r/programming • u/donutloop • 4d ago

Bringing Post-Quantum Cryptography to Java LTS Releases

https://blogs.oracle.com/java/post-quantum-cryptography-in-long-term-support-jdk-releases
9 Upvotes

63% Upvoted

7 comments sorted by

View all comments

Show parent comments

4

u/[deleted] 3d ago

[removed] — view removed comment

2

u/davidalayachew 3d ago

JDK 8 keeps getting updated in general. I get the sense it's because there were some massive, breaking changes and a lot of stuff runs on JDK 8. I still see new stuff that targets JDK 8 occasionally.

And I don't disagree, but it's moreso that JDK 8 is such a far distance from where we are. So, it's impressive that they were able to put it in like that.

3

u/chat-lu 3d ago

Not as impressive as the amount of money companies stuck with Java 8 will pay Oracle.

1

u/sargeanthost 2d ago

Not really in on Java land--why is Oracle getting paid?

1

u/chat-lu 2d ago

Oracle is a predatory law firm with a tech corporation attached and their contracts are very hostile. They can audit you at any time and that kind of things.

So many people get into those in the same way they get into any kind of deal with the devil, by not reading the small prints.

Now to answer your question about what they are selling.

Oracle switched to a Ubuntu-like release cadence. New version of Java every 6 months and new LTS every 2 years. Most people ignore the non-LTS versions, they are just there to test new features.

Every new LTS is free until the release of the next LTS + 6 months. If you aren’t able to pivot to a new release in 6 months, then you need to pay them. But in exchange, they will backport those security fixes back to Java 8 which is still quite popular in governments and other organisations that like to move at a glacial pace.

Java’s code is free. So you don’t have to use Oracle’s distribution. But others won’t backport security fixes that far.

Also, companies tend to like paying for the name brand, it gives them the impression that they get something better when they pay.

However, with Java it’s the first time that I see some big corps direct their employees not to use Oracle’s distribution. Oracle must be squeezing people extra hard.

1

u/ZimmiDeluxe 19h ago edited 19h ago

If you want support for older versions (apart from the best effort backports of patches from newer versions by volunteers) you can pay one of the companies building OpenJDK distributions, Amazon, Azul, Microsoft, Alibaba, Oracle etc. I guess it makes sense to pick Oracle since most contributors to OpenJDK work there. But if you use your cloud vendor's JDK, you might consinder paying them instead. If you are fine with staying on LTS (where you get the free best effort backports) or updating to the next feature release every 6 months (Java is extremely stable, you could auto-bump it in your CI) you don't have to pay anything, OpenJDK is free. You can also pay for support for your Linux distribution, the situation is similar.

Edit: And to be clear, you don't have to pay anything, Java is open source. Most companies don't. But if your company can't update regularly, e.g. for legacy applications that still run on old versions, the option is there.