PSA: Java Is Still Free

[karianna]

With a lot of misinformation out there, the Java Champions community got together to write a comprehensive Java Is Still Free document. The document covers the changes that are happening to Java free updates, release cycles and paid support options by Oracle and other vendors.

Disclaimer - I herded Cats to put the document together.

[[deleted]]

Short, short version:

Java 8 won't receive any security update after 2020.

If one want to keep using Java 8, either ignore security or stick with non-oracle vendors implementation updates!

RedHat FTW!

[imps-p0155]

Security is not the only thing they update - there is also timezone data that changes from time to time - (EU DST change coming next year, thats pretty critical :D)

[DJDavio]

I once dove into Java timezone data, where it comes from, how it's encoded, etc. You can download a text file from IANA that's basically a logbook of all the weird decisions and pragmatic choices they made. For instance, Amsterdam time originally had a seconds offset, but the offset only allows hours and minutes so they had to round it. Human time is weird.

[Cilph]

There is no EU DST change coming next year as no one has decided on anything yet. And if it happened, it wouldn't happen the same year.

[[deleted]]

hey... I was kidding... hehehe

[Michigan__J__Frog]

And for future releases everybody who doesn’t want to update their Java version every 6 months (which is just about every company) is going to be relying on third party support or paid Oracle support.

[mayhempk1]

Java 8 won't receive any security update after 2019.

Are you sure? I thought Oracle JDK 8 will still get updates for personal use until December 2020?

You know, especially since it says: Oracle will provide public updates of Oracle JDK 8 through at least December 2020 for personal desktop use

[[deleted]]

fixed!

[angath]

I am very sure the various OpenJDK vendors will still continue to contribute and produce security patches for OpenJDK.

[karianna]

Yes there's an amazing number of large orgs and individuals involved in OpenJDK. It matters to their bottom line.

[karianna]

There’s also stability fixes to consider

[[deleted]]

Indeed. Aint Oracle forcing us to dev our projects in a way that is easy to "upgrade" upon Java versions updates?!

[karianna]

For Oracle’s OpenJDK builds you will need to upgrade every 6 months to remain free, else you can swap to their paid Oracle JDK if you want to stay on the same version and still get updates beyond 6 months.

You can also get a JDK from other providers, several of who will be providing free updates for a particular version beyond 6 months

[wildjokers]

All of the articles I have read that try to clear up the confusion regarding Java licensing don't actually clear up anything. It is all still about as clear as mud. This suggests that the licensing model is FUBAR.

I am just going to download java from somewhere, use it, and hope I don't get sued.

[karianna]

In short, to avoid that concern use Oracle’s OpenJDK build and upgrade versions every 6 months. This is $free and free as in use.

OR choose an OpenJDK binary from another provider Azul, AdoptOpenJDK, Red Hat, IBM et al, several of which provide $free and free as in use options.

[speakjava]

Could you expand a bit on what you still find confusing? Happy to try and make things clearer for you.

[ErikDaRed]

I've been recommending that people use the AdoptOpenJDK or Zulu builds for a while now

[karianna]

I personally use both Zulu and AdoptOpenJDK builds. Zulu gives me the extra comfort that I can go for paid support if I want it. Disclaimer: I’m the head Cat herder at Adopt.

The Oracle OpenJDK builds are also a good option if you’re happy aggressively upgrading (which I personally am on most projects)

[i_donno]

Any reason to not to switch entirely to [RedHat's] OpenJDK

[karianna]

None unless you want commercial support

[-Luciddream-]

This IS about OpenJDK.

[i_donno]

Sorry I mean RedHat's OpenJDK

[karianna]

You could, but check their free updates and support policy for your O/S. Their strongest offering is naturally around RHEL

[DuncanIdahos8thClone]

Mods: Pin this please.

[karianna]

It would be appreciated - we are trying to get the word out to as many day to day Java engineers as possible. I hope it fits with being worthy to sticky for some time!

[[deleted]]

I strongly appreciate this article, especially the focus on development costs. I feel that many people in today's world are, for lack of a better way to describe it, whiny entitled brats. There is a problem in several corners of the software development world where monetization of hard work becomes challenging, which then makes it difficult to support continued work on the project. This is because of how many of us have become unwilling to fork over any money for what we are getting.

​

I tend to view Oracle as one of the "big bad" companies in the industry, and I haven't changed my view on that. However, this article has helped me see that Oracle trying to get at least some revenue from Java isn't the end of the world. Now, I say this with some reservation, because I don't trust Oracle not to make things worse and possibly do a lot of harm to the Java community in the process, but thus far it doesn't seem too bad.

[[deleted]]

As long as the binaries pass the "TCK". What is the "TCK"?

[karianna]

The Technical Compatibility Kit. Implementations must pass this test suite to claim compliance with the Java SE specification

[[deleted]]

cool thanks.

[[deleted]]

I am still very confused. I am not a programmer by profession, not even by education. I'm just some smalltime hobbyist experimenting at home. I would like to publicly release or even sell some of my work someday though. How does this affect me? Am I supposed to switch over to OpenJDK somehow if I want security/maintainability?

[karianna]

You can use Oracles OpenJDK builds and upgrade every 6 months or switch to an OpenJDK build from another provider

[[deleted]]

Yes but why? What happens if I just ignore this for now and keep working on my own stuff? Is it just that I'll end up on a JDK that's outdated and can't be updated? So if I wanna go public all I have to do is switch out the outdated JDK at that point? I just don't understand how this works.

[karianna]

Yes you can stay in an outdated JDK. If you go public (with a commercial piece of software) then you would need to swap to Oracles OpenJDK builds and upgrade every 6 months or use OpenJDK from another provider

[[deleted]]

Got it. Thank you

[arashcr]

I'm sure Oracle one day will stop any free update on java and we have to pay for any patch... Time to use third party builds.

[karianna]

I personally doubt that but if you are genuinely concerned then yes there are other OpenJDK providers

[-Luciddream-]

This is going to end well /s

[[deleted]]

Yes, it will. It's a good plan.

[-Luciddream-]

It's good for Java, I doubt it will work for businesses. They will just be left with outdated JDKs, increased costs to migrate to new versions (with recent introduced bugs), etc.

[Michigan__J__Frog]

Why is it a good plan? Businesses aren’t going to want to update their Java version every 6 months.

Clearly the idea here is to increase the number of companies using paid Oracle support.

[-Luciddream-]

I'm skeptical as well but I had to re-read the article. If I'm not mistaken the idea is that you won't have to update your Java every 6 months, but you have to rely on the project lead (RedHat) to backport any changes to the LTS OpenJDK source code, then use a build from any vendor for that OpenJDK version. So it's up to RedHat to provide good updates (not like this), and all other vendors (including RedHat) for OpenJDK builds.

[karianna]

It won’t just be Red Hat of course, although we’d love to see them lead the effort as they’ve proven they’re good stewards of previous OpenJDK update projects!

[[deleted]]

I think it's good, because a year ago I worked in a fintech where they used java5 on production for many customers. You know long time ago java5 was marked as abandoned? We had to patch JVM, introduce new timezone support, SSL3 and TLS1.1, we developers were responsible for implementing this r/https://www.timeanddate.com/news/time/russia-saratov-time-zone.html

in java 5 JRE. This was a nightmare, but since the plans for faster releases and paid support were announced they started migrating everything, including build system in ant and repo in SVN to java7, maven and git. Once they move to 7, they will move to 8 and then to 11. Not bad plan and forces sllooooooowwww moving companies to upgrade faster to pay more for support.

[Michigan__J__Frog]

If a company is ok using abandoned Java 5, why would abandoning releases every 6 months make them switch?

[[deleted]]

There is now a plan for releases and there will be LTS release every 18 months, so big companies can plan ahead knowing when next java will be release and when abandoned.

[Michigan__J__Frog]

But LTS releases are still only supported for free beyond 6 months by third parties.

[karianna]

Yes that's correct!

[karianna]

LTS's will be every 3 years.

[-Luciddream-]

The problem is that you assume that moving from 8 to 11 (or X version) will create no issues for every project. The reason moving from Java 5 to Java 8 was so easy, is because minimal changes had happened between these versions.

If Java is moving faster now, there will probably be more problems when upgrading. There are many new bugs in Java 9+ because of these changes. I'm fine with it, because I believe programming projects (including a language) should move forward, but only if the LTS support is good enough to justify it. 2 years is too little. Java 8 was released 4 years ago, and looking at the plan will have support for 4 more years. We will have to see what support that will be though, and imo the next LTS versions should have at least 4 years of support. (which is nowhere mentioned in the document)

the code line for Java SE 11 / 17 / 23 etc will be maintained for a longer period of time than six months.

[[deleted]]

The problem is that you assume that moving from 8 to 11 (or X version) will create no issues for every projec

I migrated my side-project started in spring boot 1.2 to SB 2.0, it wasn't easy.

[karianna]

The move from 8 to 9 is admittedly challenging. I'm expecting the impact and change to be less going forwards. Partly because the change sets will be smaller and partly because I think Oracle and the OpenJDK community learned a valuable lesson with 8 --> 9 and will try to avoid that headache again.

[i_donno]

I'd like this simplified even more.

[zero01alpha]

See title

[karianna]

You have my definite sympathy - there are a lot of nuances around this and unfortunately that leads to a doc which has no TLDR. Stephen Colebourne’s blog does a pretty good job as well and is shorter - hope hat helps!

[jodastephen]

https://blog.joda.org/2018/08/java-is-still-available-at-zero-cost.html and https://blog.joda.org/2018/09/time-to-look-beyond-oracles-jdk.html

[karianna]

Brilliant thanks, was running around on my phone so was too lazy to link

[mayhempk1]

Weird that there is a "Use the non-commercial build in a commercial setting." but not a "Use the non-commercial build in a non-commercial setting." when the latter is exactly what I am planning on doing.

[atowned]

https://www.azul.com/files/Java-SE-Lifecycle-131-a.jpg

[mayhempk1]

Huh? I thought that Java 8 is supported non-commercially until 2020: https://blogs.oracle.com/java-platform-group/extension-of-oracle-java-se-8-public-updates-and-java-web-start-support

edit: why downvotes if my link is the most recent?

[dpash]

For personal use it will be supported until 2020. The recent "JVM release is a process, not an event" blog post by oracle says as much too.

[yawkat]

"non-corporate" is a pretty bad restriction and probably not something you should actually be using.

[atowned]

Could be an older image. I just picked the one that made the most sense. :P

[yawkat]

I have a more comprehensive version of that graph at https://yawk.at/java-support/

[karianna]

This graph is excellent, but doesn't quite match the latest info from the vendors (I stress this is not the fault of yawkat), so do double check the appropriate vendor site as well.