Just to be clear, all of these sites offer builds of Oracle software (the OpenJDK JDK), developed by Oracle and licensed by Oracle. When you file an issue that's in the JDK, those companies forward it to us, Oracle engineers, to fix.

Java downloaded from Oracle has the following license:

> Important Oracle Java License Information

> The Oracle Technology Network License Agreement for Oracle Java SE is substantially different from prior Oracle Java licenses. This license permits certain uses, such as personal use and development use, at no cost -- but other uses authorized under prior Oracle Java licenses may no longer be available. Please review the terms carefully before downloading and using this product.

[0] https://www.java.com/en/download/

Getting JDK from better sources won't risk you accidentally hitting the wrong download link and winding up with an enterprise licensing audit and a legal requirement to Java license for every employee.

I'd strongly recommend you don't download anything Java related from Oracle or have any direct relationship with Oracle at all. Java employees working for Oracle and their advice should be treated skeptically. Reporting issues to third parties and letting them contact Oracle's engineers is ideal (least of all because you need a support contract to report it directly to Oracle anyway).

Oracle is a bad actor and should be avoided for your own good. The only ones suggesting getting it from Oracle directly are also Oracle employees.

Oracle offers the JDK under two licenses, one of them is the same license under which all other vendors offer our software: https://jdk.java.net

The fact is that if you're using Java these days (or for the past 13 years), you're using Oracle software under a license issued to you by Oracle, regardless of which website you download it from. If you want the support or advice of the people who, you know, actually develop the software then you'll need to talk to Oracle people, and those who want their software to be supported by the people who write it are those who fund the development of OpenJDK. You're welcome, by the way.

Oracle offers two licenses: A "foot gun" license that would cost you tens of thousands of dollars, and a clean license.

> The fact is that if you're using Java these days (or for the past 13 years), you're using Oracle software under a license issued to you by Oracle, regardless of which website you download it from.

That is inaccurate. If third parties build the JDK themselves, then you're only subject to the JDK's license. If you get the binaries from Oracle, you're subject to the JDK license and binary distribution license.

Plus if Oracle's distributions and third parties are the same, but the risks are much lower with third party, then why NOT get it from a third party? You haven't named a downside, and I've explained the upsides.

You cannot, in good faith, argue that downloading from Oracle "supports" Java development, while also arguing that downloading it from Oracle is always free. The only reason it supports Java development is when people screw up and get billed.

> If you get the binaries from Oracle, you're subject to the JDK license and binary distribution license.

No, if you download binaries from Oracle you're subject to the one license that accompanies your chosen binary. The main terms of the non-open-source licensed distribution are the very first thing you see on the download page of that distribution:

JDK 21 binaries are free to use in production and free to redistribute, at no cost, under the Oracle No-Fee Terms and Conditions (NFTC). JDK 21 will receive updates under the NFTC, until September 2026, a year after the release of the next LTS. Subsequent JDK 21 updates will be licensed under the Java SE OTN License (OTN) and production use beyond the limited free grants of the OTN license will require a fee.

There is nothing underhanded here. You can use the open-source license, or you can use this one, but updates for this distribution will be offered to paid support subscribers only after September 2026.

But in any event, if it makes you feel better to download our software from another website, by all means do that!

> You cannot, in good faith, argue that downloading from Oracle "supports" Java development, while also arguing that downloading it from Oracle is always free. The only reason it supports Java development is when people screw up and get billed.

I didn't say that downloading from Oracle supports anything (it doesn't because it's free under both licenses we offer). You pay Oracle for a support subscription and that's how OpenJDK (and the Java SE specification) is funded. Luckily, many of those who choose to buy support prefer buying it from the developers of the software, and that's how we've been able to increase the investment in OpenJDK over the past few years.

I feel like the attitude in your post was completely unnecessary. You’re an ambassador of OpenJDK.

Corretto seems to have 21 as of just now.

What is that minefield? How is avoided by repackagers? Do they take legal liability of Oracle lawsuits related to Java?

"Oracle(Java) is knocking at my company's door and they want money." - https://www.reddit.com/r/sysadmin/comments/165kzxg/oraclejav...

“I downloaded Photoshop and now adobe asks for its price”

Terrible take. Photoshop does not create and exploit confusion about how their products are free to use as much as Oracle does with Java. Photoshop also didn't sneakingly change terms from what used to be free without a proper notice while installing. Photoshop sales and marketing also don't do gotchas with crazy audits and threats of lawsuits.

> Photoshop also didn't sneaking change terms from what used to be free

Like making it even more free? You are literally free to use the “paid” OracleJDK on its latest LTS release up until the next LTS comes around+1 year.

The reference is to a previous licensing change, which made it less free, with Oracle shaking down groups using the Oracle JDK. They've changed their terms before and could do so again with future releases.

The JDK is GPLv2, which means it can be legally redistributed without charge. Oracle puts their JDK release under a different license. Microsoft distributes the binaries under the GPL. It’s the same code going into the binary, but different license terms.

OpenJDK (maintained by Oracle) is GPL, but Oracle JDK is a different codebase with different features under a commercial license. Oracle's OpenJDK builds are distributed under the GPL, like Microsoft's.

You would be right, if you would have made this comment a bit more than a decade ago.

The only remaining differences between OracleJDK and OpenJDK are logo, and trivial things - Oracle has opened up everything else.

As far as I'm aware, Oracle JDK gets fixes that OpenJDK doesn't, and is under a commercial license that's not GPL (even if it's free-as-in-beer under certain circumstances)? Is that wrong?

Oracle provides their builds for free, given you use their latest LTS release. But that’s apples to oranges comparison - that is an actual support release, meant for big enterprises that wants to point their fingers at someone on Christmas eve.

Right. So that’s the minefield, no? If you download from Oracle, it’s like Photoshop from Adobe. If you download from Amazon, it’s like gcc. But it’s the same software: near invisible difference.

So that’s why you shouldn’t download from Oracle.

Are you a huge enterprise system that has to be able to call someone on some national holiday at 2AM? If no, then just do whatever you want - I don’t understand running to Amazon, when you can just do `apt install openjdk`, but whatever. There is way too much fuss around this non-issue. It’s the exact same software plus-minus a few bytes.

Ubuntu LTS does not have modern JDK. Amazon has Coretto distribution. Much better.

There are two main branches of JDKs, OpenJDK and Oracle JDK (both maintained by Oracle).

Builds for the former are open-source but only updated for 6 months after each release, while the latter is under a commercial license with 3+ years commercial long-term support for some versions.

Projects like Eclipse Temurin (Adoptium) bring the LTS to OpenJDK. The underlying code is entirely open-source, so there is no licensing trouble.

Hence, if you want to download OpenJDK, it's important to do it from Adoptium, as you won't get updates on java.net after a while.

Oracle's stance on what contexts their JDK/JRE is free to use in is ... nuanced, and has changed in the past. While I don't wish to spread FUD, the thought of using it in a commercial environment in any fashion would give me pause. Playing around with Oracle on licensing is, as hobbies go, somewhere on my list of things to do down around making plutonium cocktails and alligator juggling.

The other vendors have different (typically more explicitly open) licensing on their shipped artifacts. As ever, if it really matters, it's time to consult a legal professional in your jurisdiction to be sure instead of taking a random internet nerd's opinion on it. ;)

All those vendors offer Oracle software that's licensed to you by Oracle. Amazon, for example, cannot change the license on the Oracle software they're distributing because it's not their software. The Oracle license is a standard open-source license, but if it makes you feel better to download Oracle software with an Oracle license from some other company's website -- go for it.

Technically, the OpenJDK project is independent of Oracle, even though they do sponsor and presently lead it. That source is no more Oracle's than the linux kernel is Red Hat's (in both cases, a large contributor with their own copyrights, contributing to an open project with open license).

The other vendor's shipped artifacts are in turn the work product of those vendors, based on the OpenJDK core. They are not distributing Oracle software, they are distributing artifacts built from the OpenJDK project's software, and their licensing decisions are independent of constraint from Oracle.

The Oracle build of the JDK has not always been isomorphic to those produced based on the OpenJDK code, and has in the past had different license terms that can in no way be characterized as a standard open source license. See, for example, graalvm use in production environments with OracleJDK. Being transparent, this may have changed in the past few years; ever since I left Oracle I've tried to think about their existence as little as possible.

My overall point is that it is wise, based on Oracle's past history, to read and carefully evaluate the license terms for Oracle's software before you use any of it in a commercial context. The strictly-GPLv2-with-classpath-exception-sourced vendor distributions of OpenJDK, not so much as the license is in fact standard and widely used/understood already in both commercial and non-commercial situations.

> Technically, the OpenJDK project is independent of Oracle, even though they do sponsor and presently lead it. That source is no more Oracle's than the linux kernel is Red Hat's (in both cases, a large contributor with their own copyrights, contributing to an open project with open license).

That's not true. Oracle owns the OpenJDK project, much like Google owns Chromium. To contribute to OpenJDK you need to sign a Contributor Agreement granting Oracle shared ownership over your contribution (i.e. you maintain copyright, but Oracle also has copyright); this is standard practice for such open-source projects (like Chromium).

> The Oracle build of the JDK has not always been isomorphic to those produced based on the OpenJDK code,

No. We offer two builds of the OpenJDK JDK, under two different licenses. The open-source one is here: https://jdk.java.net It is an official Oracle build.

The other official Oracle build (called by various names, including Oracle JDK) has a different license, but only diverges from OpenJDK some time after a feature release due to different bugfix backports.

> The strictly-GPLv2-with-classpath-exception-sourced vendor distributions of OpenJDK

Just pointing out that Oracle also distributes the JDK under that very same license (https://jdk.java.net), but we also offer our software through other vendors. It's up to you which website you choose to download our software from.

It is true that https://jdk.java.net/21/ starts with:

> This page provides production-ready open-source builds of the Java Development Kit, version 21, an implementation of the Java SE 21 Platform under the GNU General Public License, version 2, with the Classpath Exception.

> On the other hand, while Linux is developed by various for-profit companies, the code is owned by the Linux Foundation.

This is incorrect. Linux does not require copyright assignment.

The documentation [0] says: "Copyright assignments are not required (or requested) for code contributed to the kernel. All code merged into the mainline kernel retains its original ownership; as a result, the kernel now has thousands of owners."

[0] https://www.kernel.org/doc/html/latest/process/1.Intro.html#...

Sorry, I stand corrected on the Linux Foundation.

From the other website, it’s Oracle software under the GPLv2. From Oracle, it’s under the Oracle Binary Code License for Java (https://www.oracle.com/ca-en/downloads/licenses/binary-code-...). These are NOT the same license. The GPL, for instance, does not allow after-the-fact fees.

Oracle OpenJDK: https://jdk.java.net (GPLv2 + Classpath Exception)

Oracle JDK: https://www.oracle.com/java/technologies/downloads/ (Oracle No-Fee Terms and Conditions)

The license you linked does not apply to current JDK versions at all.

Hmm I think you are not right. If you go to https://jdk.java.net/21/, the first sentence says that it is GPLv2 (+ Classpath exception, whatever that is).

> Classpath exception, whatever that is

GPL is a copyleft license, so if you would take linux kernel (same license), added some patches to it and you would distribute the resulting software, you would have to make sure your sources are available.

This would make Java as a runtime a very bad target for any company - they don’t want to share their application code - hence the classpath exception, giving you basically a boundary over which the copyleft doesn’t propagate over.

But the JVM itself still benefits from any updates made by any company.

> hence the classpath exception, giving you basically a boundary over which the copyleft doesn’t propagate over.

Oooh that makes sense, thanks for clarifying this!

Forgot to add: I am no lawyer, so while I am generally right here based on my previous readings, my knowledge stops at this point as well.

But Oracle can try to lure and deceive you into installing a variant that is affected by more licences than the stuff also available from others.

"But almost all of this would have been available elsewhere under a standard open source licence!" is worth exactly nothing if one day you discover that you failed to stay clear of all their friendly little traps.

It’s not the Caribbean sea with singing sirens.

Java’s reference implementation is OpenJDK, developed mostly by Oracle, and is completely open-source (GPL-2).

One can optionally buy support for it, that’s the whole deal. Not that hard, but apparently this is a minefield for some..

There’s that and there’s https://www.oracle.com/ca-en/downloads/licenses/binary-code-... , where using the wrong runtime flag makes you owe money.

Don't use them commercial features if you don't be want to pay for them. And don't download the Enterprise Oracle JRE from the Oracle website if you don't want to use them commercial features. We all should read terms&conditions more carefully.

Come on, just stop this FUD already.

Oracle is responsible for 95+% of every single commit going to OpenJDK, which has the exact same license and situation as the goddamn linux kernel, GPL2. Do you also sweat a lot about accidentally installing red hat linux? If not, you have zero reason to worry.

How is amazon compiling and repackaging the exact same thing somehow different?

People have been burned too many times by Oracle “true-ups”. And no, it’s not FUD. Their license explicitly states that JEE/SE (not JRE) is covered by their commercial license, not their open source license. This year, in 2023, Oracle introduced the enterprise-wide metric license model. So if you use Java for anything in your organization, they charge you based on your organization size. (All or nothing model).

That licensing would be the Oracle JDK. Not OpenJDK like parent was talking about, which is wholly open-source (supporting SE but not EE) and also maintained by Oracle but without LTS.

See my other comment about Adoptium vs. OpenJDK vs. Oracle JDK: https://news.ycombinator.com/item?id=37571143

Yes, Oracle JDK, the default one you are directed to at oracle.com. Java.net provides OpenJDK.

There is no such thing as a JRE anymore. And even the commercial OracleJDK is free to use (though not libre).

Some people would beg to differ. There are some organizations that have Java desktop apps, some that have kiosks and appliances that run JRE-like environments. There are some that are still on Java 8.

This is what jlink is for.

Oracle's OpenJDK builds are only updated for six months after each release, while Adoptium receives long-term support (like the commercial Oracle JDK).

Even the commercial OracleJDK is free to use, as long as you stay on the latest LTS.

No one offers free long-term support. The free "long-term support" releases merely backport some fixes from the mainline to the old release, so only the intersection between the old version and the newest one is maintained in free distributions. A real LTS service includes original bug fixes. If you want the entire JDK to be maintained you have to either use the current version (completely free) or pay someone for a proper LTS service. The LTS service that Oracle offers is how OpenJDK is funded.

Can't upvote this response enough! Thank you Ron. You corrected my understanding on this a few years ago in a Reddit thread on /r/java. I've tried to convey this response ever since. You are NOT getting an LTS release from anyone outside of Oracle. Others will provide backports and that might be "good enough". If you're not paying for an LTS, you may as well update to each new release (as long as nothing else breaks).

To be fair, a few other companies also have good OpenJDK developers (although not as many as Oracle) and they also offer LTS services that cover the entire JDK, but no one offers one for free.

Yes! the "free" thing being the main difference. Thanks!

My understanding is:

Oracle publishes updates for latest release until the next release.

Then they drop maintenance of that branch, and RedHat picks it up (at least they did for 8, 11 and 17) and keep supporting/backporting fixes, with the help of other vendors and the community.

So when you are using 8/11/17 from RedHat/Adoptium/Corretto/you name it, you are actually using what RedHat provides to its customers as LTS, unless they have some private build, which I seriously doubt.

I wasn't able to find out what exactly Oracle does for their private LTS releases, do they use the public maintenance branch as a base of their private branch? Or do they continue their own private branch independently from what the community maintains? That would mean that the older the branch is (say jdk11u) the more differences there are between Oracle JDK and what you get from RedHat/Adoptium/...

On top of that Amazon provides support for Corretto on AWS, if you are using e.g. EC2 you get it as part of the fees, not exactly free, but cheap, considering you already pay for the VMs.

I appreciate any corrections/clarifications.

> Oracle publishes updates for latest release until the next release.

This is changing every now and again. For example, the Oracle JDK builds for JDK 21 will be offering free updates for three years (https://www.oracle.com/java/technologies/downloads/)

> and keep supporting/backporting fixes, with the help of other vendors and the community. So when you are using 8/11/17 from RedHat/Adoptium/Corretto/you name it, you are actually using what RedHat provides to its customers as LTS, unless they have some private build, which I seriously doubt.

This is where things get complicated, and given that there are all done by companies that fund their Java operations by selling support -- just as Oracle does -- clearly they don't offer their paid service for free. What you get for free is some backports from the mainline, i.e. only the intersection of the old and current JDK is maintained. Now, I believe that Red Hat specifically offers the same builds as they do to customers, that is not what you want if you really care about a fully maintained JDK. And that is for the following reason: If you're stuck on an old version, that probably means you're using some aspect of the JDK that's been removed or else you'd be using a new version. But the only things we remove are things that aren't widely used. This means that the fix you need is probably not the same as one some other customer who is stuck on the old version needs. If you're not a customer, your issue will not be fixed because no one offers original work on old releases for free.

Of course, if your software is heavily maintained, the safest, most secure, and cheapest option is to always use the current version rather than an old one. Once you get used to doing that, it's also the easiest.

Due to the GPL, eventually all commits will find their way into the OpenJDK repos, it is sort of similar to how vulnerabilities are handled — with paid support, you will be the first to get updates. Also, since Oracle does most of the development on the main branch as is, they have deep understanding of those patches - while during backporting it may not be as expertly implemented.

But Oracle also backports commits to older JDKs, e.g. Java 8 is supported for 2030, though that is paid.

The main takeaway is that it is still a singular project where bugfixes definitely, but even most custom features find their way eventually back to mainline (e.g. it was the case that Microsoft made some specific feature for their usecase, that was later merged).

I get what you mean, but given answers here (and other places in this thread) it seems like the licensing is not clear at all.

At least it's not clear to me, I'm still on "Oracle is evil, go as far as you possibly can from them". I would genuinely be happy to be able to confidently say that "this particular project of Oracle is safe for me to use", though.

It’s not clear for people that put their hands over their ears and go LA-LA-LA-LA. Hell, in many places bullshit like that is not even enforceable.

There was a good comment on one similar threads: oracle is thought as this litigious monster because they provide DRM-free, no phoning home solutions to companies. This is very important for these customers, as you just simply can’t shut down a country’s hospital system because Google or whatever managed to falsely flag it as some malware and now you try to grab onto any form of human contact from their support, without success.

But every sufficiently big company is only after money, so to make some form of profit they do have to actually enforce their contracts somehow, here comes the inspection - which sure suck, but there is no other way around it given the previous limitation. And sure, some higher management can easily have fked up and used some feature that was not part of their plan, and they desperately want to cover up their mishandling, and Oracle “kindly” offers them the option to forget about the fee for that plus option, if you subscribe to this other service of ours for X years, we are good; and higher management couldn’t be happier.

That kind of clarification is very useful (at least to me). I honestly don't really know why Oracle "are the bad guys". I just heard it so much that I accepted it.

There is cognitive overhead in even having to consider how Oracle could be licensing anything you download from them. Their licensing has a long history of being complex, expensive, and enforced. Choosing to get software from a less complicated (licensing wise) provider is a valid choice.

The licensing risk of using open source software, that is mostly being written by Oracle, from Amazon is less.

Amazon's open source reputation is that they'll screw over maintainers with their rebranded forks, but not go after users of open source.

According to

https://inside.java/2023/09/19/the-arrival-of-java-21/

Oracle provides roughly 3/4 of the commits and fixed issues. It's a majority, but there are other significant players (always surprised to see SAP higher then Google and Amazon).

Yeah the lack of anyone packaging this up was kinda weird to me. I understand these are done on someone else's dime, and no one owes me a free lunch though.

I don't really pay a lot of attention to Java releases but I was actually excited about this one. No one ran a build process last night in anticipation?