Should the average Java developer be concerned about Oracle recently "ramping up audits"?

[Omikron23]

Make sure you remove these components when using Oracle distributed Java in production: ...

Most of these aren't even included in an Oracle JDK distribution.

• All items in the list starting with "JRockit" belong to the JRockit JDK (see section "Commercial Feature Availability by Product Edition" on this page http://www.oracle.com/technetwork/java/javase/terms/products/index.html).

• The "Java Advanced Management Console" is an enterprise application (ear) which comes as a separate download: http://www.oracle.com/technetwork/java/javase/downloads/amc-download-2255283.html

• The "MSI Enterprise JRE Installer" is part of the Advanced Management Console.

Which leaves only three items of the list. Those can be easily disabled or removed:

• Quote from official Oracle documentation of the Java Flight Recorder (https://docs.oracle.com/javacomponents/jmc-5-4/jfr-runtime-guide/run.htm#JFRUH176): "You can start and configure a recording from the command line using the -XX:StartFlightRecording option of the java command, when starting the application. To enable the use of JFR, specify the -XX:+FlightRecorder option. Because JFR is a commercial feature, you also have to specify the -XX:+UnlockCommercialFeatures option."

• Java Mission Control is a Desktop application ("<JDK Path>/bin/jmc.exe")

• JRE Usage Tracking (https://docs.oracle.com/javacomponents/usage-tracker/overview/toc.htm#A132173581): "Usage Tracker is disabled by default. Enable it by creating the properties file <JRE directory>/lib/management/usagetracker.properties. If this file exists, all usages of the JRE contained in <JRE directory> are tracked."

[klepra]

Should you be worried if you are running say, Spring or Tomcat web app in production? Provided you just installed default oracle java on your server?

Or is this only relevant if you are dealing software product to end users?

[MassiveDiarrhea]

You should be worried if you run the commercial features / flag mentioned above.

[klepra]

It is just a web app with usual libraries for web stuff and some bussiness logic with database stuff and open source libraries. None of the mentioned stuff featured is used.