5 ms·

Nearly 3 out of 4 Oracle Java users say they've been audited in the past 3 years

96 points by rntn 1y ago

msie 1y ago
Gotta keep Larry Ellison rich!
lijok 1y ago
What's the advantage of using Oracle's Java instead of the OSS version?
- t0mas88 1y ago
  A support contract from Oracle to help you if things go wrong. Probably not worth it for the vast majority of users, but a small group is paying Oracle for this.
- mcosta 1y ago
  Some java 8 applications are on life support with 0 developer time. But must be patched against CVEs because compliance.
jsiepkes 1y ago
Who are these people who use the commercial Oracle Java version and why do they need it? When running on AWS you are probably better off running Amazon's Java, on Azure you are probably better off running Microsoft's Java, on RedHat you probably run Redhats Java, etc.
- Alupis 1y ago
  It should never matter, unless you have something specific you need from one of the various proprietary JVM's. The free JVM's are usually vanilla pre-compiled OpenJDK. Frankly, imho, you should be deploying within a container even for simple/basic apps these days - so you bring your own JVM and environment rather than use something the platform provides. The folks paying for Oracle JDK are likely big corps that want to pass the support-buck when it's 3am and something went down...
- rf15 1y ago
  I'm working for a european org that is close to government and has been granted immortality by law, so market forces only apply in a very dampened capacity. They pay a premium for Commercial Java to be able to ask for certain features or support. ...Oracle always declines them with a variety of excuses, so there's no upside. Their older developers say they use features specific to the Oracle version, but I've never seen that, it works fine with OpenJDK, Jetbrain's, Amazon's or Microsoft's JDK
  - shagmin 1y ago
    Sounds like the older developers have some form of Stockholm Syndrome.
    - thmsths 1y ago
      The older devs have zero upsides if they use a different JDK, but plenty of downsides if it introduces any issues. Is it really surprising then that they want to maintain the status quo?
    - OldfieldFund 1y ago
      Stockholm Syndrome is not a scientifically sound thing
      - npteljes 1y ago
        While a fun fact, it's not referenced here as a scientific thing, just to point out that the engineers' attachment to Oracle Java is not rational.
        OldfieldFund 1y ago
        I understand. I'm just saying that Stockholm Syndrome is very likely not a real thing: https://en.wikipedia.org/wiki/Stockholm_syndrome https://en.wikipedia.org/wiki/Stockholm_syndrome
        1y ago
- stackskipton 1y ago
  I used to work for Enterprise running Java 3rd party applications. Some of them had a requirement that we would only use Oracle Java if we wanted support. Companies were starting to pick up on the fact that people were getting pretty angry with that arrangement and were offering to support OpenJDK or other Java, if we would upgrade to latest and greatest.
ano-ther 1y ago
Seems quite onerous. There is even a market for advisors specialized in serving "companies and governments looking for help with Oracle". https://palisadecompliance.com/about/ https://palisadecompliance.com/about/
hangonhn 1y ago
We switched completely to AWS Corretto and told our IT department to remove all Oracle/Sun Java and ban the downloads. Then promptly ignored the Oracle emails. Haven't heard from them since.
- wnissen 1y ago
  It was the same thing for us with Qt Commercial licensing. We use only the LGPL version, dynamically link, don't modify the source, and give credit, so we're fully in compliance. To get support we chose to purchase commercial licenses for our small team of developers. Cue a regular series of calls about whether we were sure we were in compliance, etc. To add insult to injury they couldn't even navigate our purchasing process so it was a pain to pay them. I'll take my chances in the open source world. It's a shame that the companies that created the software aren't getting paid, truly. But don't make it so obnoxious to reward you.
- delfinom 1y ago
  The best thing a company can ever do is block downloads.oracle.com at the firewall.
robotnikman 1y ago
I'm reminded again of the meme of the Oracle org chart https://palisadecompliance.com//wp-content/uploads/2013/11/oracle-org-chart-300x195.png https://palisadecompliance.com//wp-content/uploads/2013/11/o...
- hbrav 1y ago
  Mighty bold of them to assume that most of engineering would be above most of legal.
marshray 1y ago
It's always disappointing to me to come across some really interesting innovative new tool, like a programming language, and then find it was built on JVM. I get it. It's all about the size of the ecosystem and the garbage collector. Yes, there are great open source implementations. But not even Google could pull off a clean-room reimplementation without encountering unthinkable legal expense.
pvtmert 1y ago
Call this unpopular opinion (probably gonna get downvoted anyway), but the amount Oracle gets paid because lazy-devs are well, too lazy to read which JVM arguments should they put to their deployment, requiring hand-holding by the Oracle-support team. I understand in the olden times there were javax.* and JavaEE, but nowadays, especially in the newer JDKs, these are completely gone. Whoever maintains Java 1.6 in their core infrastructure already doomed, regardless of Oracle asking them $$$ or not. edit: I know various Java-devs which are "runs on my machine" mindset. As a DevOps engineer, most of the production outages I took care of were avoidable by removing this mindset and actually testing the code in a sandbox environment...
- JohnMakin 1y ago
  I've had an ongoing debate with a guy who is supposedly senior java dev of 20+ years that doesn't understand the most basic aspects of concurrency, and codes "worked on my local" style and engages in obnoxious blame games with DevOps and infra teams about how his application works totally fine spinning up 10,000 threads on his 16 core macbook, but for "some reason" craps out in production running on a 1 vcpu allocated container. At least a year of back and forth on this and he doesn't understand why. Wish I was making it up.
DonHopkins 1y ago
Oracle spoiled the sport of arguing about Java -vs- other programming languages. Now all you have to say to win that argument is "lawnmower".
- deleted 1y ago
  [deleted]
khana 1y ago
[dead]
eadmund 1y ago
It goes without saying that this is annoying and expensive (over $100,000 for over half the respondents and over $500,000/year for over a quarter!) for those who have been audited, even if they have done nothing wrong. I am curious what fraction of auditees did do something wrong. At that sort of expense, it seems like many companies could probably do better to hire a single engineer to contribute to open-source Java and prioritise their needs. Of course, the ever-present temptation would be to lay him off and freeload.

96 points by rntn 1y ago

msie 1y ago

Gotta keep Larry Ellison rich!

lijok 1y ago

What's the advantage of using Oracle's Java instead of the OSS version?

t0mas88 1y ago
A support contract from Oracle to help you if things go wrong. Probably not worth it for the vast majority of users, but a small group is paying Oracle for this.
mcosta 1y ago
Some java 8 applications are on life support with 0 developer time. But must be patched against CVEs because compliance.

jsiepkes 1y ago

Who are these people who use the commercial Oracle Java version and why do they need it? When running on AWS you are probably better off running Amazon's Java, on Azure you are probably better off running Microsoft's Java, on RedHat you probably run Redhats Java, etc.

Alupis 1y ago
It should never matter, unless you have something specific you need from one of the various proprietary JVM's. The free JVM's are usually vanilla pre-compiled OpenJDK. Frankly, imho, you should be deploying within a container even for simple/basic apps these days - so you bring your own JVM and environment rather than use something the platform provides. The folks paying for Oracle JDK are likely big corps that want to pass the support-buck when it's 3am and something went down...
rf15 1y ago
I'm working for a european org that is close to government and has been granted immortality by law, so market forces only apply in a very dampened capacity. They pay a premium for Commercial Java to be able to ask for certain features or support. ...Oracle always declines them with a variety of excuses, so there's no upside. Their older developers say they use features specific to the Oracle version, but I've never seen that, it works fine with OpenJDK, Jetbrain's, Amazon's or Microsoft's JDK
- shagmin 1y ago
  Sounds like the older developers have some form of Stockholm Syndrome.
  - thmsths 1y ago
    The older devs have zero upsides if they use a different JDK, but plenty of downsides if it introduces any issues. Is it really surprising then that they want to maintain the status quo?
  - OldfieldFund 1y ago
    Stockholm Syndrome is not a scientifically sound thing
    - npteljes 1y ago
      While a fun fact, it's not referenced here as a scientific thing, just to point out that the engineers' attachment to Oracle Java is not rational.
      - OldfieldFund 1y ago
        I understand. I'm just saying that Stockholm Syndrome is very likely not a real thing: https://en.wikipedia.org/wiki/Stockholm_syndrome https://en.wikipedia.org/wiki/Stockholm_syndrome
        1y ago
stackskipton 1y ago
I used to work for Enterprise running Java 3rd party applications. Some of them had a requirement that we would only use Oracle Java if we wanted support. Companies were starting to pick up on the fact that people were getting pretty angry with that arrangement and were offering to support OpenJDK or other Java, if we would upgrade to latest and greatest.

ano-ther 1y ago

Seems quite onerous. There is even a market for advisors specialized in serving "companies and governments looking for help with Oracle". https://palisadecompliance.com/about/ https://palisadecompliance.com/about/

hangonhn 1y ago

We switched completely to AWS Corretto and told our IT department to remove all Oracle/Sun Java and ban the downloads. Then promptly ignored the Oracle emails. Haven't heard from them since.

wnissen 1y ago
It was the same thing for us with Qt Commercial licensing. We use only the LGPL version, dynamically link, don't modify the source, and give credit, so we're fully in compliance. To get support we chose to purchase commercial licenses for our small team of developers. Cue a regular series of calls about whether we were sure we were in compliance, etc. To add insult to injury they couldn't even navigate our purchasing process so it was a pain to pay them. I'll take my chances in the open source world. It's a shame that the companies that created the software aren't getting paid, truly. But don't make it so obnoxious to reward you.
delfinom 1y ago
The best thing a company can ever do is block downloads.oracle.com at the firewall.

robotnikman 1y ago

I'm reminded again of the meme of the Oracle org chart https://palisadecompliance.com//wp-content/uploads/2013/11/oracle-org-chart-300x195.png https://palisadecompliance.com//wp-content/uploads/2013/11/o...

hbrav 1y ago
Mighty bold of them to assume that most of engineering would be above most of legal.

marshray 1y ago

It's always disappointing to me to come across some really interesting innovative new tool, like a programming language, and then find it was built on JVM. I get it. It's all about the size of the ecosystem and the garbage collector. Yes, there are great open source implementations. But not even Google could pull off a clean-room reimplementation without encountering unthinkable legal expense.

pvtmert 1y ago

Call this unpopular opinion (probably gonna get downvoted anyway), but the amount Oracle gets paid because lazy-devs are well, too lazy to read which JVM arguments should they put to their deployment, requiring hand-holding by the Oracle-support team. I understand in the olden times there were javax.* and JavaEE, but nowadays, especially in the newer JDKs, these are completely gone. Whoever maintains Java 1.6 in their core infrastructure already doomed, regardless of Oracle asking them $$$ or not. edit: I know various Java-devs which are "runs on my machine" mindset. As a DevOps engineer, most of the production outages I took care of were avoidable by removing this mindset and actually testing the code in a sandbox environment...

JohnMakin 1y ago
I've had an ongoing debate with a guy who is supposedly senior java dev of 20+ years that doesn't understand the most basic aspects of concurrency, and codes "worked on my local" style and engages in obnoxious blame games with DevOps and infra teams about how his application works totally fine spinning up 10,000 threads on his 16 core macbook, but for "some reason" craps out in production running on a 1 vcpu allocated container. At least a year of back and forth on this and he doesn't understand why. Wish I was making it up.

DonHopkins 1y ago

Oracle spoiled the sport of arguing about Java -vs- other programming languages. Now all you have to say to win that argument is "lawnmower".

deleted 1y ago
[deleted]

khana 1y ago

[dead]

eadmund 1y ago

It goes without saying that this is annoying and expensive (over $100,000 for over half the respondents and over $500,000/year for over a quarter!) for those who have been audited, even if they have done nothing wrong. I am curious what fraction of auditees did do something wrong. At that sort of expense, it seems like many companies could probably do better to hire a single engineer to contribute to open-source Java and prioritise their needs. Of course, the ever-present temptation would be to lay him off and freeload.