Hacker News new | past | comments | ask | show | jobs | submit login

What is that minefield? How is avoided by repackagers? Do they take legal liability of Oracle lawsuits related to Java?



Oracle's stance on what contexts their JDK/JRE is free to use in is ... nuanced, and has changed in the past. While I don't wish to spread FUD, the thought of using it in a commercial environment in any fashion would give me pause. Playing around with Oracle on licensing is, as hobbies go, somewhere on my list of things to do down around making plutonium cocktails and alligator juggling.

The other vendors have different (typically more explicitly open) licensing on their shipped artifacts. As ever, if it really matters, it's time to consult a legal professional in your jurisdiction to be sure instead of taking a random internet nerd's opinion on it. ;)


All those vendors offer Oracle software that's licensed to you by Oracle. Amazon, for example, cannot change the license on the Oracle software they're distributing because it's not their software. The Oracle license is a standard open-source license, but if it makes you feel better to download Oracle software with an Oracle license from some other company's website -- go for it, and you're welcome.


Technically, the OpenJDK project is independent of Oracle, even though they do sponsor and presently lead it. That source is no more Oracle's than the linux kernel is Red Hat's (in both cases, a large contributor with their own copyrights, contributing to an open project with open license).

The other vendor's shipped artifacts are in turn the work product of those vendors, based on the OpenJDK core. They are not distributing Oracle software, they are distributing artifacts built from the OpenJDK project's software, and their licensing decisions are independent of constraint from Oracle.

The Oracle build of the JDK has not always been isomorphic to those produced based on the OpenJDK code, and has in the past had different license terms that can in no way be characterized as a standard open source license. See, for example, graalvm use in production environments with OracleJDK. Being transparent, this may have changed in the past few years; ever since I left Oracle I've tried to think about their existence as little as possible.

My overall point is that it is wise, based on Oracle's past history, to read and carefully evaluate the license terms for Oracle's software before you use any of it in a commercial context. The strictly-GPLv2-with-classpath-exception-sourced vendor distributions of OpenJDK, not so much as the license is in fact standard and widely used/understood already in both commercial and non-commercial situations.


> Technically, the OpenJDK project is independent of Oracle, even though they do sponsor and presently lead it. That source is no more Oracle's than the linux kernel is Red Hat's (in both cases, a large contributor with their own copyrights, contributing to an open project with open license).

That's not true. Oracle owns the OpenJDK project much like Google owns Chromium. To contribute to OpenJDK you need to sign a Contributor Agreement granting Oracle shared ownership over your contribution (i.e. you maintain copyright, but Oracle also has copyright); this is standard practice for such open-source projects (like Chromium). On the other hand, while Linux is developed by various for-profit companies, the code is owned by the Linux Foundation. As of now, there is no separate legal entity for OpenJDK. I'm not sure it makes a difference in practice, but if you wanted to be technically correct then that's the situation.

> The Oracle build of the JDK has not always been isomorphic to those produced based on the OpenJDK code,

No. We offer two builds of the OpenJDK JDK, under two different licenses. The open-source one is here: https://jdk.java.net It is an official Oracle build.

The other official Oracle build (called by various names, including Oracle JDK) has a different license, but only diverges from OpenJDK some time after a feature release due to different bugfix backports.

> The strictly-GPLv2-with-classpath-exception-sourced vendor distributions of OpenJDK

Just pointing out that Oracle also distributes the JDK under that very same license (https://jdk.java.net), but we also offer our software through other vendors. It's up to you which website you choose to download our software from.


> On the other hand, while Linux is developed by various for-profit companies, the code is owned by the Linux Foundation.

This is incorrect. Linux does not require copyright assignment.

The documentation [0] says: "Copyright assignments are not required (or requested) for code contributed to the kernel. All code merged into the mainline kernel retains its original ownership; as a result, the kernel now has thousands of owners."

[0] https://www.kernel.org/doc/html/latest/process/1.Intro.html#...


Sorry, I stand corrected on the Linux Foundation.


It is true that https://jdk.java.net/21/ starts with:

> This page provides production-ready open-source builds of the Java Development Kit, version 21, an implementation of the Java SE 21 Platform under the GNU General Public License, version 2, with the Classpath Exception.


From the other website, it’s Oracle software under the GPLv2. From Oracle, it’s under the Oracle Binary Code License for Java (https://www.oracle.com/ca-en/downloads/licenses/binary-code-...). These are NOT the same license. The GPL, for instance, does not allow after-the-fact fees.


Hmm I think you are not right. If you go to https://jdk.java.net/21/, the first sentence says that it is GPLv2 (+ Classpath exception, whatever that is).


> Classpath exception, whatever that is

GPL is a copyleft license, so if you would take linux kernel (same license), added some patches to it and you would distribute the resulting software, you would have to make sure your sources are available.

This would make Java as a runtime a very bad target for any company - they don’t want to share their application code - hence the classpath exception, giving you basically a boundary over which the copyleft doesn’t propagate over.

But the JVM itself still benefits from any updates made by any company.


> hence the classpath exception, giving you basically a boundary over which the copyleft doesn’t propagate over.

Oooh that makes sense, thanks for clarifying this!


Forgot to add: I am no lawyer


Oracle OpenJDK: https://jdk.java.net (GPLv2 + Classpath Exception)

Oracle JDK: https://www.oracle.com/java/technologies/downloads/ (Oracle No-Fee Terms and Conditions)

The license you linked does not apply to current JDK versions at all.


But Oracle can try to lure and deceive you into installing a variant that is affected by more licences than the stuff also available from others.

"But almost all of this would have been available elsewhere under a standard open source licence!" is worth exactly nothing if one day you discover that you failed to stay clear of all their friendly little traps.


It’s not the Caribbean sea with singing sirens.


"Oracle(Java) is knocking at my company's door and they want money." - https://www.reddit.com/r/sysadmin/comments/165kzxg/oraclejav...


“I downloaded Photoshop and now adobe asks for its price”


Terrible take. Photoshop does not create and exploit confusion about how their products are free to use as much as Oracle does with Java. Photoshop also didn't sneakingly change terms from what used to be free without a proper notice while installing. Photoshop sales and marketing also don't do gotchas with crazy audits and threats of lawsuits. You don't need to buy Photoshop for all your employees if only a few use it.


> Photoshop also didn't sneaking change terms from what used to be free

Like making it even more free? You are literally free to use the “paid” OracleJDK on its latest LTS release up until the next LTS comes around+1 year.


The reference is to a previous licensing change, which made it less free, with Oracle shaking down groups using the Oracle JDK. They've changed their terms before and could do so again with future releases.



The JDK is GPLv2, which means it can be legally redistributed without charge. Oracle puts their JDK release under a different license. Microsoft distributes the binaries under the GPL. It’s the same code going into the binary, but different license terms.


Oracle provides their builds for free, given you use their latest LTS release. But that’s apples to oranges comparison - that is an actual support release, meant for big enterprises that wants to point their fingers at someone on Christmas eve.


OpenJDK (maintained by Oracle) is GPL, but Oracle JDK is a different codebase with different features under a commercial license. Oracle's OpenJDK builds are distributed under the GPL, like Microsoft's.


You would be right, if you would have made this comment a bit more than a decade ago.

The only remaining differences between OracleJDK and OpenJDK are logo, and trivial things - Oracle has opened up everything else.


As far as I'm aware, Oracle JDK gets fixes that OpenJDK doesn't, and is under a commercial license that's not GPL (even if it's free-as-in-beer under certain circumstances)? Is that wrong?


Right. So that’s the minefield, no? If you download from Oracle, it’s like Photoshop from Adobe. If you download from Amazon, it’s like gcc. But it’s the same software: near invisible difference.

So that’s why you shouldn’t download from Oracle.


Are you a huge enterprise system that has to be able to call someone on some national holiday at 2AM? If no, then just do whatever you want - I don’t understand running to Amazon, when you can just do `apt install openjdk`, but whatever. There is way too much fuss around this non-issue. It’s the exact same software plus-minus a few bytes.


Ubuntu LTS does not have modern JDK. Amazon has Coretto distribution. Much better.


There are two main branches of JDKs, OpenJDK and Oracle JDK (both maintained by Oracle).

Builds for the former are open-source but only updated for 6 months after each release, while the latter is under a commercial license with 3+ years commercial long-term support for some versions.

Projects like Eclipse Temurin (Adoptium) bring the LTS to OpenJDK. The underlying code is entirely open-source, so there is no licensing trouble.

Hence, if you want to download OpenJDK, it's important to do it from Adoptium, as you won't get updates on java.net after a while.


Java’s reference implementation is OpenJDK, developed mostly by Oracle, and is completely open-source (GPL-2).

One can optionally buy support for it, that’s the whole deal. Not that hard, but apparently this is a minefield for some..


There’s that and there’s https://www.oracle.com/ca-en/downloads/licenses/binary-code-... , where using the wrong runtime flag makes you owe money.


Don't use them commercial features if you don't be want to pay for them. And don't download the Enterprise Oracle JRE from the Oracle website if you don't want to use them commercial features. We all should read terms&conditions more carefully.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: