[Looking for Charlie's main web site?]

What's a CF shop to do: Oracle's changed stance on commercial/prod use of Java, going forward?

(While this topic is written toward ColdFusion users, much of the information will apply to readers running ANY Java app/app server for commercial/production use, whether Java 8, 9, 10, or 11.)

Did you know that Oracle will no longer offer free updates/security patches for Java 8, if Java is used for commercial purposes beyond Jan 2019? After that, you must pay them for support/updates (including security updates). And did you know that they are not offering their next "long-term" release, Java 11, free for PRODUCTION use at all (and that you must obtain a separate license)? Finally, while Oracle will be offering a free openJDK implementation, did you know they will only be committing to supporting/updating it for 6 months after release, leaving subsequent updates to the community of contributors?

These are important changes for those running CF, since it runs on Java. (CF2016, 11, and 10 run on Java 8. And while CF2018 came out on Java 10, that Java release will not last for long, yet another complication/curiosity that I wrote about back in May: On ColdFusion and its support for Java 9, 10, and 11.)

For now, while Adobe is aware of the issue of the pending Oracle licensing change, they have yet to clarify things on the matter (at this writing, Nov 15 2018).

While we await that news from them, I wanted to share this news here to help my readers, as well as a bit more below for those wondering about the matter, and options going forward.

Finding more on the Oracle licensing change

As for finding more about this change in Oracle licensing (for Java 11 and earlier versions), well, rather than elaborate on things any further, let me point you to some resources written by others (having nothing to do with CF, of course). These have much more detail on the licensing changes, as well as alternatives to consider.

Let me start with some that are NOT from Oracle and focus perhaps more on the potential negative impact of the changes:

Then here are some that are either from Oracle or speaking from a perhaps more optimistic perspective:

If there are other, better, or more updated resources that may help readers, let me know and I will add them here.

Can you clarify "commercial" vs "production"?

(This one section has been added after the original post. Folks who are "not commercial" (such as government agencies, schools, and non-profits) will reasonably ask, "does this discussion about 'commercial' use apply to us?"

Well, let me clarify what I can find, for now. (See comments to the post below from Dec 4, when this first came up.) It seems clear that Java 11's new license does clearly say it refers to us NOT being able to use it for PRODUCTION purposes without a separate license. So that's not about "commercial" use only, but includes non-profits, etc.

What's NOT clear is about Java 8 updates, because as I write (before Jan 2019), we don't have the new license agreement that may appear when SUCH updates DO appear in 2019. But we have the Oracle blog post about the change which refers to that as being about updates post Jan 2019 being available only for "personal (non-corporate) use". We are left to interpret that, for now.

What can you do, going forward?

Well, you have a few choices:

  • Someone might think, "well the heck with them. I'll just not update my Java 8 after Jan 2019". Beware that stance: you will be opening yourself to security risks. Oracle had been updating the JVM every few months (and Adobe has always supported you updating to the latest point release of the major JVM that they support. I offer a table of those versions here, and there is an older Adobe blog post on the matter, at least up to CF11.)
  • Of course, one could just pay Oracle to provide updates for commercial use of Java 8 beyond 2019, or pay them to get a production license for Java 11.
  • And there are some other vendors offering paid support/updates, as well as various JDK alternatives.
  • Finally, one can go with Oracle's free openJDK (which IS permitted for commercial/production use), but again they have not committed to updating it beyond 6 months from release
  • Then there are other openjdk implementations that may have varying levels of long-term support/updates.

Again, see the links I offered above for more on these options.

But CF folks will surely not expect to pay for Java or java security updates, given that CF comes built on Java.

And some may be reluctant to go with an openJDK implementation that doesn't have a commitment of support beyond 6 months from its release.

We need Adobe to clarify things

We really need a resolution of this from Adobe. Again, for discussions of this matter from a CF perspective, see:

[As an update, since I wrote this, there was finally a comment in that last-mentioned forum thread, from Suresh of Adobe, who said, "The next update of  ACF  2018 and 2016 planned for  Jan/Feb  2019 will have support for Java 11 . The team is working on this as i write.". As others asked there, this does not address CF11, nor does it address support of openjdk implementations. And it would be helpful for someone from Adobe to update the blog post mentioned before that, to make this clarification or to create a new one and point the one to the other.]

At a minimum, one can hope that Adobe will at least change the recent versions of CF to support openjdk implementations of Java 11, so that we could use that (for free production purposes). Others may hope that Adobe might somehow license Java "for us" in a way that DOES allow us to use it (with CF only) for commercial/production purposes and to get updates/security patches for at least the term of Adobe's support of each CF version (CF11 will be supported by Adobe into mid-2019, and CF2016 into 2021, and CF2018 into 2023), but that seems unlikely.

Finally, though, on the matter of openjdk implementations that would allow us to use Java free for commercial/production use and be kept updated, there may be some potential good news on this front, a particular new openjdk implementation which may be of considerable interest--with support/updates even for commercial/production use for years to come, and from a vendor you know well. More on that in my next post.

Comments
Very thorough coverage (as always!). Stephen Cole's articles are a great source of information about the changes so thank you for linking to those.

It will, indeed, be very interesting to see what Adobe choose to do here. Given how long so many people stayed on Java 6 and then on Java 7, long past the EOL dates, I suspect most people on Java 8 will just stay there well past January 2019, regardless of the security risks (since that's what people did with 6 and 7).

A lot of "enterprise" companies will not be comfortable on the "unsupported" versions, and that's what Oracle is banking on, and will be willing to pay Oracle directly for support -- but I suspect a lot of SMEs will switch to OpenJDK instead.
# Posted By Sean Corfield | 11/16/18 12:43 PM
Thanks, Sean. And yep. I touched on one of your key points in the follow-up post (and debated coming back here to mention it), when I said how Corretto's much longer free update/patching timeframes better suited "server folks who are often slow to update their JVM versions (even if they may keep them patched)."

But you're right about how some orgs won't even want to consider an openjdk (even if from Amazon), for perhaps similar reasons to how some long favor staying on CF (for "Adobe support" of the product) versus moving to Lucee. Different strokes.

And different pressures will evolve over time to perhaps steer most to some solution. Interesting times, and as always, a fascinating career we have. So many moving parts, so much to learn and keep up on.

Finally thanks for the kind comments on my posts. My favorite books as a kid were those about Encyclopedia Brown (showing my age--and I realize, ours!). And then I had wonderful models for blogging with the likes of you, Ray, Ben F, Ben N, and others. Glad to pay it forward and repay you even if just a bit here. :-)
# Posted By Charlie Arehart | 11/16/18 12:54 PM
ColdFusion is the only JVM "language" that I can think of where Oracle's licensing change really matters -- because it is the only commercial "language" out there (I know it's more than "just" a language really), and the only one I can think of that _bundles the JVM_ with the installer.

Everything else is free to use pretty much any JVM but of course those other languages aren't "supported" commercially, except in rare cases (i.e., while there may be one or more companies offering commercial support around those languages, they are not commercial products, nor is paid annual support or maintenance offered by the originating project in general).

I hope that Adobe will decide to _officially_ support one or more of the OpenJDK offerings (preferably multiple ones) but I can understand why they may be reluctant to do so, because of the cost of expanding their support matrix.
# Posted By Sean Corfield | 11/16/18 12:55 PM
But Sean, are you implying that your take on things (especially regarding the discussion in part 1 post about the Oracle licensing change) is that you think someone running any other JVM-based language would NOT need to worry about the Oracle licensing change (to not provide free updates to Java 8 after Jan 2018, if they use the JVM commercially, and to not allow commercial use of Java 11?)

I didn't read it about being limited to those who "distribute" the jvm as part of their jvm-based software. I read it (and I read those resources of others) as indicating that it would apply just as well to ANYONE using the Oracle JVM for ANY commercial purposes--whether they are distributing it or not. And that's the aspect of all this that has so many concerned (the "trap" indicated in Colebourne's post that I pointed to there).

But I know these sort of licensing matters can often be VERY subtle, and of course some companies will listen only to their own lawyers interpretation of things rather than what any tech pundits may say. :-) We're all just feeling our way through the muck for now.

If you have found something to clarify things on this point, do feel free to share them. Or am I misreading you?
# Posted By Charlie Arehart | 11/16/18 12:59 PM
No, my point was that ColdFusion is the only JVM "language" that _bundles_ a JRE so it matters from the point of view of the product itself, and the updates Adobe provides.

That's not true of other JVM languages where the developers/companies have always had the responsibility to choose a JVM and manage it however they want, because those other languages don't (typically) have a commercial support setup that specifies particular JVM vendors/versions.

Does that make my intent clearer?

For Clojure, for example, the "support" for various JVMs is implied by this build matrix https://build.clojur... (Clojure 1.10 is under development and the first version to _require_ at least Java 8 -- 1.9 and earlier versions of Clojure "supported", i.e., were tested on, Java 6, 7, and 8).
# Posted By Sean Corfield | 11/16/18 1:41 PM
Right. But are you (or are you not) saying that someone on Clojure does face the same challenge due to Oracle's change in licensing? if THEY (the user of Clojure) are using it (Clojure and the jvm) commercially?

My read is that they WOULD (and therefore it seems that the discussion of any "cf only" nature of things is rather moot, beyond a technicality about it being bundled).
# Posted By charlie arehart | 11/16/18 2:33 PM
You are completely missing my point.

For ColdFusion developers, they turn to Adobe to deal with Oracle's licensing change.

For everyone else, they've already been looking at this for ages and know it's something they have to deal with themselves, like adults.
# Posted By Sean Corfield | 11/16/18 9:56 PM
Just a heads-up: I have moved the last 5 comments above to here from the blog post where they were posted 4 days ago. the follow-on post to this one, about Corretto. It's just that Sean's comments were really about oracle licensing (and CF) rather than about Corretto.

I've never done such a move of comments before, and I'm hoping Sean won't mind.

Finally, I will say I don't agree with his characterization as CFers "not being Adults" in their concern over the change of licensing. I also don't agree that others have "been looking into this for ages", since the various blog posts I point to above are all less than a couple of months old. Anyway, I won't argue the point any further. Each of us has made our positions on all this pretty clear.
# Posted By charlie arehart | 11/20/18 4:11 PM
I don't mind you moving the comments :)
# Posted By Sean Corfield | 11/20/18 4:17 PM
I think what's unique (or at least rare) with ColdFusion and the JRE/JVM is that _Adobe_ bundles a particular Oracle JRE version with the CF server installer, but after that typically the _user_ updates the Oracle JRE with minor versions to get patches.

This scenario, until now, was perfectly fine: it didn't matter whether Adobe distributed the Oracle JRE or the user downloaded it themselves, from a licencing point they were both fine for commercial use. So Adobe didn't have to bother distributing minor updates to the JRE, could just instruct the users to do so.

Typically, for most other products I've seen, until now use of a JRE followed this pattern:
1) The product doesn't come with JRE, the user is responsible for centrally installing and maintaining whatever version they want (or perhaps use a version supplied with their OS). Going forward, such a user would have to pay Oracle if they choose to keep using Oracle JRE.
2) The product comes bundled with JRE and updates to the product update the bundled JRE. Going forward, the creator of the product would have to pay Oracle to keep distributing the Oracle JRE.

As noted at the start of this comment, CF server does not currently follow either pattern, hence the complicated licencing situation.
# Posted By Legorol | 11/27/18 7:53 PM
Yep, Legorol.
# Posted By Charlie Arehart | 11/28/18 7:23 AM
Charlie, thanks very much for this thorough post. There is one thing I'm not sure I understand: in the first two paragraphs, you bolded / underlined for emphasis that these licensing changes pertain to *commercial* use of Java. I'm a CF developer working for an entirely state & federally grant-funded department in a public university. I would think that qualifies us as "not commercial," but in my other research & reading on this issue, I've only seen a distinction between "commercial" and "personal desktop" use of Java. We would be closer to commercial than to personal desktop use if any organizational use is considered commercial (even if it's not for profit), but that just doesn't feel right. My understanding is that CF has a large user base among governmental agencies, so this may be a question others would have as well. I haven't found an answer to this in my other research, so was wondering if you had any sense of what the correct answer is.
# Posted By Bugs Meany | 12/4/18 1:45 PM
Bugs, it's funny you should ask. I literally just got off a troubleshooting call with a university, where after helping solve their issue I was explaining also this Java licensing issue, and we wondered the same thing: is Oracle referring to "commercial" as in simply "not personal" or as in "profit-making".

Like you, I read it as "not personal", and therefore WOULD mean that schools, gov agencies, and non-profits would all be under the same "commercial" umbrella.

But I don't know, and I will dig around to see if I can find clarification. If I do, I will share it here as a comment (and then update the blog post).

Finally, I will add that while there is indeed lots of use of CF in such agencies (gov/school/non-profit), my own observation (among my clients and in the community) is that it's probably split evenly among this "commercial" and "non-profit" distinction, so really, the issue affects us all (who use CF)--or again, needs to be answered.

And as I say above, it's really Adobe who needs to answer this for us: whether identifying that they will support an openjdk, or perhaps license Java for us (a stretch, I realize, but indeed a possible option).

My sense is that they will support an openjdk. Then it will be on us (like all in the Java community) to deal with the implications of that (also discussed above, and in my follow-up post on Coretto, as one openjdk alternative.)
# Posted By charlie arehart | 12/4/18 2:03 PM
Charlie, thanks for your reply. Likewise, if I'm able to determine one way or the other how gov / school / nonprofits are categorized for these purposes, I'll come back and let you know.

Hope you got a smile out of the Bugs Meany reference. For anyone reading who isn't familiar, in the Encyclopedia Brown books mentioned in Charlie's 11/16/2018 12:54pm comment above, Bugs Meany was the leader of the Tigers, a neighborhood pack of bullies who liked to hassle Encyclopedia and his friend Sally Kimball. (My older son is now at the right age to be reading those books.)
# Posted By Bugs Meany | 12/4/18 2:14 PM
Ah, cool. I thought I DID recognize the name, but I have to admit it's been...a, um, long while...since I read the books. :-)
# Posted By charlie arehart | 12/4/18 2:19 PM
OK, I have confirmed now more specifics, about whether this issue is about "commercial" use (only, as in for profit). That is NOT the case. It's about ANY use in production.

If you visit the downloads page for Java, for instance (https://www.oracle.c...),in the section on Java 11 it refers us to the new license:

https://www.oracle.c...

And in the middle, under "License Rights and Restrictions", it has a bulleted list that starts "Further, You may not:", and the first bullet is that we may NOT (under this license) use Java:

"for any data processing or any commercial, production, or internal business purposes other than developing, testing, prototyping, and demonstrating your Application"

So there you go. It's NOTHING to do with profit making. Simply "production". I will update the blog post to clarify that. (And if you or I or others find more, do please share it.)

I will add that someone may ask, "but what about Java 8"? Well, that same download page points us to a DIFFERENT page for the license for THAT:

https://www.oracle.c...

And in that page, it discussed how Java did use to have a distinction about "commercial features" (a section of its own there), and we were not allowed to use those without a "separate license". This covered things like the Flight Recorder.

And as for the changes about updates in Java 8 (post Jan 2019), there is NO mention of that in this license (as of today, as it shows being updated last in 2017), but we can expect that when java updates Do come out later, the page will then point to some changed or new license about THAT, and we can reasonably expect that it will also be about "production" use, not "commercial".

Again, if anyone finds more specifics, please do share.
# Posted By charlie arehart | 12/4/18 2:31 PM
And I see now where the "commercial" discussion came from. First, as I show above, it's CLEAR that the Java 11 change is NOT about "commercial" use but any PRODUCTION USE.

As for Java 8 updates, my reference to "commercial" came instead from the wording used in the blog post from Oracle that I pointed to, about Java 8 updates:

https://blogs.oracle...

"The public availability of Java SE 8 updates from Oracle has been extended to at least January 2019. Moreover, Oracle will continue to provide consumers with updates for personal (non-corporate) use of Java SE 8 through at least the end of 2020."

So it's saying updates will be made available after Jan 2019 only for "personal (non-corporate) use". Until we see the actual license for updates then (likely the next after 1.8.0_191/192), we won't know for sure what is the actual fact.
# Posted By charlie arehart | 12/4/18 2:38 PM
Interesting that the current ColdFusion 2018 support matrix simply lists "JDK 10" without mentioning Oracle at all -- and also includes this disclaimer at the bottom of the document...

"DISCLAIMER: This document is intended to provide information about the possible platform combinations available at the time of its writing. Some platform combinations may not be supported by vendors of the various components of the platform (operating system vendor, web server vendor, application server vendor, JDK provider, and so on). Please refer to each vendor’s system requirements and support policies to ensure the combination you plan to run is supported."

Source: https://helpx.adobe....

I suppose one way to interpret this is that "any" JDK 10 will do, but to your point Charlie it would be good if Adobe clarified.
# Posted By Bernie Dolan | 12/10/18 12:22 PM
Yep, Bernie, that's interesting to note. I had not noticed it (that the support matrix said only jdk 10, not Oracle JDK (as it had said in the 2016 matrix, for instance, where it had said "Oracle JDK 1.8").

And FWIW, as for the disclaimer, the 2016 one had said the exact same thing.

So to both points, I'd not (myself) read anything about those as being something we should interpret about whether the openjdk SHOULD be expected to be supported by CF for now. :-)

So yep, we still must wait for Adobe to clarify things.

PS I moved Bernie's comment here (which he had put initially into the Coretto post), with his agreement (indeed, at his suggestion, which I agreed with).
# Posted By charlie arehart | 12/10/18 2:58 PM
Copyright ©2018 Charlie Arehart
Carehart Logo
BlogCFC was created by Raymond Camden. This blog is running version 5.005.
(Want to validate the html in this page?)

Managed Hosting Services provided by
Managed Dedicated Hosting