Hacker News new | past | comments | ask | show | jobs | submit login
Oracle's Newest Audit Tactic: Focusing on Java (forbes.com/sites/danwoods)
131 points by Garbage on Feb 3, 2019 | hide | past | favorite | 163 comments



Intel's newest audit tactic, focusing on illegal installations from VTune, Intel C++, Intel Fortran, ....

Want to use commercial software? Pay accordingly.

Not wanting to pay for it? Plenty of options available.

https://adoptopenjdk.net/

https://aws.amazon.com/corretto/

https://www.azul.com/downloads/zulu/

https://www.eclipse.org/openj9/

https://developers.redhat.com/products/openjdk/download/


That's not exactly the same. Oracle is infamous for bait and switch, where it's free at first. With Java, they first snuck in some extra components that triggered license requirements, then later, just changed the whole jdk license.

They are very aware that big companies wouldn't be nimble enough to switch to openjdk in time to avoid the license fees.

Additionally, they know that companies have 3rd party software that bundles what was once "free" oracle jdk. The end user gets to foot the bill for that rather than the 3rd party.


Old JDKs, bundled or not, require an explicit flag (`-XX:+UnlockCommercialFeatures`) to enable commercial features.

As to new JDKs, Oracle has open sourced (or discontinued) all previously commercial features so that now OpenJDK and Oracle JDK are the same software: https://blogs.oracle.com/java-platform-group/oracle-jdk-rele...

Infamous or not, the licensing situation is now clearer and better than ever before: Oracle offers the same software under a commercial license for those who wish to buy support, or under a free license to those who don't. The download pages for either option clearly identify the license, and point the user to the other option, if that's what they want:

* https://www.oracle.com/technetwork/java/javase/downloads/ind...

* https://www.oracle.com/technetwork/java/javase/downloads/jdk...

* https://openjdk.java.net/projects/jdk/11/


The companies that were caught up in this are, for the most part, the ones on Oracle JDK 8, which is substantially different than OpenJDK.

The "UnlockCommercialFeatures" doesn't catch everything either. For example, Oracle once added a clause about "embedded devices" needing a commercial license. With a very broad definition of embedded.

This is pretty clearly a cash grab.

Also, If the bits are truly the same as of version 11... what's the point of making people download a duplicate codebase where the only difference is one text license file?


> For example, Oracle once added a clause about "embedded devices" needing a commercial license. With a very broad definition of embedded.

No, field-of-use restrictions had applied under Sun, too, as licensing Java to mobile/embedded devices was Java's income source. Later, various commercial features were also a source of income. Oracle has now completely opened the JDK (and there are no field-of-use restrictions for the free license), opened all commercial features, and has switched to a support model.

Like all companies providing open source runtimes/languages, Oracle, too, must fund Java somehow (as I explained in another comment https://news.ycombinator.com/item?id=19069655). You're free to think that the funding model now is less preferable to you personally than the previous ones, but I don't think anyone can claim it is any more of a "cash grab" than the previous monetization strategies.

I think that if anyone claims that recent changes to Java's licensing and release models are not for the better, then they are either misled or misleading.


Ahh, yes, you're right. The clause was there. But Sun, in practice, applied it to things that most people would call "embedded". Oracle used a broader definition that included PC hardware in many situations.

Not sure I understand the whole funding argument. Swift, golang, v8, typescript, etc, seem to be fine as open source.


Golang, V8 and TypeScript are tiny projects compared to OpenJDK. Oracle employs hundreds of full-time OpenJDK contributors. Swift is funded through iOS (just as .NET is funded through Windows and Android through, well, Android). I don't know if this is true anymore, but the number of people developing Golang at Google is (or used to be, last I heard) close to the number of people there modifying OpenJDK for their internal use. V8 is also funded through Chrome, BTW.


I'm mystified as to why Java is so much bigger than any pure open source language implementation.

In any case all this jockeying around with the license will certainly reduce the user base. From talking to my peers at other companies, we're all putting together our "get off of java" plans now.


Why? Because the requirements are so much more challenging. OpenJDK has several state-of-the-art GCs (e.g. for software that values throughput, software that values latency, and software that's in between), three state-of-the-art compilers (C1, C2 and Graal) plus the frontend compiler, javac, and an extensive standard library. People rely on Java for projects that are much more demanding than those using, say, Python, Go, Node.JS etc. .NET is of a similar size, because the demands are similarly high.

I can tell you that the amount of software switching from other platforms to Java is significantly higher than that switching away. Those switching away are those with lesser requirements (e.g. in terms of performance, data size, management and tooling), and those switching to Java do that because they want the scalability and tooling. The full open-sourcing of the JDK and the new release cadence are big improvements that make Java even more attractive to those that were on the fence before, and the pipeline of major OpenJDK projects (Valhalla, Amber, Panama, Loom, Metropolis) is deeper than ever in Java's history.


Most of the companies I work with are either Java or .NET shops, moving away from any of those platforms means rebuilding their business, for some of them, even the services that they sell, throw out worldwide trainings moving the whole company into a new stack.

A large majority of corporations aren't that allergic to software licenses, they have other issues on their top list.


It's not the license by itself. It's the relationship with that vendor.


On the enterprise space there are much worse vendors than Oracle, still everyone is buddy with everyone.


>I'm mystified as to why Java is so much bigger than any pure open source language implementation.

Because with Java someone actually pays for its development.


> Swift is funded through iOS

Swift is reasonably independent from Apple these days. It’s stable starting version 5 and most new features are geared towards other applications than Cocoa.


Swift is pretty useless outside Apple platforms.


They didn't change the license of old JDKs AFAIK (correct me if I'm wrong).

So, those big companies would first have to switch to an affected version of the JDK anyway, so they could as well switch to OpenJDK.


These are great options. If you don't want to pay up to Oracle. Just use one of the OpenJDK distributions. Java is still free and the JVM is still an amazing piece of tech.


Isn't it nicer to just... not use anything related to Oracle though? Oracle still holds a tremendous amount of power over OpenJDK, right?

Oracle has also demonstrated in court that the Java API is their intellectual property, and that they are willing to go after people for reimplementing them. OpenJDK might be blessed, but I'd still be afraid of having anything to do with their intellectual property. That's also one of the primary reasons I'm not very excited about ZFS.


> Oracle has also demonstrated in court that the Java API is their intellectual property, and that they are willing to go after people for reimplementing them. OpenJDK might be blessed, but I'd still be afraid of having anything to do with their intellectual property. That's also one of the primary reasons I'm not very excited about ZFS.

If you use OpenJDK you get an implicit patent grant to run OpenJDK (as it's licensed under the GPL).

If you use any other non-OpenJDK runtime you might still violate some of Oracle's patents, but you don't get any patent grant.

So if you're concerned about patents then using OpenJDK (instead of not using it) would actually be the safer way to go.


I think GP is pointing out that it would be far safer to not use Java in the first place. One day Oracle could decide to kill OpenJDK, and since they have a history of aggression towards non-Oracle distributions of Java you would be trapped if you depend on Java.


There are already lots of non-Oracle distributions of OpenJDK: Azul's Zulu, AdoptOpenJDK, Amazon's Corretto and I'm not aware of any aggression towards those projects. The lawsuit against Google targets an implementation that didn't derive from OpenJDK and is thus not covered by any of the patent grants.

Furthermore, OpenJDK is licensed under the GPL. Even if Oracle stopped contributing to OpenJDK the GPL license would ensure that OpenJDK and all derivative works can still be freely distributed and are still subject to Oracle's original implicit patent grant.


> There are already lots of non-Oracle distributions of OpenJDK: Azul's Zulu, AdoptOpenJDK, Amazon's Corretto and I'm not aware of any aggression towards those projects.

I don't see how that's relevant? I wasn't aware of any aggression towards Google, until Oracle suddenly decided to aggress. The fact that Oracle hasn't been aggressive towards non-Oracle OpenJDK distributions in the past doesn't mean they won't be aggressive in the future.


OpenJDK is licensed by Oracle under an open source license (and Google has made use of this license, and even internally forked OpenJDK, both during the trial and now). The court trial was over an unlicensed use of Java (Google claimed they didn't need a license because the APIs weren't Oracle's to license, but in any event, that lawsuit has absolutely nothing to do with OpenJDK).


Oh, that wasn't intended as an argument that OpenJDK is unsafe, I was just asking why it's relevant that Oracle hasn't shown aggression towards non-Oracle OpenJDK distributions yet, when nobody has brought up concerns about how Oracle already is aggressive towards OpenJDK distributions.

I can probably agree that Oracle is relatively unlikely to start coming after people for patent infringement related to using OpenJDK or forks thereof, when OpenJDK is licensed under a license with a patent grant. My biggest concern is just that Oracle seems like a thoroughly evil and unpredictable company, and I wouldn't like to use technology they own and which uses patents they own. I wouldn't have imagined that Oracle would ever come after people for re-implementing their API; I can't imagine what Oracle will do in the future, but I won't build a business or institution around the assumption that they will do nothing. It's not like there aren't a plethora of other solutions for anything developed by Oracle, most of which are better than Oracle's alternatives.


The copyright to non-Oracle OpenJDK distributions is still owned by Oracle, but Oracle licenses OpenJDK as free software (as in beer and in speech).

I think that even if it made sense to assign virtue judgments to corporations, it would be a huge stretch to claim that Oracle is any more evil than other companies of similar size, like Google, Facebook, Microsoft or Apple, but as I work for Oracle, I'm obviously biased.


> JVM is still an amazing piece of tech

It’s hard to say that when we’re still clamouring for generics without type-erasure. It’s been over 14 years since the CLR had it and it’s definitely holding back the Java ecosystem in my opinion.


Erased generics are awesome. Without erasure interop and code sharing among languages with different variance strategies is severely hampered. It's because Java erases generics (for subclassable reference types) that Java, Kotlin and Clojure can all share the same data structures without any runtime conversions.


I imagine it would help to keep binary size and compile times down too, though I don't know by how much.

I wonder if C++ compilers "collapse" things like `vector<Foo⋆>` and `vector<Bar⋆>` (or even `vector<size_t>`) if they can figure out that all of their respective methods end up generating the same machine code... Maybe not?

(Stars because I can't seem to escape asterisks properly...)


This is a fairly common optimization that is normally performed by the linker. [0] is a blog entry that describes Microsoft’s implementation of identical function merging.

[0] https://blogs.msdn.microsoft.com/oldnewthing/20050322-00/?p=...

Edited to add link.


Ooh, really cool. The comment about function-pointer comparisons was a pretty funny ramification I hadn't considered too. Real "wtf" debugging case I bet.

I wonder what the standard says about it, what the linker can/could typically prove is "safe", and what performance/size changes are seen in practice.


The paper Safe ICF in Gold[0] says that they get between 4 to 7% savings on code size. A safer version that omits functions that have their address taken was 97% as effective.

The talk Diet Templates[1] has some suggestions for how to reduce template bloat.

[0] https://ai.google/research/pubs/pub36912

[1] https://accu.org/content/conf2011/Jonathan-Wakely-diet-templ...

Edited to add the second paragraph.


You want to erase generics because you don't want to bake a specific variance model into your runtime. Erasing generics allows languages with different variance (e.g. Java, Kotlin and Clojure) to share code and data structures. This is not an issue for generics of non-subtypable types, which is why generics of the forthcoming value types will be specialized rather than erased.


Holding it back compared to what? I come from a CLR background and look enviously at the jvm ecosystem all the time. Haskell, BEAM, etc are almost all a step down from jvm once you factor in tooling.


I work with both, so I do agree with you with my C# hat on.

On the other hand with my Java hat on, I look enviously to proper unsigned types, value types, explicit SIMD, and the language support for low level coding optimizations.

Still looking forward for Valhalla and Panama to arrive.


Off the top of my head, Java’s Linq reimplementation (“Streams”) feels second-class because of the specialisation of value-types.


.NET dev here - especially now we have Core CLR, what do you envy about the JVM?


That's a Java thing, not a JVM thing. Try Kotlin for example.


That’s not true. Type erasure is certainly a part of the JVM. I’m not familiar with Kotlin but maybe it does automatic type tagging?

But in response to GP, type erasure sucks and makes a lot of things harder.


> Type erasure is certainly a part of the JVM

No, it is not. Most JVM languages (except Ceylon, I think) choose to erase generics, as that's the right thing to do if you want good polyglot interop.


No, I mean that the JVM itself doesn’t have opcodes for storing generics type info. Hence why it was done for backward compatability, they didn’t need to add or change instructions.


That's incorrect. You could specialize classes on the fly (and the opcodes for all reference types are the same, anyway). It's just that it's a bad idea to reify generics of reference (and so subtypable) types. You gain little and lose much.


Ok I looked it up. You’re right. Kudos


Anyone know the details of Amazon Coretto in this regard?


You left out Oracle's free option:

http://jdk.java.net/


I wouldn't trust that it doesn't have some onerous terms buried in the license.

Anything oracle is tainted. And that's putting it lightly.


I am all for being very cautious regarding Oracle, the license situation is fairly straight forward http://openjdk.java.net/legal/gplv2+ce.html


It still makes no difference. All vendors offering OpenJDK builds offer it under the same license, as the license is dictated by the open source OpenJDK, which is owned and run by Oracle, and developed mostly by Oracle. If you actually read the license for any OpenJDK distribution, you'll see that the copyright for the software is owned by Oracle. So all OpenJDK distributions are equally "tainted".


Good point.

If you're using Java now, its probably a good idea to start looking at migration to something not Java. And until the API lawsuit is resolved, even things like Kotlin are probably not safe.

And well, if you choose Java now, you're just a fool :/ It is a footgun and the trigger is controlled by a pack of lawyers at Oracle.


The API lawsuit has absolutely nothing to do with OpenJDK. OpenJDK is licensed to anyone under an open source license. The lawsuit relates to the use of code library APIs not in accordance with any license. Because the license is clear, whatever licensing situation you may have been afraid of before, things are strictly better now.

BTW, Google has used OpenJDK extensively even throughout the court case, and still does, and has even forked it internally.


> BTW, Google has used OpenJDK extensively even throughout the court case, and still does, and has even forked it internally.

But isn't that their problem? The Oracle claim is that APIs themselves are copyrighted , and need permission from Oracle to even use the APIs?

It wouldn't matter of the software package was licensed. If Oracle's argument is accepted, then even invoking the APIs need a separate license outside the permission to copy JDK.

I really hope the judge finds in favor of Google. APIs should absolutely not be copyrightable.. But that's the main issue. And I still stand by my assessment that Java-anything is harmful for your health. And if your company has $$$, using Java is attracting sharks.


Even if APIs are copyrighted, anything that's copyrighted can be licensed, and OpenJDK, which includes the Java APIs, is licensed under an open source license (which, BTW, Google did not use in Android until recently, but have used, and still do, for their use of OpenJDK).


Having worked there myself before and leaving in disgust this is definitely how it goes down.

Further, I always suspected some kind of dodgy dealing at some clients I’d visit since there’d be an army of their employees who’d be negative about Oracle but always a single big-wig that managed to be super passionate about Oracle.

Of course I never found evidence of anything dodgy - just a number of clients where this was a notable pattern.


I’ve worked at BigCorp(s) and seen similar things but from the other side. Most people absolutely hated oracle from the director who ran the teams to the admins and devs.

The only people who liked Oracle were VP and above. They were so short sighted they signed a deal with Oracle after they drastically cut support costs the first year. They were so shocked in year 2 when costs went north of 1 million. Making Oracle much much more expensive than the competitors who also bid. Everyone knew the competitors were less expensive in the long run and actually good products.

Not to mention the time they were audited and owed big time due to a webservice sending changes to our ERP system.


I'm sure some big companies like to make it easier on the higher-ups to accept their products (and the lower class be damned), because that would explain a lot of crap being sold by those "big companies"

It would be very interesting if some evidence came to light in an FCPA filing.


I've seen the same.

We were close to finalizing a sale for a huge company before some non-technical exec insisted on using Oracle for the backend. Then it became a huge sticking point. Our cto joked that he must be getting a kickback.


Once Oracle bought Sun Microsystems, i became dis-interested in Java all round. I would rather use a programming language not licensed by a huge corporation.

The reason they are a huge company is the way they are predatory towards their customers. Probably why sun didn't survive as well, its kind of sad that this is the way of the world.


Oracle has now fully open sourced the JDK[1] (more than Sun ever did), not to mention all the resources invested into Java now.

[1]: https://blogs.oracle.com/java-platform-group/oracle-jdk-rele...


GPLv2 have no explicit patent granting. If you remember Sun, you should knew the TCK license controversy.


The TCK is a different project licensed separately.

As to GPLv2 and patents, see http://en.swpat.org/wiki/GPLv2_and_patents

But note that patents are unrelated to copyright, and licesors may only grant their own patents. Third-party licenses always apply (e.g. see how Microsoft was able to extract billions from Android vendors through patents).


You should give C# a try. It's pretty open these days (bonus: it's a much nicer language than Java)


Or better use Go! It's 100% open/BSD license.


I do myself now use go, i've developed a scripting language on top of go which has all the great features of the go runtime but it is interpreted instead. It has a few hundred commands and will eventually have the ability to modify its own commands at runtime.

I started the same thing with C++ but found that i spent too long getting libraries to work with each other without clashing (especially on windows)

I've also found java to be a terrible memory hog and require significant tuning to run stable without having long periods of garbage collection and non-responsiveness, i've not had that problem with go out of the box.

Thats the one thing about go that is great, goroutines and the (much much better) garbage collection.

Yeah, i'm a bit of a go fanboy :)


You should not call yourself a fanboy for being practical!

Lately I am on the hunt for a good closer-to-the metal language because I feel that even though the Erlang runtime (and thus Elixir's) is extremely stable and with unmatched concurrency and parallelism primitives, there still is a need for a native hyper-optimized code every now and then (crypto and compression come to mind).

I like Go a lot. The authors got a lot of things right and the language's tooling is exceptional. Goroutines are no match for the true preemptive scheduling that the BEAM (Erlang's VM) can provide though. But I don't intend to use Go where I would use Erlang/Elixir anyway. They serve different niches.

---

Have you evaluated other languages outside of Go and C++? For example Rust or OCaml? If you did evaluate anything else, what are your impressions?


I have evaluated Rust a while ago, before i updated my C++ skills to C++17 with vcpkg / cmake and learned go using the new go modules functionality.

I think rust is overly complex, and very quirky but.. It has some good ideas that i have taken and used in my own experimental languages i have developed like the error/ok branch structures.

I think Ocaml is even more quirky than rust, they are using symbols (|) to define select statements, i would to be honest rather have something more readable. Reminds me of perl a lot.

Both use "let" for defining variables that i'm not a fan of as a keyword.


Eh, but you cannot deny these are cosmetical / taste preferences and not technical disadvantages of the languages.

IMO OCaml is a less sciency Haskell, and more focused on getting stuff done -- but I am still evaluating it and it definitely has warts in the tooling. Time will tell.

Rust... I looked at it but it struck me as a modern C++... too many ways to do one thing.

We need opinionated tech. Programming is not an art class practice session.


Its all about:

Syntax Libraries Runtime

I picked syntax briefly, because i think its the most important part of the language.

The libraries can be written, the runtime improved but if the syntax is bad its hard to change it later.


Go is good for system-level tools. But the web-facing / framework-wise is weak. The dependancy hell is not fully fixed yet.


I would say that the lack of gigantic frameworks is a feature. Go is great for web APIs.


This x1000 If you want to make a little cross platform binary for some utility sure maybe Go is the right choice, but most of the time people are building a "Web Application" in which case there are dozens of better languages to use


I found Go a better fit than Java & Python for my web APIs/micro-services. I'm not sure what web application are but Go compiles to WASM so it would make it an even more complete solution once WASM gets DOM access.


[flagged]


Its all still encumbered by patents, its not free. Its "open"


To be fair, grandfather did write: "I would rather use a programming language not licensed by a huge corporation."


Isn't Go out of Google...


Because who could possibly imagine a world where M$ would pull this same sort of stunt with the CLR...


Usage of “M$” is very juvenile in 2019, but this is the same point I was going to make. Microsoft hasn’t been as extortionist as oracle, at least not yet.


Microsoft has also demonstrated a far stronger commitment to developers over many decades compared with Oracle, who never sell or promote that far away from the C-suite.


Realy? I remember pretty much every development stack for windows being dropped and abandoned (leaving devs in the lurch) time after time on windows. XNA, Silverlight, WinRT, etc. It's easy to make MS look ok when you compare them to the horror show that is Oracle


He said "no big corporations behind". Also, it's not fully open, as you said.


Is C# more open than Java?


Well it's about the same amount of open as far as licensing is concerned, but it's created by microsoft rather than oracle, so you're less likely to be chased into ridiculous lawsuits.

Downside is: the library ecosystem is less open. Some libraries are proprietary, which is not something I've encountered in other ecosystems. This seems to be changing though, now that C# itself is open source.


> you're less likely to be chased into ridiculous lawsuits.

Microsoft has sued/legally threatened companies over Android and extracted many billions of dollars from them:

* https://www.forbes.com/sites/ewanspence/2015/11/01/microsoft...

* https://www.computerworld.com/article/2475440/android/micros...


AFAIK it’s not because of android, but because of fat32.


Patent extortion works by threatening the most applicable patents you have, then licensing your whole portfolio. If they didn't have fat32, do you really think they wouldn't have just used another patent to try and extract rents?


It’s more common to pay for licenses in the .net ecosystem in my experience.


No it isn't, OpenJDK is literally same as Oracle JDK and anyone can even fork it if you want unlike C#.


> Unlike C#

How do you figure? The Csharp compiler is Apache licensed.

https://github.com/dotnet/roslyn/blob/master/License.txt


Like java, the real problem is the runtime.


The C# runtime is also open source: https://github.com/dotnet/coreclr


Microsoft started open sourcing the heck out of the C# ecosystem a few years back, so the whole shebang is open source now.


As far as I understand it yes. Only the whole Oracle problem is the API copyright lawsuit. If Oracle win that then it will be impossible to avoid.


I don't care about Java, but I care about Clojure in which it is implemented. Should I be worried about Oracle?


I doub't it, not unless Oracle wins the Google V Oracle case and somehow API's can become patented, in which case were all boned https://en.wikipedia.org/wiki/Oracle_America,_Inc._v._Google....

Just make sure you don't use the Oracle JDK and use Open JDK or similar


When there are so many software options that don't involve buying from companies that use these kind of tactics, it's difficult to see how this will work out for Oracle in the long term.

Sure in the short-term they'll rinse companies for large amounts of money, but people tend to remember when that's been done to them, and aren't exactly keen to have it happen again.

Whilst I have no direct experience, a quick search indicates that IBM have similar practices. I wonder when/if that'll bleed across into Redhat.


> Sure in the short-term they'll rinse companies for large amounts of money, but people tend to remember when that's been done to them, and aren't exactly keen to have it happen again.

The tech personnel, yes. The guys who accept corporate sales pitches, no. They only hear "Oracle" and are thinking "big name, nobody gets fired for buying that".


My first proper job involved oracle. This put me off ever using it again from a licensing, technology and ethical perspective. Just the army of clueless but certified vulture contractors explained the ecosystem. This is how you slowly burn a business but Larry’s going to be dead then so he doesn’t give a fuck.


This practice has been going on for decades. And Oracle isn't close to be the only company.

But don't worry you shouldn't feel sympathy for enterprise companies as they are often just as bad as the vendors.


Whilst I may or may not feel sympathy for the companies themselves (although not everyone who uses Oracle software is an "enterprise" by any means), I can feel sympathy for the poor IT teams who would have to deal with a surprise audit from a vendor.


Has deployments of Oracle software gone up over the long term, or are people beginning to migrate away from Oracle software?


Just from my limit experience they are very slowly migrating away as they transition from on-premise to the cloud.

Not just Oracle but pretty much anything that is standalone software.


but people tend to remember when that's been done to them, and aren't exactly keen to have it happen again.

Companies stick with Oracle and IBM for multi-decade stretches, maybe the move to cloud will be what it takes to dislodge them, but then again, in a world where Azure, AWS and GCP exist some people still choose Oracle and IBM, so there's no explaining it.

If I were a CIO I would announce that this year's bonuses will be funded from savings on Oracle licenses, then sit back and let nature take its course.


Easy, Oracle bashers keep forgetting that Oracle and IBM pay the majority of salaries on OpenJDK developers.

Then again, there are plenty of other JVMs available since the 2000's, and many customers do pay for them.


That's an interesting characterization, that people who don't agree with Oracle's approach to licensing are "Oracle Bashers"?

Do you feel that the surprise audit approach to license compliance is a good one?


Yes, it quite common in the industry to track down on piracy use, Oracle is not alone in doing surprise audits.

There are even international organizations that collaborate with national police on that regard, https://www.bsa.org/


BSA is a fucking joke. A couple of decades ago I -- or rather the one-man legal entity that stood firewall between me and the corporate world -- received a Letter Of Demand from BSA "requiring" a full inventory of all software in use by my "organisation". For the record it was Microsoft behind this campaign. Since I had by then already switched 100% to Linux and FOSS I had no qualms about simply ignoring there peremptory bullshit. A couple of weeks later I received a phone call from them threatening legal action and jackboots kicking down my door. I believe my response was "fuck off", with no accompanying elucidation. Never heard from them again. So much for the BSA. Rather surprised to learn they even still exist.


Indeed it happens, but my question was more given your initial post, do you think it's a good way to manage licensing?

To me it provokes an adversarial relationship between software vendors and their customers and is quite likely a factor in the rise of the use of Open Source software in enterprise.

If the propietary software industry is to continue to prosper, it seems likely that annoying their customers with this approach to licensing is not a good one.

Now you could argue that this will have a knock on effect on Open source as many devs are employed by software companies, but that won't necessarily stop it happening.


The failure of pure open source, moving away from GPL and increase in dual licensing for enterprise software proves otherwise.


Ah well if we're arguing that kind of point, I'd say that in my line of work (Security tester) I'm seeing faaar more open source software than I did 10-15 years ago even in traditionally enterprise software friendly environments (e.g. banks/public sector)

The demise of proprietary unix in favour of Linux is one striking example.

another is the rise of open source products like Docker and Kubernetes. They are being heavily deployed in organizations that might once have considered more proprietary software options instead.


I mentioned failure of pure open source, the GPL dream, not open source as such.


I'm not sure I'd agree that GPL compatible licenses have failed.

To take one example Kubernetes, one of the most popular projects around at the moment is Apache 2 licensed which has been agreed with the FSF is an open source license. Other popular projects like Tensorflow also use this license

Likewise very popular projects like Visual Studio code, React Native and Angular make use of the MIT license which is also GPL compatible.


None of those licenses are copyleft, a company can pick any of those projects listed by you, sell a closed source product with their improvements, without giving even a semicolon back to upstream.


> The failure of pure open source

I see the opposite with languages and runtimes these days. If anything, I'd say there's a failure of trying to make money on the language/runtime itself instead of thinking or other parts of the company.


Languages yes, but then one starts deploying into cloud based solutions, none of them compliant with GPL ideals.


> none of them compliant with GPL ideals

That's totally fine with me and the beauty of restrictionless freedoms, you can do what you want. I license lots of my work that way, keep other parts hidden, etc. It's a healthy model instead of this rampant litigious approach often coupled with an irrational fear of theft. To be truly open sans restrictions is to take the bad with the good and recognize that what you open is not specifically where you make your money. Happily the industry continues to move towards unencumbered software especially on the language/runtime front.


That was my point about failure of pure open source, the money needs to come from somewhere and the ideals of GPL don't work across all business domains.


FACT as well (Federation Against Copyright Theft).

Personally I'm not a huge fan but if you are using copyright material then obey the law.


obey or evade or challenge the law.


Oracle contributes about 90% of development (80% of the issues, and almost all new JEPs). Red Hat contributes ~5%, and IBM only 1%. So the recent Red Hat acquisition improves their position a lot, but before that Oracle and IBM paid for the majority of OpenJDK salaries the same way Bill Gates and I combined have billions of dollars.

* https://blogs.oracle.com/java-platform-group/building-jdk-11...

* https://youtu.be/wHoRBvt3U6o?t=830


If Oracle wasn't involved you wouldn't need to pay as many to get involved


Hi all - I help run https://adoptopenjdk.net - I genuinely think that the article is spreading some FUD, but I also understand if folks feel strongly about looking at alternatives then you can read the full background https://medium.com/@javachampions/java-is-still-free-c02aef8... and I'm happy to answer Q's here as well


I actually think that is the best long-term approach for all of the parties involved:

In the past OpenJDK was missing critical features so that companies often used the commercial closed-source Oracle JDK. At the same time even then Oracle JDK was somewhat of a trap when it comes to licensing, as it included features not covered by the free licence that might be accidentally used by developers.

With Java 11 there is finally feature parity: Oracle contributed missing features to OpenJDK. Features that couldn't be contributed (due to licensing issues) were removed from the commercial Oracle JDK. So starting with Java 11 those two versions of the JDK are pretty much equal.

With Java 11 there's no reason to use the commercial Oracle JDK. Most of the companies that used the Oracle JDK before are better served by using one of the open-source OpenJDK builds: Either Oracle's OpenJDK build (which is only going to provide support for 6 months after each release), or one of the third-party builds that most likely are also going to track LTS releases such as Azul's Zulu or AdoptOpenJDK.

Oracle is very upfront about those changes: When you try to download Java 11+ from Oracle's website there's a huge yellow box with a warning about the license changes. In addition, that box also links to the GPL-licensed OpenJDK version.

As a Java developer I'm very happy about that new approach: With the feature parity between OpenJDK and the commercial release it's finally possible to develop and run Java applications on a 100% open-source stack, which is something that was much harder to do with earlier OpenJDK releases.


I see articles like this and then see a bunch of comments about not wanting to use Java because of Oracle. But these articles are somewhat misleading in that there are free versions of Java out there. I think the authors of said articles just wants to stir the pot. This is old news and not really relevant with all the free alternatives. Even on our Ubuntu builds, when we install Java it's the open jdk variant that gets installed by default.


There’s a response to this in the article - those free versions are only supported for 6 months.


OpenJDK builds from AdoptJDK [1] have LTS versions. The also state the following in their Roadmap [2]:

In addition, every three years one feature release will be designated as the Long Term Supported (LTS) release. We will produce LTS releases for at least four years. This assurance will allow you to stay on a well-defined code stream, and give you time to migrate to the next, new, stable, LTS release when it becomes available.

[1] - https://adoptopenjdk.net

[2] - https://adoptopenjdk.net/support.html#roadmap


But they're not major versions. Java has switched to "Chrome versioning," and every new feature release gets a new number. Those versions are supported until the next one comes along.


I think what they mean is OpenJRE, versus Oracle JRE


To expand: in the waning days of Sun, they open sourced large parts of the Java development kit (JDK). This became OpenJDK, and is GPL v2 licensed (with a linking exception).

Initially, not all code was available under a GPL license.

Separately at the same time, Apache led the Harmony project to produce an open source implementation of Java SE 5 & 6. This was successful.

As time passed, Sun (and maybe Oracle) open sourced more code into OpenJDK, leading to supporters switching from Harmony to OpenJDK. Additionally, Sun made the unfriendly move of licensing the TCK in a way that precluded any non-OpenJDk release from ever being able to claim Java compatibility. In response, Apache resigned from the Java board. And as of 2011, the Harmony project was stopped.

Because of the platform-independent goal of Java, there's a lot of ancillary "not-Java, but needed" libraries to build and run Java. These were not all open sourced by Sun / Oracle, but were reimplemented by RedHat under a project called IcedTea.

So, in summary, you can run OpenJDK/IcedTea and tell Oracle to pound sand.

The primary risk is that Oracle withdraws the things they do still control from the OpenJDK project, or stops working with the project to coordinate new releases. But they'd be shooting themselves in the foot if they did.


Working with the project to coordinate releases? Oracle employees run and manage the OpenJDK project (which is owned by Oracle, BTW), and contribute ~90% of the work (including designing future releases):

https://blogs.oracle.com/java-platform-group/building-jdk-11...


It is more then that.

Many java-relate patent grant require passing the TCK.


Not if you're using OpenJDK, which is licensed under the GPLv2.


I don't know anyone who buys new softwares from Oracle. Only few large companies are going after Oracle new services and software, mostly because some selfish company executives.


"I don't know anyone who buys new softwares from Oracle."

I do - I doubt that there are many organisations licensing just the Oracle database these days - I suspect most of their sales are in the ERP/finance areas where there are relatively few competitors.

How many competitors are there for Hyperion FM/Planning?

Edit: Note that I'm definitely not defending Oracle, but the market for their products is quite complex and much wider than a relational database engine.


Do I know you? :)

As for competitors to hfm/epm: there are a few (onestream, tagetik, whatever sap is peddling...). But it doesn’t matter, all this thing about auditing will go away when every Oracle customer is forced at gunpoint to move to cloud versions - where they can be squeezed for more money at the touch of a button. Hfm licenses, for example, are basically not sold anymore unless you get special blessing from an Oracle VP; it’s FCCS or nothing.


Its been ~4 years since I was involved in that area - I know at that time Oracle was trying to recruit some of my colleagues for their cloud team. I don't think anyone took them up on the offer!

I did a lot of integration work with HFM for my previous employer - I was actually rather proud of the reporting solution we built on top of HFM, infinitely better than the reporting tools that Oracle provided. I sometimes wish that we'd productized that and sold it!


The enterprise sector is full of this. And why wouldn't it? It's basically never-ending circle of highly-paid consultants, in-house employees with very specific skillsets, never mind corporate kickbacks for devs and their managers. Opening this up would ruin your own revenue. No consultant ever got complaints from his successors for choosing IBM.

We look down on what's going on in the pharma industry, but the software world isn't all sunshine and lilies.


I am on the other side, the large majority of our customers ride on SQL Server, Oracle, DB2, SAP and there is hardly any plan to move away from them.


This is the problem with large company. They always "want" the applications to be "enterprise" level. Even if it's just a report generation tool to automate some simple task, use Oracle because they already have a large team that will take care of the database, why use mySQL and risk unforeseen issues down the road?

I have even seen a super super tool that simply allow user to go through a questionnaire, which a paper print out will more than likely enough and faster, to be implemented as an Oracle database, with the business logic embedded inside the database, and a super thin UI. User will need to know the correct schema name to use though, because they use schemas for versioning, and it's not like 1.0 and 1.1, it's latest_with_iso_compliace, test_only_production_for_customer_A and beta_for_production or similar.


Huh?

>That’s why I think Oracle is sort of hedging its bets with Java audits and not going in there as strongly. It’s too soon. Give it five years when you’re stuck in Oracle’s ecosystem and Oracle needs money. Then they’ll start auditing.

This is burying the lede...


Lets assume that as an individual I want to move away from Java for backend development and currently I use Spring. Is there another ecosystem with a great IDE, type safety (or just type annotations), limits that allow one to not shoot yourself in the foot, a good debugger, memory safety and lastly speed ? Python really shines in most of the above except for the speed part.


Why not just use openJDK? Seems a bit drastic to do a full rewrite.


I agree. I wouldn't consider a full re-write but for further development.


Sounds like you might be looking for C#, but I'm sure you've considered it already.


But why would you want to move away from an ecosystem with a great IDE, type safety, speed and limits that prevent yourself from shooting yourself in your foot?


You could look into dart. Take a look at http://aqueduct.io/ for an example.


I have to plug Angel, too: https://angel-dart.github.io/


The Python speed issue in my experience is almost never a material concern. It’s fast enough using the CPython reference implementation, and there are numerous options (PyPy, Cython) to squeeze out better performance if you really need it.


Go is pretty decent from a few releases back.

If you're using JetBrains IDEA Ultimate, the official JetBrains plugin for Go works really well. It's the same piece their GoLand IDE uses.


Node.js, optionally with TypeScript, and VS Code as an IDE


Numba provides a Python decorator (like Java annotations) to opt in to native compilation: http://numba.pydata.org


Oracle wanted to be the apple of enterprise to offer an all in one oracle package that would be deeply integrated but they failed to assess the market.

It is not about Oracle not having competitive producta or services but about Oracle being stuck with their thinking in the 1991-2008 era.


As someone who works at Oracle on the JDK (i.e. OpenJDK), I’d like to point out a couple of things, as the interviewee was someone who directly benefits from any fear, uncertainty and doubt regarding Java (but this is not an official comment, and I speak only for myself):

* Under the old BCL license the Oracle JDK was a mix of free and commercial features. Using the commercial features required explicitly turning them on with the flag `-XX:+UnlockCommercialFeatures`. You could not use them accidentally. Current JDKs no longer contain any commercial features, as explained below.

* Starting with JDK 11, Oracle has completed open sourcing the JDK[1], which no longer contains any commercial features. Rather than a mixed free/commercial license, Oracle now offers the same software under two different licenses, the commercial OTN lincense, intended for those who wish to but a support subscription from Oracle, and a free and open-source license, for those who don't[2]. The commercial license download page[3] clearly states the different options:

Oracle Customers and ISVs targeting Oracle LTS releases: Oracle JDK is Oracle's supported Java SE version for customers and for developing, testing, prototyping or demonstrating your Java applications.

End users and developers looking for free JDK versions: Oracle OpenJDK offers the same features and performance as Oracle JDK under the GPL license (with the non-viral "Classpath Exception")

The page also links to the free option. The particular commercial JDK download page[4] also contains a big bright warning and links to the downlad page for the free license.

* That Oracle now only offers six months of free support (as oppsoed to before) is misleading. For at least the past seven years, Java had a major release every 3 or so years, and "update releases" (containing substantial new features, but no language or API changes) every six months, plus quarterly security and bug fixes[5]. The releases were also not supported for more than six months, and to be up to date on security, one was always required to upgrade to the semi-annual update releases. What changed recently, due to community demand, is how the features are distributed among the releases. There are no more major Java releases. The last one (ever) was JDK 9. Starting with JDK 10, the semi-annual releases are not major releases but "feature releases," that are allowed to contain API and language changes, but are small, so that instead of a major upgrade every three years, the upgrade process is more gradual (e.g. compare JDK 9, the last major release, with JDK 11, a feature release[6]). The feature releases are therefore somewhere between a major release and an update release but much closer to the latter. While major releases were supported for a number of years and the feature releases only for six months, the feature relases are by no stretch of the imagination major releases.

* Similarly sized runtimes/languages -- Apple's Swift/iOS, Google's Android and Microsoft's .NET -- are all part of ecosystems entirely or largely under the control of the companies owning the projects, and that generate billions of dollars annually, and so fund the development of the platform. Oracle has no control over the Java ecosystem, and so must fund the development of OpenJDK somehow. This is now done by offering long-term support for some of the feature releases, for companies that don't wish to upgrade to every feature release (in the past the funding came partly through the commercial features, which have now all been open sourced, and the annoying search toolbar that came with the JRE, which is gone now, too).

* Oracle employs hundreds of full-time developers who manage the OpenJDK project and contribute the lion's share of OpenJDK development[7]. While Oracle developers will continue to contribute most of the work, including security updates to current OpenJDK versions, they will not commit to backporting those contributions to old feature releases via OpenJDK's "JDK update" projects. Other companies have said they will do that work, so that there will likely be OpenJDK update releases for some feature releases, probably those that correspond to Oracle's LTS versions. Oracle encourages other members of the OpenJDK community to contribute even more.

[1] https://blogs.oracle.com/java-platform-group/oracle-jdk-rele...

[2] http://jdk.java.net/

[3] https://www.oracle.com/technetwork/java/javase/downloads/ind...

[4] https://www.oracle.com/technetwork/java/javase/downloads/jdk...

[5] https://java.com/en/download/faq/release_dates.xml

[6] https://openjdk.java.net/projects/jdk9/ vs. https://openjdk.java.net/projects/jdk/11/

[7] https://blogs.oracle.com/java-platform-group/building-jdk-11...


Wow, so with Java, rather than developing software... I can spend my time reading through piles of legalese, trying to figure out which incantation of vague licensing/use language I’m beholden to.


The JDK is under the same license as Linux, so however closely you pay attention to the Linux legalese, that's as much attention you need to pay to Java's.


All JDKs are GPL?


All JDKs built from the OpenJDK project have the same license as the OpenJDK project, which is GPLv2 with the Classpath Exception (that means the license does not infect Java programs running on top of the JDK).

http://openjdk.java.net/legal/gplv2+ce.html

(The same JDK is also offered by Oracle under a commercial license for those who wish to buy a support subscription from Oracle, and other companies license the code to make their own commerical JDKs, e.g. Azul's Zing).


Sounds...complicated.


> As someone who works at Oracle ...

Ahhh. Your other responses were so positive and promoting of Oracle, I nearly accused you of working for them.

Turns out you really do.


You should consider saving this comment so that it can be kept added to other similar article's that come out every few months.


But then the four last sentences say that they don't actually audit so much -- but they will, in five years' time!

It’s too soon. Give it five years when you’re stuck in Oracle’s ecosystem and Oracle needs money. Then they’ll start auditing. Right now, there’s so much buzz going on around Java, they don’t have to audit.


That’s the trap the author is trying to warn people about falling into.


Perhaps this is a stupid question, and someone please enlighten me - but would not the vast majority of JVM deployments be on either CentOS or Debian-derived base images with good support for an OpenJDK package?

I thought that the main differences between OpenJDK and Oracle java was the nicer font rendering and some Swing-ish stuff, is there a good comparison as to why people even use the Oracle Java?


Or... Just run openjdk! Problem solved


Thank goodness LibreOffice split from OpenOffice.org. A true blessing in disguise!


Another biased article by Java hater who has no clue what he is talking about. Make Java Great Again!




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: