[Looking for Charlie's main web site?]

What's an admin to do: Oracle's changed stance on production use of Java, going forward?

Did you know that Oracle announced in 2018 major changes regarding free production use of Java 8 and 11?
  • Regarding Java 8, did you know that Oracle will no longer offer free updates/security patches for Java 8, if used for production (NOT just "commercial") purposes beyond Jan 2019? After that, you must pay them for support/updates (including security updates). For more on why this is NOT just about "commercial" use, see below.)
  • Regarding Java 11, the next major release, did you know that the Oracle Java 11 JVM cannot be USED at ALL for PRODUCTION purposes, without paying for it?
  • Finally, while Oracle will be offering a free openJDK implementation (which CAN be used for production, for free), did you know they will only be committing to supporting/updating their Oracle Java 11 openjdk for 6 months after release, leaving subsequent updates to the community of contributors?

For more, including why this may have significant impact on your use of Java-based applications, as well as alternatives that may exist for you going forward, read on.

What can you do, going forward?

So, with the pending changes regarding free production use of Java 11 at all, and free production use of Java 8 updates post Jan 2019, what can you do going forward? Well, you have a few choices:

  • Someone might think, "well the heck with them. I'll just not update my Java 8 after Jan 2019". Beware that stance: you will be opening yourself to security risks. Oracle had been updating the JVM every few months
  • Of course, one could just pay Oracle to provide updates for production use of Java 8 beyond 2019, or pay them to get a production license for Java 11.
    • (Update, Jan 23 2019: Users of ColdFusion are taken care of, as Adobe has announced that they have now licensed Oracle Java for production use with ColdFusion. For more information, see more on CF and this updated news below.)
  • And there are some other vendors offering paid support/updates, as well as various JDK alternatives. One can go with Oracle's free openJDK (which IS permitted for production use), but again they have not committed to updating it beyond 6 months from release. But there are other openjdk implementations that may have varying levels of long-term support/updates (though, as for CFers, Adobe has not yet indicated if any OpenJDK's are supported for CF)

For more info, keep reading, and see also several links I offer below with more info from others on all this.

Can you clarify "commercial" vs "production"?

I had previously added this discussion as a new section in this post, as it is indeed an important question which rises out of information being shared in a couple of places by Oracle. But as I have been revising this post (see my explanation at the very bottom of this post), I have decided that this is a topic that really deserves to be its own blog post, as I've seen the question asked elsewhere.

See that as a new post, Does Oracle's change regarding Java apply only to "commercial" use, or to ANY production use?.

The next section discusses some specific aspects of this matter, with respect to the ColdFusion Application server (which deploys by default atop Tomcat).

If you're not interested in CF, click here to skip to the section following that, for more of general interest on this Java licensing issue.

More details on this Java change, for CF users

I've written the above to be of generic use to readers running ANY Java app/app server for production use, whether Java 8, 9, 10, or 11. That said, my blog here is indeed written more typically toward users of the ColdFusion (or Lucee) CFML engine. CF (since CF10) comes deployed on Tomcat or can be deployed on other Java application servers. I want to share now a fre more specifics for them.

As for CF support of Java 8 or 11, note first that CF2016, 11, and 10 run on Java 8. And while CF2018 came out on Java 10, that Java release will not last for long, yet another complication/curiosity that I wrote about back in May: On ColdFusion and its support for Java 9, 10, and 11. Adobe has said (as of this writing in Nov 2018) that they do plan to update ColdFusion 2018 and 2016 to support Java 11, though questions remained. For more, read on.

Update, Jan 23, 2019: Great news for CF users. Adobe announced today they did what I proposed below might be an option: they have licensed Oracle Java (8 and 11 and beyond) for production use with CF. We will not need to pay for it, either to get updates for Java 8 after Jan 2019 or to use it with Java 11 and forward in production. (Note that only CF2016 and 2018 will be updated to support Java 11, with updates due in February. CF 11 will not be updated to support Java 11. And for now, they have no current plans to support an OpenJDK.)

For more, see this post and also the comments, including from CF Product Manager Rakshith Naresh who clarifies that things are indeed as I am reporting them in this update. The original wording of his post left some questions, which he answered. Sadly, he would have to go through significant hoops (including legal review) to revise the post's original wording.

(Given that new information, I am striking out the next 5 paragraphs from the original post.)

CFers should note that Adobe has posted about how they are aware of the issue of the pending Oracle licensing change, though they have yet to clarify things on the matter (at this writing, Nov 15 2018), which is why I was motivated to write this post. There has been some confusion on all this, both from within the CF and outside the CF community.

[As an update, since I wrote this, there was finally a comment in that last-mentioned forum thread, from Suresh of Adobe, who said, "The next update of  ACF  2018 and 2016 planned for  Jan/Feb  2019 will have support for Java 11 . The team is working on this as i write.". As others asked there, this does not address CF11, nor does it address support of openjdk implementations. And it would be helpful for someone from Adobe to update the blog post mentioned before that, to make this clarification or to create a new one and point the one to the other.]

CFers do indeed need Adobe to clarify things (see questions being asked in the comments on the aforementioned blog post, for example). There has also been at least one Adobe CF Forum thread where this matter was initially raised with considerable discussion, and then some more questions and discussions about it in the Adobe CF portal.

Bottom line: CF folks will surely not expect to pay for Java or java security updates, given that CF comes built on Java. And some may be reluctant to go with an openJDK implementation that doesn't have a commitment of support beyond 6 months from its release.

At a minimum, one can hope that Adobe will at least change the recent versions of CF to support openjdk implementations of Java 11, so that we could use that (for free production purposes). Others may hope that Adobe might somehow license Java "for us" in a way that DOES allow us to use it (with CF only) for production purposes and to get updates/security patches for at least the term of Adobe's support of each CF version (CF11 will be supported by Adobe into mid-2019, and CF2016 into 2021, and CF2018 into 2023), but that seems unlikely.

Moving off of CF-specific matters, let's get back to aspects of this discussion that apply to ANY Java users.

Finding more on the Oracle licensing change

If you'd like to read what others have said about this change in Oracle licensing (for Java 11 and earlier versions), here are several such resources (having nothing to do with CF, of course).

Let me start with some that are NOT from Oracle and focus perhaps more on the potential negative impact of the changes:

Then here are some that are either from Oracle or speaking from a perhaps more optimistic perspective:

If there are other, better, or more updated resources that may help readers, let me know and I will add them here.

Some hope regarding longer-term OpenJDK support, from others

Finally, though, on the matter of openjdk implementations that would allow us to use Java free for production use and be kept updated, there may be some potential good news on this front, a particular new openjdk implementation which may be of considerable interest--with support/updates even for production use for years to come, and from a vendor you know well. More on that in my next post.

[Update Jan 1, 2019: Note that I have changed this post pretty substantially since I first wrote it in Nov 2018, based both on additional information I found and comments shared below, but also especially to make the post more clearly of use for ANY Java user, while separately addressing aspects specific to CF users, the typical audience for my blog here. Indeed, I even changed the title and URL a bit for that reason. For a bit more, see my Jan 1 comment below.)

For more like this:

Comments
Very thorough coverage (as always!). Stephen Cole's articles are a great source of information about the changes so thank you for linking to those.

It will, indeed, be very interesting to see what Adobe choose to do here. Given how long so many people stayed on Java 6 and then on Java 7, long past the EOL dates, I suspect most people on Java 8 will just stay there well past January 2019, regardless of the security risks (since that's what people did with 6 and 7).

A lot of "enterprise" companies will not be comfortable on the "unsupported" versions, and that's what Oracle is banking on, and will be willing to pay Oracle directly for support -- but I suspect a lot of SMEs will switch to OpenJDK instead.
# Posted By Sean Corfield | 11/16/18 12:43 PM
Thanks, Sean. And yep. I touched on one of your key points in the follow-up post (and debated coming back here to mention it), when I said how Corretto's much longer free update/patching timeframes better suited "server folks who are often slow to update their JVM versions (even if they may keep them patched)."

But you're right about how some orgs won't even want to consider an openjdk (even if from Amazon), for perhaps similar reasons to how some long favor staying on CF (for "Adobe support" of the product) versus moving to Lucee. Different strokes.

And different pressures will evolve over time to perhaps steer most to some solution. Interesting times, and as always, a fascinating career we have. So many moving parts, so much to learn and keep up on.

Finally thanks for the kind comments on my posts. My favorite books as a kid were those about Encyclopedia Brown (showing my age--and I realize, ours!). And then I had wonderful models for blogging with the likes of you, Ray, Ben F, Ben N, and others. Glad to pay it forward and repay you even if just a bit here. :-)
# Posted By Charlie Arehart | 11/16/18 12:54 PM
ColdFusion is the only JVM "language" that I can think of where Oracle's licensing change really matters -- because it is the only commercial "language" out there (I know it's more than "just" a language really), and the only one I can think of that _bundles the JVM_ with the installer.

Everything else is free to use pretty much any JVM but of course those other languages aren't "supported" commercially, except in rare cases (i.e., while there may be one or more companies offering commercial support around those languages, they are not commercial products, nor is paid annual support or maintenance offered by the originating project in general).

I hope that Adobe will decide to _officially_ support one or more of the OpenJDK offerings (preferably multiple ones) but I can understand why they may be reluctant to do so, because of the cost of expanding their support matrix.
# Posted By Sean Corfield | 11/16/18 12:55 PM
But Sean, are you implying that your take on things (especially regarding the discussion in part 1 post about the Oracle licensing change) is that you think someone running any other JVM-based language would NOT need to worry about the Oracle licensing change (to not provide free updates to Java 8 after Jan 2018, if they use the JVM commercially, and to not allow commercial use of Java 11?)

I didn't read it about being limited to those who "distribute" the jvm as part of their jvm-based software. I read it (and I read those resources of others) as indicating that it would apply just as well to ANYONE using the Oracle JVM for ANY commercial purposes--whether they are distributing it or not. And that's the aspect of all this that has so many concerned (the "trap" indicated in Colebourne's post that I pointed to there).

But I know these sort of licensing matters can often be VERY subtle, and of course some companies will listen only to their own lawyers interpretation of things rather than what any tech pundits may say. :-) We're all just feeling our way through the muck for now.

If you have found something to clarify things on this point, do feel free to share them. Or am I misreading you?
# Posted By Charlie Arehart | 11/16/18 12:59 PM
No, my point was that ColdFusion is the only JVM "language" that _bundles_ a JRE so it matters from the point of view of the product itself, and the updates Adobe provides.

That's not true of other JVM languages where the developers/companies have always had the responsibility to choose a JVM and manage it however they want, because those other languages don't (typically) have a commercial support setup that specifies particular JVM vendors/versions.

Does that make my intent clearer?

For Clojure, for example, the "support" for various JVMs is implied by this build matrix https://build.clojur... (Clojure 1.10 is under development and the first version to _require_ at least Java 8 -- 1.9 and earlier versions of Clojure "supported", i.e., were tested on, Java 6, 7, and 8).
# Posted By Sean Corfield | 11/16/18 1:41 PM
Right. But are you (or are you not) saying that someone on Clojure does face the same challenge due to Oracle's change in licensing? if THEY (the user of Clojure) are using it (Clojure and the jvm) commercially?

My read is that they WOULD (and therefore it seems that the discussion of any "cf only" nature of things is rather moot, beyond a technicality about it being bundled).
# Posted By charlie arehart | 11/16/18 2:33 PM
You are completely missing my point.

For ColdFusion developers, they turn to Adobe to deal with Oracle's licensing change.

For everyone else, they've already been looking at this for ages and know it's something they have to deal with themselves, like adults.
# Posted By Sean Corfield | 11/16/18 9:56 PM
Just a heads-up: I have moved the last 5 comments above to here from the blog post where they were posted 4 days ago. the follow-on post to this one, about Corretto. It's just that Sean's comments were really about oracle licensing (and CF) rather than about Corretto.

I've never done such a move of comments before, and I'm hoping Sean won't mind.

Finally, I will say I don't agree with his characterization as CFers "not being Adults" in their concern over the change of licensing. I also don't agree that others have "been looking into this for ages", since the various blog posts I point to above are all less than a couple of months old. Anyway, I won't argue the point any further. Each of us has made our positions on all this pretty clear.
# Posted By charlie arehart | 11/20/18 4:11 PM
I don't mind you moving the comments :)
# Posted By Sean Corfield | 11/20/18 4:17 PM
I think what's unique (or at least rare) with ColdFusion and the JRE/JVM is that _Adobe_ bundles a particular Oracle JRE version with the CF server installer, but after that typically the _user_ updates the Oracle JRE with minor versions to get patches.

This scenario, until now, was perfectly fine: it didn't matter whether Adobe distributed the Oracle JRE or the user downloaded it themselves, from a licencing point they were both fine for commercial use. So Adobe didn't have to bother distributing minor updates to the JRE, could just instruct the users to do so.

Typically, for most other products I've seen, until now use of a JRE followed this pattern:
1) The product doesn't come with JRE, the user is responsible for centrally installing and maintaining whatever version they want (or perhaps use a version supplied with their OS). Going forward, such a user would have to pay Oracle if they choose to keep using Oracle JRE.
2) The product comes bundled with JRE and updates to the product update the bundled JRE. Going forward, the creator of the product would have to pay Oracle to keep distributing the Oracle JRE.

As noted at the start of this comment, CF server does not currently follow either pattern, hence the complicated licencing situation.
# Posted By Legorol | 11/27/18 7:53 PM
Yep, Legorol.
# Posted By Charlie Arehart | 11/28/18 7:23 AM
Charlie, thanks very much for this thorough post. There is one thing I'm not sure I understand: in the first two paragraphs, you bolded / underlined for emphasis that these licensing changes pertain to *commercial* use of Java. I'm a CF developer working for an entirely state & federally grant-funded department in a public university. I would think that qualifies us as "not commercial," but in my other research & reading on this issue, I've only seen a distinction between "commercial" and "personal desktop" use of Java. We would be closer to commercial than to personal desktop use if any organizational use is considered commercial (even if it's not for profit), but that just doesn't feel right. My understanding is that CF has a large user base among governmental agencies, so this may be a question others would have as well. I haven't found an answer to this in my other research, so was wondering if you had any sense of what the correct answer is.
# Posted By Bugs Meany | 12/4/18 1:45 PM
Bugs, it's funny you should ask. I literally just got off a troubleshooting call with a university, where after helping solve their issue I was explaining also this Java licensing issue, and we wondered the same thing: is Oracle referring to "commercial" as in simply "not personal" or as in "profit-making".

Like you, I read it as "not personal", and therefore WOULD mean that schools, gov agencies, and non-profits would all be under the same "commercial" umbrella.

But I don't know, and I will dig around to see if I can find clarification. If I do, I will share it here as a comment (and then update the blog post).

Finally, I will add that while there is indeed lots of use of CF in such agencies (gov/school/non-profit), my own observation (among my clients and in the community) is that it's probably split evenly among this "commercial" and "non-profit" distinction, so really, the issue affects us all (who use CF)--or again, needs to be answered.

And as I say above, it's really Adobe who needs to answer this for us: whether identifying that they will support an openjdk, or perhaps license Java for us (a stretch, I realize, but indeed a possible option).

My sense is that they will support an openjdk. Then it will be on us (like all in the Java community) to deal with the implications of that (also discussed above, and in my follow-up post on Coretto, as one openjdk alternative.)
# Posted By charlie arehart | 12/4/18 2:03 PM
Charlie, thanks for your reply. Likewise, if I'm able to determine one way or the other how gov / school / nonprofits are categorized for these purposes, I'll come back and let you know.

Hope you got a smile out of the Bugs Meany reference. For anyone reading who isn't familiar, in the Encyclopedia Brown books mentioned in Charlie's 11/16/2018 12:54pm comment above, Bugs Meany was the leader of the Tigers, a neighborhood pack of bullies who liked to hassle Encyclopedia and his friend Sally Kimball. (My older son is now at the right age to be reading those books.)
# Posted By Bugs Meany | 12/4/18 2:14 PM
Ah, cool. I thought I DID recognize the name, but I have to admit it's been...a, um, long while...since I read the books. :-)
# Posted By charlie arehart | 12/4/18 2:19 PM
OK, I have confirmed now more specifics, about whether this issue is about "commercial" use (only, as in for profit). That is NOT the case. It's about ANY use in production.

If you visit the downloads page for Java, for instance (https://www.oracle.c...),in the section on Java 11 it refers us to the new license:

https://www.oracle.c...

And in the middle, under "License Rights and Restrictions", it has a bulleted list that starts "Further, You may not:", and the first bullet is that we may NOT (under this license) use Java:

"for any data processing or any commercial, production, or internal business purposes other than developing, testing, prototyping, and demonstrating your Application"

So there you go. It's NOTHING to do with profit making. Simply "production". I will update the blog post to clarify that. (And if you or I or others find more, do please share it.)

I will add that someone may ask, "but what about Java 8"? Well, that same download page points us to a DIFFERENT page for the license for THAT:

https://www.oracle.c...

And in that page, it discussed how Java did use to have a distinction about "commercial features" (a section of its own there), and we were not allowed to use those without a "separate license". This covered things like the Flight Recorder.

And as for the changes about updates in Java 8 (post Jan 2019), there is NO mention of that in this license (as of today, as it shows being updated last in 2017), but we can expect that when java updates Do come out later, the page will then point to some changed or new license about THAT, and we can reasonably expect that it will also be about "production" use, not "commercial".

Again, if anyone finds more specifics, please do share.
# Posted By charlie arehart | 12/4/18 2:31 PM
And I see now where the "commercial" discussion came from. First, as I show above, it's CLEAR that the Java 11 change is NOT about "commercial" use but any PRODUCTION USE.

As for Java 8 updates, my reference to "commercial" came instead from the wording used in the blog post from Oracle that I pointed to, about Java 8 updates:

https://blogs.oracle...

"The public availability of Java SE 8 updates from Oracle has been extended to at least January 2019. Moreover, Oracle will continue to provide consumers with updates for personal (non-corporate) use of Java SE 8 through at least the end of 2020."

So it's saying updates will be made available after Jan 2019 only for "personal (non-corporate) use". Until we see the actual license for updates then (likely the next after 1.8.0_191/192), we won't know for sure what is the actual fact.
# Posted By charlie arehart | 12/4/18 2:38 PM
Interesting that the current ColdFusion 2018 support matrix simply lists "JDK 10" without mentioning Oracle at all -- and also includes this disclaimer at the bottom of the document...

"DISCLAIMER: This document is intended to provide information about the possible platform combinations available at the time of its writing. Some platform combinations may not be supported by vendors of the various components of the platform (operating system vendor, web server vendor, application server vendor, JDK provider, and so on). Please refer to each vendor’s system requirements and support policies to ensure the combination you plan to run is supported."

Source: https://helpx.adobe....

I suppose one way to interpret this is that "any" JDK 10 will do, but to your point Charlie it would be good if Adobe clarified.
# Posted By Bernie Dolan | 12/10/18 12:22 PM
Yep, Bernie, that's interesting to note. I had not noticed it (that the support matrix said only jdk 10, not Oracle JDK (as it had said in the 2016 matrix, for instance, where it had said "Oracle JDK 1.8").

And FWIW, as for the disclaimer, the 2016 one had said the exact same thing.

So to both points, I'd not (myself) read anything about those as being something we should interpret about whether the openjdk SHOULD be expected to be supported by CF for now. :-)

So yep, we still must wait for Adobe to clarify things.

PS I moved Bernie's comment here (which he had put initially into the Coretto post), with his agreement (indeed, at his suggestion, which I agreed with).
# Posted By charlie arehart | 12/10/18 2:58 PM
I have pretty substantially revised this post. I not only changed text, but also indeed the title and URL, to make things more accurate. Bottom line: these changes are NOT only about "commercial" use of Java going forward but any PRODUCTION use. That was clear about Java 11 (as I showed above).

But regarding Java 8 updates (post Jan 2019), I did finally find clarification (in Oracle licensing info) that confirms that that is NOT limited to just "commercial" users. See the discussion above about the confusion and the resolution.

Given that change, I didn't want to use the word "commercial" in either the title or URL of this post, so I changed those (and implemented a url rewrite so that old links still get to the right URL, of course).

Further, I revised the order of contents in the post to break the CF aspects of this discussion into their own section. This way, the first couple and last couple of sections are more clearly generic to ANY production Java users of Java 8 or 11. As such, I also then changed the title of the post.
# Posted By charlie arehart | 1/1/19 1:45 PM
Here's an important update on this post, for those using ColdFusion. Adobe has posted late last night a new clarification that they have now licensed Oracle Java 8 and 11 (and future editions) for use by CF users, so we will NOT need to pay for Oracle Java 8 updates or to use Oracle Java 11 in production.

See the update I have added in the post above, for more (including on CF11 and on openjdk support). I can't hand-craft hyperlinks here in the comments, so here is a link to the anchor about the update within the post above:

https://www.carehart...
# Posted By charlie arehart | 1/24/19 6:53 PM
That's very good -- and probably the best possible outcome for all ColdFusion users!
# Posted By Sean Corfield | 1/24/19 7:39 PM
Indeed. :-)
# Posted By Charlie Arehart | 1/24/19 8:50 PM
Copyright ©2019 Charlie Arehart
Carehart Logo
BlogCFC was created by Raymond Camden. This blog is running version 5.005.
(Want to validate the html in this page?)

Managed Hosting Services provided by
Managed Dedicated Hosting