What's an admin to do: Oracle's changed stance on production use of Java, going forward?
Note: This blog post is from 2018. Some content may be outdated--though not necessarily. Same with links and subsequent comments from myself or others. Corrections are welcome, in the comments. And I may revise the content as necessary.Did you know that Oracle announced in 2018 major changes regarding free production use of Java 8 and 11?
- Regarding Java 8, did you know that Oracle will no longer offer free updates/security patches for Java 8, if used for production (NOT just "commercial") purposes beyond Jan 2019? After that, you must pay them for support/updates (including security updates). For more on why this is NOT just about "commercial" use, see below.)
- Regarding Java 11, the next major release, did you know that the Oracle Java 11 JVM cannot be USED at ALL for PRODUCTION purposes, without paying for it?
- Finally, while Oracle will be offering a free openJDK implementation (which CAN be used for production, for free), did you know they will only be committing to supporting/updating their Oracle Java 11 openjdk for 6 months after release, leaving subsequent updates to the community of contributors?
For more, including why this may have significant impact on your use of Java-based applications, as well as alternatives that may exist for you going forward, read on.
What can you do, going forward?
So, with the pending changes regarding free production use of Java 11 at all, and free production use of Java 8 updates post Jan 2019, what can you do going forward? Well, you have a few choices:
- Someone might think, "well the heck with them. I'll just not update my Java 8 after Jan 2019". Beware that stance: you will be opening yourself to security risks. Oracle had been updating the JVM every few months
- Of course, one could just pay Oracle to provide updates for production use of Java 8 beyond 2019, or pay them to get a production license for Java 11.
- (Update, Jan 23 2019: Users of ColdFusion are taken care of, as Adobe has announced that they have now licensed Oracle Java for production use with ColdFusion. For more information, see more on CF and this updated news below.)
- And there are some other vendors offering paid support/updates, as well as various JDK alternatives. One can go with Oracle's free openJDK (which IS permitted for production use), but again they have not committed to updating it beyond 6 months from release. But there are other openjdk implementations that may have varying levels of long-term support/updates (though, as for CFers, Adobe has not yet indicated if any OpenJDK's are supported for CF)
For more info, keep reading, and see also several links I offer below with more info from others on all this.
Can you clarify "commercial" vs "production"?
I had previously added this discussion as a new section in this post, as it is indeed an important question which rises out of information being shared in a couple of places by Oracle. But as I have been revising this post (see my explanation at the very bottom of this post), I have decided that this is a topic that really deserves to be its own blog post, as I've seen the question asked elsewhere.
See that as a new post, Does Oracle's change regarding Java apply only to "commercial" use, or to ANY production use?.
The next section discusses some specific aspects of this matter, with respect to the ColdFusion Application server (which deploys by default atop Tomcat).
If you're not interested in CF, click here to skip to the section following that, for more of general interest on this Java licensing issue.
More details on this Java change, for CF users
I've written the above to be of generic use to readers running ANY Java app/app server for production use, whether Java 8, 9, 10, or 11. That said, my blog here is indeed written more typically toward users of the ColdFusion (or Lucee) CFML engine. CF (since CF10) comes deployed on Tomcat or can be deployed on other Java application servers. I want to share now a fre more specifics for them.
As for CF support of Java 8 or 11, note first that CF2016, 11, and 10 run on Java 8. And while CF2018 came out on Java 10, that Java release will not last for long, yet another complication/curiosity that I wrote about back in May: On ColdFusion and its support for Java 9, 10, and 11. Adobe has said (as of this writing in Nov 2018) that they do plan to update ColdFusion 2018 and 2016 to support Java 11, though questions remained. For more, read on.
Update, Jan 23, 2019: Great news for CF users. Adobe announced today they did what I proposed below might be an option: they have licensed Oracle Java (8 and 11 and beyond) for production use with CF. We will not need to pay for it, either to get updates for Java 8 after Jan 2019 or to use it with Java 11 and forward in production. (Note that only CF2016 and 2018 will be updated to support Java 11, with updates due in February. CF 11 will not be updated to support Java 11. And for now, they have no current plans to support an OpenJDK.)For more, see this post and also the comments, including from CF Product Manager Rakshith Naresh who clarifies that things are indeed as I am reporting them in this update. The original wording of his post left some questions, which he answered. Sadly, he would have to go through significant hoops (including legal review) to revise the post's original wording.
And you can find the JVM installers that Adobe supports at their CF downloads page, where various CF-related tools can be downloaded (but not CF itself).
(Given that new information, I am striking out the next 5 paragraphs from the original post.)
CFers should note that Adobe has posted about how they are aware of the issue of the pending Oracle licensing change, though they have yet to clarify things on the matter (at this writing, Nov 15 2018), which is why I was motivated to write this post. There has been some confusion on all this, both from within the CF and outside the CF community.
[As an update, since I wrote this, there was finally a comment in that last-mentioned forum thread, from Suresh of Adobe, who said, "The next update of ACF 2018 and 2016 planned for Jan/Feb 2019 will have support for Java 11 . The team is working on this as i write.". As others asked there, this does not address CF11, nor does it address support of openjdk implementations. And it would be helpful for someone from Adobe to update the blog post mentioned before that, to make this clarification or to create a new one and point the one to the other.]
CFers do indeed need Adobe to clarify things (see questions being asked in the comments on the aforementioned blog post, for example). There has also been at least one Adobe CF Forum thread where this matter was initially raised with considerable discussion, and then some more questions and discussions about it in the Adobe CF portal.
Bottom line: CF folks will surely not expect to pay for Java or java security updates, given that CF comes built on Java. And some may be reluctant to go with an openJDK implementation that doesn't have a commitment of support beyond 6 months from its release.
At a minimum, one can hope that Adobe will at least change the recent versions of CF to support openjdk implementations of Java 11, so that we could use that (for free production purposes). Others may hope that Adobe might somehow license Java "for us" in a way that DOES allow us to use it (with CF only) for production purposes and to get updates/security patches for at least the term of Adobe's support of each CF version (CF11 will be supported by Adobe into mid-2019, and CF2016 into 2021, and CF2018 into 2023), but that seems unlikely.
Moving off of CF-specific matters, let's get back to aspects of this discussion that apply to ANY Java users.
Finding more on the Oracle licensing change
If you'd like to read what others have said about this change in Oracle licensing (for Java 11 and earlier versions), here are several such resources (having nothing to do with CF, of course).
Let me start with some that are NOT from Oracle and focus perhaps more on the potential negative impact of the changes:
- Using Java 11 In Production: Important Things To Know
- Eliminating Java Update Confusion
- Java is still available at zero-cost
- Oracle's Java 11 trap - Use OpenJDK instead!
Then here are some that are either from Oracle or speaking from a perhaps more optimistic perspective:
- Oracle Java SE Support Roadmap (updated Nov 2018)
- Oracle Technology Network License Agreement for Oracle Java SE (license for Java 11 JDK)
- Java Is Still Free
- The future of Java and OpenJDK updates without Oracle support
- Oracle JDK Releases for Java 11 and Later
If there are other, better, or more updated resources that may help readers, let me know and I will add them here.
Some hope regarding longer-term OpenJDK support, from others
Finally, though, on the matter of openjdk implementations that would allow us to use Java free for production use and be kept updated, there may be some potential good news on this front, a particular new openjdk implementation which may be of considerable interest--with support/updates even for production use for years to come, and from a vendor you know well. More on that in my next post.
[Update Jan 1, 2019: Note that I have changed this post pretty substantially since I first wrote it in Nov 2018, based both on additional information I found and comments shared below, but also especially to make the post more clearly of use for ANY Java user, while separately addressing aspects specific to CF users, the typical audience for my blog here. Indeed, I even changed the title and URL a bit for that reason. For a bit more, see my Jan 1 comment below.)
For more content like this from Charlie Arehart:Need more help with problems?
- Signup to get his blog posts by email:
- Follow his blog RSS feed
- View the rest of his blog posts
- View his blog posts on the Adobe CF portal
- If you may prefer direct help, rather than digging around here/elsewhere or via comments, he can help via his online consulting services
- See that page for more on how he can help a) over the web, safely and securely, b) usually very quickly, c) teaching you along the way, and d) with satisfaction guaranteed
It will, indeed, be very interesting to see what Adobe choose to do here. Given how long so many people stayed on Java 6 and then on Java 7, long past the EOL dates, I suspect most people on Java 8 will just stay there well past January 2019, regardless of the security risks (since that's what people did with 6 and 7).
A lot of "enterprise" companies will not be comfortable on the "unsupported" versions, and that's what Oracle is banking on, and will be willing to pay Oracle directly for support -- but I suspect a lot of SMEs will switch to OpenJDK instead.
But you're right about how some orgs won't even want to consider an openjdk (even if from Amazon), for perhaps similar reasons to how some long favor staying on CF (for "Adobe support" of the product) versus moving to Lucee. Different strokes.
And different pressures will evolve over time to perhaps steer most to some solution. Interesting times, and as always, a fascinating career we have. So many moving parts, so much to learn and keep up on.
Finally thanks for the kind comments on my posts. My favorite books as a kid were those about Encyclopedia Brown (showing my age--and I realize, ours!). And then I had wonderful models for blogging with the likes of you, Ray, Ben F, Ben N, and others. Glad to pay it forward and repay you even if just a bit here. :-)
Everything else is free to use pretty much any JVM but of course those other languages aren't "supported" commercially, except in rare cases (i.e., while there may be one or more companies offering commercial support around those languages, they are not commercial products, nor is paid annual support or maintenance offered by the originating project in general).
I hope that Adobe will decide to _officially_ support one or more of the OpenJDK offerings (preferably multiple ones) but I can understand why they may be reluctant to do so, because of the cost of expanding their support matrix.
I didn't read it about being limited to those who "distribute" the jvm as part of their jvm-based software. I read it (and I read those resources of others) as indicating that it would apply just as well to ANYONE using the Oracle JVM for ANY commercial purposes--whether they are distributing it or not. And that's the aspect of all this that has so many concerned (the "trap" indicated in Colebourne's post that I pointed to there).
But I know these sort of licensing matters can often be VERY subtle, and of course some companies will listen only to their own lawyers interpretation of things rather than what any tech pundits may say. :-) We're all just feeling our way through the muck for now.
If you have found something to clarify things on this point, do feel free to share them. Or am I misreading you?
That's not true of other JVM languages where the developers/companies have always had the responsibility to choose a JVM and manage it however they want, because those other languages don't (typically) have a commercial support setup that specifies particular JVM vendors/versions.
Does that make my intent clearer?
For Clojure, for example, the "support" for various JVMs is implied by this build matrix https://build.clojur... (Clojure 1.10 is under development and the first version to _require_ at least Java 8 -- 1.9 and earlier versions of Clojure "supported", i.e., were tested on, Java 6, 7, and 8).
My read is that they WOULD (and therefore it seems that the discussion of any "cf only" nature of things is rather moot, beyond a technicality about it being bundled).
For ColdFusion developers, they turn to Adobe to deal with Oracle's licensing change.
For everyone else, they've already been looking at this for ages and know it's something they have to deal with themselves, like adults.
I've never done such a move of comments before, and I'm hoping Sean won't mind.
Finally, I will say I don't agree with his characterization as CFers "not being Adults" in their concern over the change of licensing. I also don't agree that others have "been looking into this for ages", since the various blog posts I point to above are all less than a couple of months old. Anyway, I won't argue the point any further. Each of us has made our positions on all this pretty clear.
This scenario, until now, was perfectly fine: it didn't matter whether Adobe distributed the Oracle JRE or the user downloaded it themselves, from a licencing point they were both fine for commercial use. So Adobe didn't have to bother distributing minor updates to the JRE, could just instruct the users to do so.
Typically, for most other products I've seen, until now use of a JRE followed this pattern:
1) The product doesn't come with JRE, the user is responsible for centrally installing and maintaining whatever version they want (or perhaps use a version supplied with their OS). Going forward, such a user would have to pay Oracle if they choose to keep using Oracle JRE.
2) The product comes bundled with JRE and updates to the product update the bundled JRE. Going forward, the creator of the product would have to pay Oracle to keep distributing the Oracle JRE.
As noted at the start of this comment, CF server does not currently follow either pattern, hence the complicated licencing situation.
Like you, I read it as "not personal", and therefore WOULD mean that schools, gov agencies, and non-profits would all be under the same "commercial" umbrella.
But I don't know, and I will dig around to see if I can find clarification. If I do, I will share it here as a comment (and then update the blog post).
Finally, I will add that while there is indeed lots of use of CF in such agencies (gov/school/non-profit), my own observation (among my clients and in the community) is that it's probably split evenly among this "commercial" and "non-profit" distinction, so really, the issue affects us all (who use CF)--or again, needs to be answered.
And as I say above, it's really Adobe who needs to answer this for us: whether identifying that they will support an openjdk, or perhaps license Java for us (a stretch, I realize, but indeed a possible option).
My sense is that they will support an openjdk. Then it will be on us (like all in the Java community) to deal with the implications of that (also discussed above, and in my follow-up post on Coretto, as one openjdk alternative.)
Hope you got a smile out of the Bugs Meany reference. For anyone reading who isn't familiar, in the Encyclopedia Brown books mentioned in Charlie's 11/16/2018 12:54pm comment above, Bugs Meany was the leader of the Tigers, a neighborhood pack of bullies who liked to hassle Encyclopedia and his friend Sally Kimball. (My older son is now at the right age to be reading those books.)
If you visit the downloads page for Java, for instance (https://www.oracle.c...),in the section on Java 11 it refers us to the new license:
https://www.oracle.c...
And in the middle, under "License Rights and Restrictions", it has a bulleted list that starts "Further, You may not:", and the first bullet is that we may NOT (under this license) use Java:
"for any data processing or any commercial, production, or internal business purposes other than developing, testing, prototyping, and demonstrating your Application"
So there you go. It's NOTHING to do with profit making. Simply "production". I will update the blog post to clarify that. (And if you or I or others find more, do please share it.)
I will add that someone may ask, "but what about Java 8"? Well, that same download page points us to a DIFFERENT page for the license for THAT:
https://www.oracle.c...
And in that page, it discussed how Java did use to have a distinction about "commercial features" (a section of its own there), and we were not allowed to use those without a "separate license". This covered things like the Flight Recorder.
And as for the changes about updates in Java 8 (post Jan 2019), there is NO mention of that in this license (as of today, as it shows being updated last in 2017), but we can expect that when java updates Do come out later, the page will then point to some changed or new license about THAT, and we can reasonably expect that it will also be about "production" use, not "commercial".
Again, if anyone finds more specifics, please do share.
As for Java 8 updates, my reference to "commercial" came instead from the wording used in the blog post from Oracle that I pointed to, about Java 8 updates:
https://blogs.oracle...
"The public availability of Java SE 8 updates from Oracle has been extended to at least January 2019. Moreover, Oracle will continue to provide consumers with updates for personal (non-corporate) use of Java SE 8 through at least the end of 2020."
So it's saying updates will be made available after Jan 2019 only for "personal (non-corporate) use". Until we see the actual license for updates then (likely the next after 1.8.0_191/192), we won't know for sure what is the actual fact.
"DISCLAIMER: This document is intended to provide information about the possible platform combinations available at the time of its writing. Some platform combinations may not be supported by vendors of the various components of the platform (operating system vendor, web server vendor, application server vendor, JDK provider, and so on). Please refer to each vendor’s system requirements and support policies to ensure the combination you plan to run is supported."
Source: https://helpx.adobe....
I suppose one way to interpret this is that "any" JDK 10 will do, but to your point Charlie it would be good if Adobe clarified.
And FWIW, as for the disclaimer, the 2016 one had said the exact same thing.
So to both points, I'd not (myself) read anything about those as being something we should interpret about whether the openjdk SHOULD be expected to be supported by CF for now. :-)
So yep, we still must wait for Adobe to clarify things.
PS I moved Bernie's comment here (which he had put initially into the Coretto post), with his agreement (indeed, at his suggestion, which I agreed with).
But regarding Java 8 updates (post Jan 2019), I did finally find clarification (in Oracle licensing info) that confirms that that is NOT limited to just "commercial" users. See the discussion above about the confusion and the resolution.
Given that change, I didn't want to use the word "commercial" in either the title or URL of this post, so I changed those (and implemented a url rewrite so that old links still get to the right URL, of course).
Further, I revised the order of contents in the post to break the CF aspects of this discussion into their own section. This way, the first couple and last couple of sections are more clearly generic to ANY production Java users of Java 8 or 11. As such, I also then changed the title of the post.
See the update I have added in the post above, for more (including on CF11 and on openjdk support). I can't hand-craft hyperlinks here in the comments, so here is a link to the anchor about the update within the post above:
https://www.carehart...