw,nofail 0 0 in the guest and then sharing ~/Downloads in UTM will share the Downloads folder as /mnt/host/Downloads When using the QEMU backend, VirtFS is used instead, which does not use such a parent folder and requires restarting the VM to change shares iirc.
pt_PT_guy 3y ago
license issues apart, virtualbox guest tools for windows are awesome: clipboard sharing, drag and dropping files, network shares, auto window resize, etc just work out of the box. With KVM/splicetools it is always a pain to setup that.
mkl 3y ago
> Virtual Machine Manager Do you mean Red Hat's Virtual Machine Manager, AKA virt-manager (https://en.wikipedia.org/wiki/Virt-manager https://en.wikipedia.org/wiki/Virt-manager), or Microsoft's Virtual Machine Manager (https://learn.microsoft.com/en-us/system-center/vmm/?view=sc-vmm-2022 https://learn.microsoft.com/en-us/system-center/vmm/?view=sc...), or Synology's Virtual Machine Manager (https://www.synology.com/en-global/dsm/feature/virtual_machine_manager https://www.synology.com/en-global/dsm/feature/virtual_machi...)? I'm guessing the first one? I use VirtualBox for trying things out or sandboxing, mainly because of the friendly GUI, but wouldn't mind switching to something as friendly that's not Oracle's.
maxlin 3y ago
From oracle, I only use an older version of Virtualbox and in cloud I only use their free VM tier (4 ARM cores & 12GB RAM) because it's the best current "permanent" offer out there. That said, I take care to not invest in to any of their specific cloud guff and just run my own or generally available software & OS on Linux VM's there, which is not too much work to migrate anywhere. I've seen enough in the past to have zero trust in the company to not start doing more anti-dev stuff.

kramerger 3y ago

Not only that. In past oracle lawyers have send huge bills to companies after someone in their IP range had used virtualbox guest editions (which is not free for commercial use).

josephcsible 3y ago
> virtualbox guest editions (which is not free for commercial use) This is false. https://www.virtualbox.org/wiki/Licensing_FAQ https://www.virtualbox.org/wiki/Licensing_FAQ says: > the VirtualBox Guest Additions are licensed under the GPLv2. You might have been thinking of the VirtualBox Extension Pack, which is an entirely different thing.
- qwertox 3y ago
  But it's pretty hard not to use the Extension Pack.
  - londons_explore 3y ago
    I don't think I've ever needed an extension pack feature.
    - kramerger 3y ago
      You used to very much need it as it improved performance, display resolution and I/O significantly. Oracle could not milk VirtualBox for money so they used this as a way to extort unknowing commercial users.
  - cowsandmilk 3y ago
    How is it hard? It is a separate download and install.
    - thrawaway3292 3y ago
      Sure, but it's reasonable for most people to expect an extension they've downloaded from within the app itself might have similar licensing as the app itself. Even if it isn't reasonable to do so, I suspect most people do indeed do so, and that's exactly what Oracle is counting on.
      - josefx 3y ago
        > from within the app itself Where in the App does it download the extensions? I know it will download the Guest Additions for you, but those are something completely different.
  - josefx 3y ago
    How? It doesn't add any functionality relevant to most users and you have to download it separately from Virtual Box itself.
lproven 3y ago
You are wrong. You are confusing the Guest Additions (free, FOSS, included in many distros) and the Extension Pack (commercial/proprietary, freeware for personal/non-commercial use.) I have had to explain this within the last fortnight; read that. https://news.ycombinator.com/item?id=36679707 https://news.ycombinator.com/item?id=36679707
- kramerger 3y ago
  Sorry, I did in fact mean extension pack. The FOSS one have not always been available/complete hence in past a lot of companies had no choice other than using the Oracle guest addition extension pack. Which resulted in situations like this: https://www.reddit.com/r/sysadmin/comments/d1ttzp/oracle_is_going_after_companies_using_virtualbox/ https://www.reddit.com/r/sysadmin/comments/d1ttzp/oracle_is_...
  - lproven 3y ago
    No, you are still wrong. The Guest Additions are capital F Free. The Extension Pack is not. There is no such thing as "the Oracle guest addition extension pack." Never has been. You are conflating 2 totally different separate things, as is that Redditor.
    - kramerger 3y ago
      Extension Pack used to include the guest tools almost everyone needed. Exactly what it was called is not important. The point is that you needed it and Oracle later made it a torpedo cost.
      - lproven 3y ago
        [[Citation needed]] I think you are wrong. The Guest Additions (GAs) are not part of the Extension Pack (EP). As far as I can recall, after I think 15 years of using VirtualBox now, the GAs never were part of the EP. The GAs are FOSS. The EP is not FOSS. Since VirtualBox 4.0, released December 22, 2010, the core product has been FOSS and the proprietary bits were in the EP and only the EP. https://www.virtualbox.org/wiki/News_pre_4_3 https://www.virtualbox.org/wiki/News_pre_4_3 VirtualBox 2 and 3 had separate freeware PUEL and Open Source editions (OSE), but that is back in the noughties. You are reaching back nearly 15 years here to get to when the product was not all-FOSS. I think you are confusing the names and the descriptions of the two totally separate add-ons, one of which is a proprietary addon to the hypervisor itself, and the other of which is a FOSS addon to the OS running inside the VM.

p_l 3y ago

Can you expose some more on the licensing issues with migration from Oracle Java to OpenJDK? I will admit that nothing jumps at me from the FAQ, but then it's rather... legalistic one.

brightlancer 3y ago

> Their VirtualBox license FAQ [1] gives them enough leeway to change future licenses at will. If an exploit is discovered in your old VirtualBox and they've changed the license, you're out of luck. That only applies to the optional Extension Pack. The base software for host and guest is GPL v2, as described in the FAQ you linked. ---- Will the licensing terms of the VirtualBox base package be changed in the future? We are not currently planning to do so, but it doesn't really matter. The license that applies to the VirtualBox base package is perpetual and cannot be taken back unless you violate the license. Even if Oracle were to change the license again, this would only affect future versions, and anybody still in compliance would still be permitted to redistribute the existing VirtualBox code under the terms of the GPLv2. ----

madsbuch 3y ago
> this would only affect future versions, I think this is what the parent commenter was saying: > If an exploit is discovered in your old VirtualBox and they've changed the license
yrro 3y ago
I think the point is that the patch for a critical security vulnerability _could_ be gated behind a license change. Seems unlikely though even for Oracle. If it did happen I expect someone else would come up with a freely licensed fix and that would be shipped by all the distros. I prefer libvirt/kvm anyway. :)

Etheryte 3y ago

Out of curiosity since it seems you have a lot of experience in this field, how does UTM compare to VMware Fusion on macOS? I used to run VirtualBox for years but switched to VMware due to recurring performance issues. Trying out VMware was like a breath of fresh air, things that used to take a lot of effort to configure suddenly worked right out of the box. How does UTM fare?

happymellon 3y ago

Oh I remember about 10 years ago doing the migration from Oracle JVM to OpenJDK. I think it would have been around the Java 6 period, but there were all sorts of small things that I didn't think would be an issue that ended up cutting us. The two main ones were a font, which I don't remember exactly which or why but I think it was to generate PDFs and it came bundled with the Oracle JVM so the PDF library defaulted to it. For Open JDK there was an extra setup step to install a RedHat font, but it was confusing when a pdf comes out garbled because you switched your JVM. But I could be mixing up my issues. I think the other was built in certificates, but it was too long ago now. Having a fun time at the moment with Java 11 to 17. The application has extensive Lombok, so nothing quite works the same. I've had less pain migrating from Python 2 to 3.

winrid 3y ago
Yeah, Lombok doesn't use standard, supported APIs. They even say in their docs, what they're doing could become incompatible for future java versions at any time. Not java's fault really. It is for this reason I don't use it (also I don't like too much magic, but that's me).
- jarym 3y ago
  > I don't like too much magic Not just you. 'Magic' seems great until newer members of the team have no idea how it works and just use it - then things get painful.
  - happymellon 3y ago
    I dislike Spring JPA for the same reason. It just magically understands your query based upon the name of the function. There is far too much "magic" going on these days which has a massive learning curve for the newbies, and a headache for everyone else when something stops working because they've changed how the incantation works.
- happymellon 3y ago
  Yeah, I didn't pick it and this is an inherited codebase that I'm trying to bring up to date while I still have overlapping Java 11 support. I haven't picked it in the past except for a toy project, to experiment with Lombok. It has some interesting ideas which would be nice if they folded it into Java, but while it's fringe it ends up being a liability.

misterS 3y ago

> Be specially careful when installing their extension pack, as it is an evaluation license. Our company was targeted by Oracle Sales because they detected mere _downloads_ from our IP range. They couldn't prove any installations, but of course wanted the company to pay for commercial licenses. Im not sure about the details, but in the end I think we bought a couple of licences & then blocked all URLs for the extension pack company-wide.

benterix 3y ago
Is this even legal? After such an intrusion I wouldn't ever want to have anything to do with Oracle.
- krylon 3y ago
  Hence the blocking of said URLs afterwards.
- jacquesm 3y ago
  There are companies that weaponize the use of tracking to the point that just a visit from your IP address can result in leadgen. For instance Lead Forensics, but there are others in this space as well.
- dspillett 3y ago
  > Is this even legal? Probably not. But how would you feel about going up against Oracle's legal team to make the point? They, and other large companies, rely on this a lot when deciding upon whether or not to use dubious practises. I think Oracle's main business has become litigious & licensing arse-hole-ary, with everything else in their portfolio existing to support those functions, so they are rather good at it. > After such an intrusion I wouldn't ever want to have anything to do with Oracle. This sort of thing is why many people are wary of Oracle. The company has considerable form for this sort of thing and worse.
nly 3y ago
Happened to me on a VPS also
3y ago

anta40 3y ago

>> UTM on Mac How easy is it to setup directory sharing? Reading https://docs.getutm.app/guest-support/sharing/directory https://docs.getutm.app/guest-support/sharing/directory... seems a bit more difficult than VirtualBox My use case is relatively simple: build some tiny OSes (into ISO image) on Linux VM, then run the ISO on macOS's qemu

palinkapika 3y ago
UTM uses VirtioFS with Apple's virtualisation backend. Works out of the box with my Ubuntu server guests. You still need to mount the share as described here, but that's it: https://docs.getutm.app/guest-support/linux/#macos-virtiofs https://docs.getutm.app/guest-support/linux/#macos-virtiofs What took me a bit to figure out is that this does not mount a single folder, but a virtual parent folder to which you can add and remove directories without changing the mount. This even works while the VM is running. For example, mounting share /mnt/host virtiofs rw,nofail 0 0 in the guest and then sharing ~/Downloads in UTM will share the Downloads folder as /mnt/host/Downloads When using the QEMU backend, VirtFS is used instead, which does not use such a parent folder and requires restarting the VM to change shares iirc.

pt_PT_guy 3y ago

license issues apart, virtualbox guest tools for windows are awesome: clipboard sharing, drag and dropping files, network shares, auto window resize, etc just work out of the box. With KVM/splicetools it is always a pain to setup that.

mkl 3y ago

> Virtual Machine Manager Do you mean Red Hat's Virtual Machine Manager, AKA virt-manager (https://en.wikipedia.org/wiki/Virt-manager https://en.wikipedia.org/wiki/Virt-manager), or Microsoft's Virtual Machine Manager (https://learn.microsoft.com/en-us/system-center/vmm/?view=sc-vmm-2022 https://learn.microsoft.com/en-us/system-center/vmm/?view=sc...), or Synology's Virtual Machine Manager (https://www.synology.com/en-global/dsm/feature/virtual_machine_manager https://www.synology.com/en-global/dsm/feature/virtual_machi...)? I'm guessing the first one? I use VirtualBox for trying things out or sandboxing, mainly because of the friendly GUI, but wouldn't mind switching to something as friendly that's not Oracle's.

maxlin 3y ago

From oracle, I only use an older version of Virtualbox and in cloud I only use their free VM tier (4 ARM cores & 12GB RAM) because it's the best current "permanent" offer out there. That said, I take care to not invest in to any of their specific cloud guff and just run my own or generally available software & OS on Linux VM's there, which is not too much work to migrate anywhere. I've seen enough in the past to have zero trust in the company to not start doing more anti-dev stuff.