4 ms·

Oracle Java license teams set to begin targeting unknowing Oracle users

55 points by cempaka 2y ago

bradley13 2y ago
Use any of the free versions. There is no reason to download Java from Oracle.
- repelsteeltje 2y ago
  Maybe Oracle downloads ought to be blocklisted the same way known malware is. (Speaking as an ex-Oracle employee) There is no good reason to ever consider buying into Oracle, except when you're already their customer; in which case... Good luck.
  - Someone1234 2y ago
    If I was a CTO at a mid to large company, that has no business relationship to Oracle, I'd absolutely order the Oracle domains to be blackholed. The liability is simply too high. One employee downloads something and suddenly you need to license every seat in the Org. That's a crazy risk to take.
- hocuspocus 2y ago
  I agree there's usually no reason not to download a 3rd party OpenJDK distribution, as it's often easier. But there are plenty of valid use cases for Oracle GraalVM, and I haven't diff'ed the GFTC and NFTC licenses, but I believe their terms are essentially similar.
  - onli 2y ago
    Oracle trumps use cases. That is why GraalVM never was a valid option.
  - cess11 2y ago
    If you want to sell the output from Graal you must get a payed license. Kotlin/Native might be an alternative if that doesn't fit your needs.
    - hocuspocus 2y ago
      I don't think that's a concern for the vast majority of people using Java on the backend.
    - kaba0 2y ago
      That’s not true.
- cageface 2y ago
  Or better still just dump the whole ecosystem altogether. There are good alternatives.
  - cess11 2y ago
    The only thing that comes close is .NET, and that's MICROS~1. On the timescales in my business that's not an option, they can't be trusted to not act like Oracle does and they are deeply ingrained into important libraries in that "ecosystem". Rumour has it that there is some PDF/A capable library for .NET, but I would have to put in quite some time to figure out if it is low level enough for the control I need and whether there are additional libraries suited for layout and typography. Since I might have to ditch it within five years, that's not an option. Some people claim .NET developer ergonomics on Linux are fine now, but those I know personally that tells me this are using VSCode, which I consider a rather shoddy piece of software. Am I going to take the time and see if it's the case? Fiddle around with IntelliJ plugins and try to setup a LSP for vim and whatnot? Nope, I won't, because there is no revenue in that, and I might suddenly have to do the great rewrite several times at once further down the line. Maven is a turd, but a very solid one when you've figured out the XML incantation you need. I'm not sure what the alternatives are in .NET-land, or whether I can feel that I trust that they will work fine in ten years, like fifteen year old Maven projects tend to do. GraalVM allows me to output neat executables too. Java has Wildfly. What's the equivalent in .NET? Running a MICROS~1 Windows Server with IIS? That's not an option. And so on and so on.
    - stackskipton 2y ago
      For developing .Net (Core) on Linux? Rider is your best option from JetBrains. Most development still happens on Windows though because Visual Studio is best option if running Linux Desktop is most important thing for you. However running it? .Net runs on both Windows and Linux with performance generally being much better on Linux. .Net Team IME also recommends Linux as well unless you are doing some Windows only things. Web Server? .Net comes with built in cross platform Web Server called Kestrel which is pretty darn performant so most people just run Kestrel and proxy it with something like Nginx/Caddy though it's not required. After dealing with both companies, if you put a gun to my head and said "Oracle or Microsoft?" Microsoft hands down. Both are licensing nightmares but Microsoft has never come close to hostage taking behavior that Oracle has. Don't even get me started on Oracle Database Core license requirements in virtual environments. MSSQL never went that bad.
sebazzz 2y ago
This can’t be a sustainable business model - can it? I work at a very large company and all computers are regularly scanned for Oracle components and those are cleared/flagged.
- Rucadi 2y ago
  at this point Oracle is no different than ransomware
  - repelsteeltje 2y ago
    I suppose the unique thing is that with Oracle it's always a long con. Maybe call Oracle's type of malware a judicial APT?
- kotaKat 2y ago
  They've done it before with VirtualBox. If you grab the Vbox Addons pack from a corpo IP, Oracle will come swinging at you. https://old.reddit.com/r/sysadmin/comments/d1ttzp/oracle_is_going_after_companies_using_virtualbox/ https://old.reddit.com/r/sysadmin/comments/d1ttzp/oracle_is_...
- stackskipton 2y ago
  At last two companies, both had this Java Third Party Application that was pretty mission critical. Both of those companies put out support statements that they would only support Oracle JRE and no, they wouldn't be paying for licensing. So my companies ended up shelling out for JRE costs. One of third party later changed their mind and said they would support Adoptium JRE but you had to be on latest version of software. Generally, upgrades required their consulting people to come in so cha-ching. Last I heard, we were on their calendar to come do the upgrade since upgrade cost was about a year of Oracle licensing fees.
  - sorokod 2y ago
    I know what you mean when you say Adoptium but the java build is called Temurin https://adoptium.net/en-GB/temurin/releases/ https://adoptium.net/en-GB/temurin/releases/
jostmey 2y ago
Let me get this straight: 1) Oracle allowed anyone to download Java, seemingly for free 2) Somewhere in the fine print it said you might have to pay Oracle for using Java, but this was not transparent when you visit the download page. 3) Oracle is hunting down everyone who downloaded Oracle. Is this right?
- Vegenoid 2y ago
  Yes, this is exactly correct. I was very surprised when I learned that this was possible and legal. It happened to a company I worked for, and cost the company quite a bit of money. Since then I have learned much about how unintuitive and convoluted software licensing can be.
  - doubled112 2y ago
    This is free except those times it is not. Download now!
  - maximinus_thrax 2y ago
    It is correct and I used to work for a company where we moved everything to OpenJDK because of this. Legal was involved.
  - gary_0 2y ago
    Licensing BS is why Open Source really became a thing, starting back in the bad old 90's when Steve Ballmer could kill with a stare. "Surprise! We're going to start billing you based on how many keyboard keys your business uses." The mortal terror that someone upstream of your business might Alter The Deal (Pray We Don't Alter It Further) is why a lot of people are totally uninterested in any software that isn't MIT/BSD/Apache. And that's also why if something that was MIT/BSD/Apache changes licenses, some developers will start gnawing off their leg before the trap even springs shut.
    - neonsunset 2y ago
      I wonder if this is enough to make the larger dev community to finally realize that .NET is more open-source than Java ecosystem?
nicholasjarnold 2y ago
If this might apply to you/your company and you don't have a lot of time to get into deep research on the topic just go see the Eclipse Temurin[0] project and grab a build or image from them. [0] https://adoptium.net/temurin/releases/ https://adoptium.net/temurin/releases/
- hocuspocus 2y ago
  If you depend on Java, I'd recommend to spend some time and look into the best distribution for your needs. There's no need to go into deep research, but take maybe 5 minutes to understand the landscape of OpenJDK distributions. For instance if you run RedHat based linux like many companies, Adoptium brings nothing, there's no reason not to use RedHat's OpenJDK packages.
  - nicholasjarnold 2y ago
    Fair. My comment was more in the direction of saving others time, as I've personally looked into this previously (granted, some years ago) and found the Temurin packages to be of very high quality while avoiding the legal risk with the Oracle packages. Perhaps this is also helpful for others - https://whichjdk.com/ https://whichjdk.com/
kaba0 2y ago
Next news: you have to pay adobe for photoshop. Just the usual info, because there are so many disinfo spread: Java’s reference implementation is OpenJDK, developed 95% by Oracle. This has the same license as the linux kernel, it’s completely open-source. Similarly to how different distros pre-build the kernel for you, there are OpenJDK “distros”, like OracleJDK, Adoptium, etc. These are, for all practical purposes equivalent code-wise with the upstream project, Oracle has open-sourced almost every enterprise-only feature from the Sun times. So java is and will always be completely free. There is another dimension: support. Just as Red Hat sells support services to their linux distro, Oracle and other companies also offer such (which certain government companies might legally require, but otherwise you most likely know about it if you need it). The question of LTS: just as most open-source projects, development happens at master, backporting work to older versions is a significant undertaking. So your best bet at all times is to use the latest version, released every 6 months. Companies having their own builds define LTSs themselves.
- Nullabillity 2y ago
  Adobe doesn't pretend that Photoshop is free.
- AlotOfReading 2y ago
  If I go to openjdk.org today, the only links I see to download a JDK point to the Oracle site, jdk.java.net. Is that the reference openjdk or the dangerous Oracle version? It's entirely unclear at first glance. Honestly, why should I as an end user spend the time and effort to figure this out and update every few months to begin with? Why is it not as simple and convenient as the CLR is, with standard major releases annually, minor releases quarterly, and LTS versions every 3 years.
  - vips7L 2y ago
    Is it really not that clear? > Download and install the latest open-source JDK. Oracle’s free, GPL-licensed, production-ready OpenJDK JDK 22 binaries for Linux, macOS, and Windows are available at jdk.java.net/22; Oracle’s commercially-licensed JDK 22 binaries, based on the same code, are here. It's right on the landing page.
bubbleRefuge 2y ago
Wonder if you install the oracle jre via sdkman if you are tracked?
dorothybraith 2y ago
[dead]
acdha 2y ago
I pivoted things over to AWS Corretto after they tried something similar a few years ago on the theory that if anything came of it, you can let two 800lbs gorillas fight while you stay out of it. https://aws.amazon.com/corretto/ https://aws.amazon.com/corretto/ It was extremely painless (literally xargs to run sed + git commit + git push), has great ARM support, and if you are an AWS customer you can use your existing support contract should the need arise.
deleted 2y ago
[deleted]
captn3m0 2y ago
https://whichjdk.com/ https://whichjdk.com/ is an excellent resource that guides users to the various JDK builds from different parties, and which one to pick. Specifically, their recommendations for various Oracle builds are to stay away.
- office_drone 2y ago
  That's crazy. I'm tempted to register whichCLR.com which will contain a single link to download the latest .NET runtime.
- cess11 2y ago
  That's pretty neat. I've used SDKMan's list for this purpose, https://sdkman.io/jdks https://sdkman.io/jdks .
cageface 2y ago
I have to wonder if one of the reasons Google is keeping Dart alive is as a possible last resort if they have to abandon Java completely at some point due to Oracle's aggressive license enforcement.

55 points by cempaka 2y ago

bradley13 2y ago

Use any of the free versions. There is no reason to download Java from Oracle.

repelsteeltje 2y ago
Maybe Oracle downloads ought to be blocklisted the same way known malware is. (Speaking as an ex-Oracle employee) There is no good reason to ever consider buying into Oracle, except when you're already their customer; in which case... Good luck.
- Someone1234 2y ago
  If I was a CTO at a mid to large company, that has no business relationship to Oracle, I'd absolutely order the Oracle domains to be blackholed. The liability is simply too high. One employee downloads something and suddenly you need to license every seat in the Org. That's a crazy risk to take.
hocuspocus 2y ago
I agree there's usually no reason not to download a 3rd party OpenJDK distribution, as it's often easier. But there are plenty of valid use cases for Oracle GraalVM, and I haven't diff'ed the GFTC and NFTC licenses, but I believe their terms are essentially similar.
- onli 2y ago
  Oracle trumps use cases. That is why GraalVM never was a valid option.
- cess11 2y ago
  If you want to sell the output from Graal you must get a payed license. Kotlin/Native might be an alternative if that doesn't fit your needs.
  - hocuspocus 2y ago
    I don't think that's a concern for the vast majority of people using Java on the backend.
  - kaba0 2y ago
    That’s not true.
cageface 2y ago
Or better still just dump the whole ecosystem altogether. There are good alternatives.
- cess11 2y ago
  The only thing that comes close is .NET, and that's MICROS~1. On the timescales in my business that's not an option, they can't be trusted to not act like Oracle does and they are deeply ingrained into important libraries in that "ecosystem". Rumour has it that there is some PDF/A capable library for .NET, but I would have to put in quite some time to figure out if it is low level enough for the control I need and whether there are additional libraries suited for layout and typography. Since I might have to ditch it within five years, that's not an option. Some people claim .NET developer ergonomics on Linux are fine now, but those I know personally that tells me this are using VSCode, which I consider a rather shoddy piece of software. Am I going to take the time and see if it's the case? Fiddle around with IntelliJ plugins and try to setup a LSP for vim and whatnot? Nope, I won't, because there is no revenue in that, and I might suddenly have to do the great rewrite several times at once further down the line. Maven is a turd, but a very solid one when you've figured out the XML incantation you need. I'm not sure what the alternatives are in .NET-land, or whether I can feel that I trust that they will work fine in ten years, like fifteen year old Maven projects tend to do. GraalVM allows me to output neat executables too. Java has Wildfly. What's the equivalent in .NET? Running a MICROS~1 Windows Server with IIS? That's not an option. And so on and so on.
  - stackskipton 2y ago
    For developing .Net (Core) on Linux? Rider is your best option from JetBrains. Most development still happens on Windows though because Visual Studio is best option if running Linux Desktop is most important thing for you. However running it? .Net runs on both Windows and Linux with performance generally being much better on Linux. .Net Team IME also recommends Linux as well unless you are doing some Windows only things. Web Server? .Net comes with built in cross platform Web Server called Kestrel which is pretty darn performant so most people just run Kestrel and proxy it with something like Nginx/Caddy though it's not required. After dealing with both companies, if you put a gun to my head and said "Oracle or Microsoft?" Microsoft hands down. Both are licensing nightmares but Microsoft has never come close to hostage taking behavior that Oracle has. Don't even get me started on Oracle Database Core license requirements in virtual environments. MSSQL never went that bad.

sebazzz 2y ago

This can’t be a sustainable business model - can it? I work at a very large company and all computers are regularly scanned for Oracle components and those are cleared/flagged.

Rucadi 2y ago
at this point Oracle is no different than ransomware
- repelsteeltje 2y ago
  I suppose the unique thing is that with Oracle it's always a long con. Maybe call Oracle's type of malware a judicial APT?
kotaKat 2y ago
They've done it before with VirtualBox. If you grab the Vbox Addons pack from a corpo IP, Oracle will come swinging at you. https://old.reddit.com/r/sysadmin/comments/d1ttzp/oracle_is_going_after_companies_using_virtualbox/ https://old.reddit.com/r/sysadmin/comments/d1ttzp/oracle_is_...
stackskipton 2y ago
At last two companies, both had this Java Third Party Application that was pretty mission critical. Both of those companies put out support statements that they would only support Oracle JRE and no, they wouldn't be paying for licensing. So my companies ended up shelling out for JRE costs. One of third party later changed their mind and said they would support Adoptium JRE but you had to be on latest version of software. Generally, upgrades required their consulting people to come in so cha-ching. Last I heard, we were on their calendar to come do the upgrade since upgrade cost was about a year of Oracle licensing fees.
- sorokod 2y ago
  I know what you mean when you say Adoptium but the java build is called Temurin https://adoptium.net/en-GB/temurin/releases/ https://adoptium.net/en-GB/temurin/releases/

jostmey 2y ago

Let me get this straight: 1) Oracle allowed anyone to download Java, seemingly for free 2) Somewhere in the fine print it said you might have to pay Oracle for using Java, but this was not transparent when you visit the download page. 3) Oracle is hunting down everyone who downloaded Oracle. Is this right?

Vegenoid 2y ago
Yes, this is exactly correct. I was very surprised when I learned that this was possible and legal. It happened to a company I worked for, and cost the company quite a bit of money. Since then I have learned much about how unintuitive and convoluted software licensing can be.
- doubled112 2y ago
  This is free except those times it is not. Download now!
- maximinus_thrax 2y ago
  It is correct and I used to work for a company where we moved everything to OpenJDK because of this. Legal was involved.
- gary_0 2y ago
  Licensing BS is why Open Source really became a thing, starting back in the bad old 90's when Steve Ballmer could kill with a stare. "Surprise! We're going to start billing you based on how many keyboard keys your business uses." The mortal terror that someone upstream of your business might Alter The Deal (Pray We Don't Alter It Further) is why a lot of people are totally uninterested in any software that isn't MIT/BSD/Apache. And that's also why if something that was MIT/BSD/Apache changes licenses, some developers will start gnawing off their leg before the trap even springs shut.
  - neonsunset 2y ago
    I wonder if this is enough to make the larger dev community to finally realize that .NET is more open-source than Java ecosystem?

nicholasjarnold 2y ago

If this might apply to you/your company and you don't have a lot of time to get into deep research on the topic just go see the Eclipse Temurin[0] project and grab a build or image from them. [0] https://adoptium.net/temurin/releases/ https://adoptium.net/temurin/releases/

hocuspocus 2y ago
If you depend on Java, I'd recommend to spend some time and look into the best distribution for your needs. There's no need to go into deep research, but take maybe 5 minutes to understand the landscape of OpenJDK distributions. For instance if you run RedHat based linux like many companies, Adoptium brings nothing, there's no reason not to use RedHat's OpenJDK packages.
- nicholasjarnold 2y ago
  Fair. My comment was more in the direction of saving others time, as I've personally looked into this previously (granted, some years ago) and found the Temurin packages to be of very high quality while avoiding the legal risk with the Oracle packages. Perhaps this is also helpful for others - https://whichjdk.com/ https://whichjdk.com/

kaba0 2y ago

Next news: you have to pay adobe for photoshop. Just the usual info, because there are so many disinfo spread: Java’s reference implementation is OpenJDK, developed 95% by Oracle. This has the same license as the linux kernel, it’s completely open-source. Similarly to how different distros pre-build the kernel for you, there are OpenJDK “distros”, like OracleJDK, Adoptium, etc. These are, for all practical purposes equivalent code-wise with the upstream project, Oracle has open-sourced almost every enterprise-only feature from the Sun times. So java is and will always be completely free. There is another dimension: support. Just as Red Hat sells support services to their linux distro, Oracle and other companies also offer such (which certain government companies might legally require, but otherwise you most likely know about it if you need it). The question of LTS: just as most open-source projects, development happens at master, backporting work to older versions is a significant undertaking. So your best bet at all times is to use the latest version, released every 6 months. Companies having their own builds define LTSs themselves.

Nullabillity 2y ago
Adobe doesn't pretend that Photoshop is free.
AlotOfReading 2y ago
If I go to openjdk.org today, the only links I see to download a JDK point to the Oracle site, jdk.java.net. Is that the reference openjdk or the dangerous Oracle version? It's entirely unclear at first glance. Honestly, why should I as an end user spend the time and effort to figure this out and update every few months to begin with? Why is it not as simple and convenient as the CLR is, with standard major releases annually, minor releases quarterly, and LTS versions every 3 years.
- vips7L 2y ago
  Is it really not that clear? > Download and install the latest open-source JDK. Oracle’s free, GPL-licensed, production-ready OpenJDK JDK 22 binaries for Linux, macOS, and Windows are available at jdk.java.net/22; Oracle’s commercially-licensed JDK 22 binaries, based on the same code, are here. It's right on the landing page.

bubbleRefuge 2y ago

Wonder if you install the oracle jre via sdkman if you are tracked?

dorothybraith 2y ago

[dead]

acdha 2y ago

I pivoted things over to AWS Corretto after they tried something similar a few years ago on the theory that if anything came of it, you can let two 800lbs gorillas fight while you stay out of it. https://aws.amazon.com/corretto/ https://aws.amazon.com/corretto/ It was extremely painless (literally xargs to run sed + git commit + git push), has great ARM support, and if you are an AWS customer you can use your existing support contract should the need arise.

deleted 2y ago

[deleted]

captn3m0 2y ago

https://whichjdk.com/ https://whichjdk.com/ is an excellent resource that guides users to the various JDK builds from different parties, and which one to pick. Specifically, their recommendations for various Oracle builds are to stay away.

office_drone 2y ago
That's crazy. I'm tempted to register whichCLR.com which will contain a single link to download the latest .NET runtime.
cess11 2y ago
That's pretty neat. I've used SDKMan's list for this purpose, https://sdkman.io/jdks https://sdkman.io/jdks .

cageface 2y ago

I have to wonder if one of the reasons Google is keeping Dart alive is as a possible last resort if they have to abandon Java completely at some point due to Oracle's aggressive license enforcement.