Canonical To Remove Sun Java From Repositories, Users' Machines
New submitter an_orphan writes "Apparently, Oracle's 'Operating System Distributor License for Java' is expired, causing Ubuntu to not only remove sun-java from the partner repository, but from user's machines."
Canonical is the new Apple.
WTF? I'm no fan of Java (we all know the logo is coffee because you have time to get some while your app loads), but this is another challenge for the Linux desktop.
Java was always a huge fuckup of a language, with its balonulous lazily-typed variables and its snordoblulous memory "management" and flubriglated syntax. Only idiots use it, good riddance.
UNITE with the Campaign for a Free Internet because today, our future begins with tomorrow!
To shoot oneself in the foot?! I just don't get it. Wouldn't Oracle want to have their platform deployed as widely as possible? Someone's asleep at the helm. Just like at the media companies. Seems some big corporations these days are like chicken running around headless...
A successful API design takes a mixture of software design and pedagogy.
From the article: "Oracle, in retiring the ‘Operating System Distributor License for Java’, means Canonical no longer have permission to distribute the package." So it's not that Oracle has lost their right to distribute Java (JDK) or something, but they are retiring the license Canonical is using that granted them the right to distribute it with Ubuntu. The summary also states (correctly) that Ubuntu will remove the sun-java package from the repository and user's machines, but does not state why: “Due to the severity of the security risk, Canonical is immediately releasing a security update for the Sun JDK browser plugin which will disable the plugin on all machines.” Ubuntu’s Marc Deslauriers wrote in a mail to the Ubuntu Security Mailing list. “This will mitigate users’ risk from malicious websites exploiting the vulnerable version of the Sun JDK.” Summarizing: there are two things going on here, one is that Oracle has revoked the license Canonical is using to distribute Java (JDK) freely so it will not come with Ubuntu anymore. Java must now be downloaded from Oracle's site. Second: The java jdk package will be removed from user's computers because of severe security holes. Java must now be downloaded from Oracle's site. So, two things, one article and one terrible summary.
This will be a huge problem that I didn't see coming. I wonder what the wide ranging effect will be.
But more importantly I wonder if Canonical will some how notify Ubuntu users, better than this obscure blog post, that Canonical is about to wreak havoc on their systems.
Sensationalist headline is sensationalist.
Ubuntu will still have the OpenJDK, which is maintained in part by Oracle. "Sun Java" refers to a specific JVM installation.
All it takes is someone to pick apart the update, someone else to mirror it a few times and then all the people googleing for "java is broken in Ubuntu" find a modified update that fixes it. anyway, why does a distribution license expiry mean that people who already have copies may no longer use it?
All the while OpenJDK still doesn't work with half of the stuff out there, for example Juniper's SSL VPN.
Great! Java: Compile once, works nowhere.
Let's hope they handle this well (aka a de updater that lets people know what and why it happens).
I am critical about ubuntu usually, and I can almost hear some bearded guy saying: "Told you so, next time learn to build upon Free Software instead". But I think this time they would have rather avoided this and they couldn't.
I dunno, the industry seems to be killing java and flash ahead of time.
---- MISSING MISCELLANEOUS DATA SEGMENT --- [sigdash] trolololol
Seriously, most people knew this would happen if Oracle got their hands on Sun's intellectual property. However, didn't think it would happen so quickly. My only question is, how good are the other alternatives. Pros, and Cons.
Ubuntu uses OpenJDK Java by default. Users have for years had the option to switch out the default OpenJDK Java for an alternative package in the 3rd party repository which is Sun Java. That alternative is being removed. In fact, it has never been available in the latest Oneiric 11.10 release of ubuntu. In the latest release OpenJDK is the default & the only java available from the package repos.
Most people use OpenJDK on Ubuntu and for them this news means nothing.
If you're using an older release (11.04 or earlier) and you have sun-java installed, simply remove the package & install default-jdk. problem solved.
Oh shit! I forgot to click "Post Anonymously"...
Why does Canonical even need a "Operating System Distributor License" for Java? Wasn't Java re-licensed as GPL v2 back in the Sun days? How can they stop anyone from distributing something under the GPL?
Warning: Opinions known to be heavily biased.
Are all Linux user going to have to know manually install *every* update to Oracle's Java then? No offense to the OpenJDK guys but some stuff just doesn't work right with it. If I remember correctly, a lot of the really big performance boost are also only in Oracle's JVM...
I can see how Apple can survive and prosper. They've targeted customers who are either spending somebody else's money (mainly the children of the wealthy living off of "daddy's money" or trust funds), those who are financially foolish (people who buy useless gadgets on credit), and those seeking a modern religion (the so-called Apple fanatics). This has let them put out sub-par products with pretty horrible limitations, but they can still sell them outrageous prices, and coupled with third-world manufacturing it allows them to make a very sizable profit.
Canonical has none of this. While it did put out some useful extensions to the Debian Linux distribution, they just don't seem to have the ongoing financial stranglehold that Apple has acquired. They aren't targeting the children of the wealthy, or those who waste money. Some degree of religious fanaticism has arisen around Ubuntu, but it surely doesn't seem capable of providing the financial support that Apple's religious following does.
Moves like continuing to use GNOME when KDE was clearly the better desktop environment, then later ruining the desktop experience by moving to Unity, and now stuff like this are exactly what will drive users away. Many of the smartest Ubuntu users have moved to Linux Mint. The remaining Ubuntu users seem to be those who aren't smart enough to learn about the alternatives. They don't seem like the kind of people who will pay good money for Ubuntu, either.
Apple's financial strategy seems to be pretty solid, but I just can't see Canonical's at all. How can they survive as a company without financial backing?
Nothing of value was lost. Seriously Java was always an abortion from a security point of view then Oracle got a hold of it and two updates a week later its still a security nightmare. The best thing that could happen is it's end, Java is more like Flash than Flash is now from a security point of view.
Kill java and remove half the attack surface from your systems.
I know people use Ubuntu on server systems as well. I can just imagine production systems falling over because, suddenly, there's no JRE/JDK installed anymore after routine maintenance security upgrades. Sounds like fun.
Gentoo saw the license expiring, and did a proactive thing: flipped the "fetch restriction" flag back on, forcing users to pull it manually and slap it into the right place to install/upgrade.
--
# Canmephians for a better Linux Kernel
$Stalag99{"URL"}="http://stalag99.net";
I have my computers setup the way I want it. That is why I disable automatic updates and selectively update. None of my windows machines are connected to the internet, and I don't have any iOS or android devices.
Reading the license agreements.
Get my Hitchhiker's Guide Tribute Novella From Pirate Bay
http://thepiratebay.org/torrent/6848623/Perfect_Me_By_Jason_Z._Christie
First - I want to see in the license where it requires them to pull it off systems.
Second - What the hell are they going to replace it with? Are they saying you have to download and install Java manually? OpenJDK supposedly doesn't work with all things.
Third - What does this mean for Ubuntu derivatives like Mint? Are they going to have to pull the jdk as well?
Forth - Can we _please_ take up a collection to have the Oracle execs framed for terrorism and shipped off to Gitmo?
Honestly this is just stupid.
"Bah!" - Dogbert
I just checked and i'm showing OpenJDK
with a different water pump. problem solved!!!
other than your car being out of commission for several days, and untold problems being encountered due to the incompatabilities between the old water pump and the new water pump. but whatever.
in the fantasy land of free software, you can replace word with openoffice, exchange with ????, and it wont cost anyone anything!
Gaah it's like being on Windows again, having to check every single package to make sure it's up to date or deal with their own specific stupid updaters. There's a reason we have apt, why does it have to break? This isn't earning Oracle any love in my book right now.
First, it doesn't but it prevents the distribution of security fixes, leaving systems where it is still installed vulnerable to publicly available exploits. Second nothing, you'll have to manage updates by yourself if you want the Sun JVK. Third, not certain, but likely. Fourth, no.
On Noes!
How will I get my Minecraft fix now!
Fuck it, there goes our 4 month Ubuntu workstation trial down the drain. We have Java crap which only works with Sun Java.
I want to see them try that with my live disk!
I have encountered numerous problems in recent years with Java code that simply doesn't work on IcedTea. It's not doing anything clever or undocumented. It runs fine on Windows, on MacOS, and on the same Linux boxes but with a different Java run-time. On some of these projects, we had so many problems that we explicitly no longer support IcedTea and won't even consider support requests from customers who insist on using it.
I don't know about any other JREs based on OpenJDK, but IcedTea is so bug-ridden as to be unusable, and has been for a long time.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
No, Sun JDK is not being removed from users' computers, only the browser plugin is disabled, which is riddled with security flaws that are only corrected in newer versions that cannot be distributed by Canonical.
And no, removing the package from the repositories does not remove it from the system when already installed.
I work in a Java shop. We run Sun Java 6 on a mix of Solaris and Ubuntu. I'll be handrolling a deb from the Sun Java tarball precisely because not everything can be trusted to work identically between Sun Java 6 and OpenJDK 6.
We just recently hit a weird bug which turned out to be a "how did that ever work?" moment - revolving around different implementation-specific behaviours in Sun Java 6u24 for Solaris SPARC and Sun Java 6u26 for Linux.
We'll be moving to OpenJDK, but only after thorough testing. OpenJDK 6 is a proper Java, but we've discovered the hard way not to make any such move without thorough testing. Because programmers are human and bugs happen. Never trust, always verify.
http://rocknerd.co.uk
Canonical has breached their trust with me. I am in the process of building a new PC - I will definitely not be installing Ubuntu this time. I am very shocked and very angry at this action from a company that is supposed to be upholding the principles of free software and computer freedom.
I did not give them permission to remove software that I have installed. I only signed up for updates, not crippling of functionality at the whim of some pencil-pushing dweeb at Canonical HQ.
This sort of behavior should result in an automatic death penalty - collective deinstallation of their OSes everywhere and refusal to recommend it to others.
Go ahead steak my java rotten scumbag globalist thief I don't use it anyway. But try to remove the Sun and it's WAR!
Does this also mean that the sun-javaX-fonts (where X is the version) package won't be supported, which has the Lucida TrueType fonts. I rely on Lucida Sans Typewriter from this package
I just did a synaptic update and it in fact upgraded sun-java6-jre and jdk, to 6.26-2lucid1.
I'm sorry, but, why do people use java? it's a pain, from every point of view.
I was fighting with my release of ubuntu last week because of this. In summary, a coworker's machine is set up properly and seems to magically work.
I had a different experience that ultimately prevents me from having to use a windows machine for server work when I get assigned on call days. Spent two weeks getting refusals and windows-only auto-downloads from the VPN-starting website under my OpenJDK. Clicked around until an alternative page stated the lie that only red hat and open suse worked. Found the version number that they required, which is secifically older than what The current Ubuntu will inject your machine with, so extra downloads directly from Oracle were required to continue testing. Had issues just removing the Open JDK via the default Ubuntu Control Center in part because of current dependencies that required complex Synaptic interaction, and then needed to manually force the .so link to point to the new JRE after manual extraction into a dubious location due to the lack of an installer.
After all the work to pass a single test of getting the right version for my 64 bit OS, all I got was a cryptic failure icon that brought up a debug console starting that I had a bad magic number. The web later pointed me to scripts that claimed to get around this but there were ambiguous confirmations on the forums. I reckoned to have started out with an OS that isn't in the official support list anyway and just decided to defer to the windows empire and lug the dedicated work laptop home. To sum up, Network Connect from Juniper should have better Linux documentation and support and Ubuntu should have better Java support.
Ah Java - how many times have our PCs and Servers been compromised because of the numerous security bugs.
And the code? Write once, fucked everywhere.
Remember : if Java had real garbage collection, it would delete all the crap that spewed from so-called 'java developers' , dump VM, and then delete itself.
Oracle's Purpose is to make big dollar for Mr Ellison, Shareholders and employees. The JVM does the opposite: It reduces their profit.
I knew Mr Ellison would do that.
Maybe, Ca-hey-nonny-nonny-ical got fed up polishing and packaging that great steamer called 'Java'.
If you can't understand C++, then go work as a shelf-stacker, burger flipper. Don't pretend you can program by getting away with it using Java.
Automatic Updates are being forced. One of the new updates I saw the other day, UNATTENDED UPDATES.
I can understand pulling it from the repositories for future installs, but from a user that installed it while the license was still in effect? Really uncool.
Aside from pissing people off in general, just think of all the production servers they may kill by doing this. And the lost customers, time, money..
---- Booth was a patriot ----
i wonder if the users of Ubuntu / Linux can still download a Java Development kit from www.javasoft.com. Or maybe they can use OpenJDK instead.
dunno about this. .....gawd...loathe to say it..."Oracle" Java and by removing OpenJDK.
I ran into an issue lately that only happens with OpenJDK (specifically OpenJDK's implementation of Java Webstart) which was only remedied by installing
Checking the article shows that Ubuntu’s Marc Deslauriers is behind Canonical/Ubuntu actions. Oracle's actions regarding the JDK have been known, planned, and widely distributed.
I would advise Ubuntu users to ignore Ubuntu’s Marc Deslauriers' Ubuntu update for JDK. Seems that Mr Deslauriers has convolved OpenJDK, which Ubuntu users have been able to install for some time now, with JavaJDK (Sun) into a security problem with thoughts of "security holes". Kinda like "bad time for a whore to get religion".
Since Ubuntu, like any other GNU Linux distrobution can be costumized as users desire, Ubuntu’s Marc Deslauriers' planned actions constitute a deliberate act of cracking/hacking computer systems, which he does not own, with malicious intent.
...seriously, get rid of Java and stop encouraging people to use it. Replace it with what you ask? Anything. Everytime I visit a website that uses Java on the backend I can certainly tell I'm on a Java website because it is slow as fuck.
It seems like the flashplugin-installer Ubuntu package doesn't include the actual flash bits themselves, but rather contains a script named flashplugin-installer which goes and download the flash bits directly off Adobe's website, and installs the .so in the correct place, sets up symlinks, etc.
Now the question is: Can the new Java license permit this kind of mechanism? If so, that could be a workaround.
First - I want to see in the license where it requires them to pull it
off systems.
This was followable via the links in the original article.
Oracle has ended the DLJ, the "Distributor License for Java".
http://jdk-distros.java.net/
http://robilad.livejournal.com/90792.html
Second - What the hell are they going to replace it with? Are they saying
you have to download and install Java manually? OpenJDK
supposedly doesn't work with all things.
That's true; there are certain known issues with OpenJDK and basically Oracle is saying "it'll just have to do".
Third - What does this mean for Ubuntu derivatives like Mint? Are they
going to have to pull the jdk as well?
Yes, and that's exactly what's been happening, because there's no other choice.
What I don't understand is why Canonical doesn't do for Java what SuSE did for the NVidia drivers (I don't know if Ubuntu does or did the same; I've never used Ubuntu on an NVidia system): Make a package which does not contain the actual code, but an installer which downloads it from the official web site and installs it. That way you both obey the license (download to install only from original source web page) and give the benefits of package management.
The Tao of math: The numbers you can count are not the real numbers.
Along with Firefox and Gnome3's so Ubuntu would be usable again.
Too late, I'm already posting this from Windows 7 and Chrome.
They have to because the current package is vulnerable to remote code execution and they aren't allowed to distribute the fix.
If OpenJDK is becoming the official Oracle-blessed distribution, then why not put out a final release of empty sun-java6-* that depends on OpenJDK, so that the package is transitioned over on next restart (or sooner)?
C is the most portable language.
This may be true, but just because a language is portable doesn't mean that the facilities provided by the language alone meet one's needs. The input and output facilities specified in the C99 standard consist solely of stdin, stdout, stderr, and a file system without directories and without a way to enumerate files. Because this is not sufficient for mobile, workstation, or server tasks, C runtime environments extend this with POSIX+X11 or nonstandard extensions or both. Microsoft refuses to implement POSIX+X11 as a standard feature in its operating systems, having left SUA to rot.
And people complain about how Apple, Google, and in the future Microsoft can remotely kill apps. Why no outrage at Canonical?
Java is no longer "the future," and never fully realized that prediction anyway. Java is dead. Java has been dead for a few years now. Yes, massive amounts of Java code doing things out there, but it doesn't matter. Anything that Java can do, just about everything else does much better.
There are two ways around this in Ubuntu 11.10 (and, I'm assuming, derivative distributions). One way is to install from a PPA (that's the most likely answer you'll get if you search for a remedy online). I don't really like that idea, so I sat down today, did some research, and figured out how to install the latest version (1.6.0-30) directly from the Oracle website. It is not a trivial process, if you are a relative amateur like I am. Why does an amateur like me care? Because a very common mathematics learning software (ALEKS) requires Sun Java to run. I teach using this software, and although I could run a VM to access their system, I'd rather not. If anyone cares, here's what to do, after you download the appropriate .bin file from Oracle:
./jre-6u30-linux-x64.bin /opt/java /opt/java/64 /opt/java/64/jre1.6.0_30 /opt/java/64/jre1.6.0_30/bin/java /usr/lib/mozilla/plugins /opt/java/64/jre1.6.0_30/lib/amd64/libnpjp2.so
chmod +x jre-6u30-linux-x64.bin
sudo mkdir
sudo mkdir
sudo mv jre1.6.0_30/
sudo update-alternatives --install "/usr/bin/java" "java" "/opt/java/64/jre1.6.0_30/bin/java" 1
sudo update-alternatives --set java
cd
sudo ln -s
PS I'm sure there's a better way to do this, but it worked. I pieced this together off of the web - none of it is original.
I received a message a few months ago from Gentoo that Oracle had changed their licensing back to a distribution unfriendly version. Gentoo turned on the fetch restriction switch and gave me a link to download the needed files. I followed the link and read their new license only to discover that it forbade installing Java on Netbooks and cell phones. Three of the computers I maintain are Netbooks. I opted to skip updating Java until I learned more. Then life happened and I stopped paying attention to Java.
Today, I see this headline and I follow it to see what is going on. The comments seem to fall into two groups, Windows fan boys and OpenJDK discussion. OpenJDK is new to me and useful information. I've never heard of it before. Unfortunately, "emerge -s jdk" doesn't show an OpenJDK. I'll have to research it more. Perhaps it has a different name in Portage?
I originally installed Sun's JDK because my bank said I needed Sun's specific implementation to access my account on-line. I also worked for a company at the time that insisted that any data you wanted to capture needed to have an application coded in Java. I had played around with the idea of learning the language for work. That was given up when I figured out that any application I wrote wouldn't be approved for work use. I just did what most people did there, keep the data in Excel and away from the databases. It was that, or wait for the Dev team's multi-year backlog to clear.
I'll have to see what I can learn about OpenJDK and see if it covers my banking needs...
Request a Linux Shockwave player here: http://www.macromedia.com/support/email/wishform/
I like to see the fire and the energy swirling around Linux and Java in this discussion. My brother uses Mac's exclusively, because he works in the movies using Pro Tools -- and even if Pro Tools worked on Linux, he is committed and says "Apple operates by capitalizing on a lifestyle... How could the open source community match Apple, who has untold engineers, paid, working to make Mac's easy to use, and powerful?" Mac's seem a bit pricey to me. I've heard the OS is based on a *nix (FreeBSD). Also, their hardware supposedly works well because being the proprietary corporation for the hardware and software, Apple can dominate its suppliers and configurations, and say, "We want a battery that will last seven hours" or whatnot. All praise to Apple for making a good product that is derived from *nix..! However, their anti-competitive legal behavior with regard to Android disturbs me... Don't be evil..! A tablet is a generic category of nature..! You think _YOU_ invented a flat computer, or that only you have the right to make them?? Insane..! Linux, however, is the wave of the Future Earth... Google runs on it, as do the FBI and the National Security Agency (Security Enhanced Linux).. This guy Salus wrote a history of open source -- http://www.groklaw.net/staticpages/index.php?page=20051013231901859 I think it is fascinating. My parents bought a Win7 laptop, which got fried by a virus within weeks of powering up. I convinced them to let me install Ubuntu. My Dad liked it fairly well, but he's a big iTunes user, so eventually my brother was convinced to give them one of his old Mac laptops. Now Dad can run iTunes, look at the super-slick Mac interface, and be reasonably certain that he might not get killed by another virus. Any suggestions on what I should do with the extra Linux box? Maybe bring it to my apartment, and experiment with using it as a firewall...(Oh, doesn't a firewall require two network interfaces? I don't think the little Toshiba lappy thought of that yet..) IPTables, packet mangling, Network Address Translation anyone? My XP box (Windows XP Media Center Edition) has an odd habit of complaining loudly that no firewall is turned on, but ironically it doesn't let me turn it on for long. I live in fear that my big box will get fried. I run Avast AV and do boot-time scans kind of frequently, and I am really reluctant to visit URL's I don't know. My Ubuntu lappy is my pride and joy. I always install all the updates as soon as possible. How could _I_ second-guess Canonical? This is what they do for a living, this is their profession. I am simply a user. Although I know how to program, and Java is my favorite language. I figure Oracle or whoever will work out a way to make Java work cross platform. That was Java's promise, wasn't it? A Virtual Machine running on a bunch of different OS's -- which your Java code would ride barebacked on and always work..! It disturbs me to hear shit talked on Java. I have a lot of study invested in it. What is the alternative? Well, Linux for instance is written in C.. Maybe if I ever decide to develop software, I could bite the bullet and do the menial labor of compiling it differently for each OS.. Or -- I don't give a shit about Windows or Mac OS -- why not simply go full force, full Linux -- and stop developing anything for any other OS?
David C. Baird theunspokenyes.com
If Ubuntu’s Marc Deslauriers is intent on destroying Ubuntus users computers then Ubuntu’s Marc Deslauriers must be welcome to be removed from existance and life.
I can't figure out why nobody has yet done the:
"We are altering the agreement. Pray we do not alter it further"
meme.
Oh, yeah, that's right, it outdated. Silly me :-)
It's there, install 10.04 and run Update Manager along with checking for the lastest updates. Do not allow it to update while it installs. I don't remember if it asks to download updates during installation. But you'll see the unattended updates package in the upgrades. The only two packages that need upgrades are kernel and firefox. This crap is out of hand.
I agreed to the deployment of timely security and software updates, not to the arbitrary removal and resulting breakage of my systems. If Canonical proceeds with removing the sun-java packages from my machine instead of merely removing them from their distribution repositories, I'll be removing Canonical and going with a distro that understands the importance of not breaking user's machines.
However, I seriously doubt either Oracle or Ubuntu would be so stupid as to break production systems around the world in such a fashion.
I don't blame Oracle for dropping Canonical's distribution. Historically they've always provided their own installers. But they really need to start providing .deb installers as well as .rpm. Using "alien" may work, but it's rather distasteful for production systems to do so. Application and server producers don't want to be in the business of packaging software for installation. And Oracle should really reconsider the benefits of having an automatic distribution engine like Ubuntu's repositories, or start up their own repository server that can be trivially added to the set that Ubuntu queries every time it runs, the same way you can add repositories to Eclipse.
I do not fail; I succeed at finding out what does not work.
While most may think it's 6 of one or half-dozen of the other, it's really not. I have yet to have an app that worked correctly with OpenJDK. In each case, Sun's JDK was the fix to get the app working. If you doubt this, try running Minecraft with OpenJDK. It doesn't work.
Can anyone explain why Canonical would 'pull' the app from systems where it was already distributed? It appears that the distribution license is for the ability to continue distributing but wouldn't affect systems that have previously been distributed to.
This business with Canonical pulling the app from working systems is a bit too much like Microsoft's behavior for my liking. Looks like it might be time to switch up which distribution I use if this becomes standard procedure for them.
Grammar Nazi here:
U might like your Forth with an U instead of going forth to do battle against my Army of the Undead.
Signing off to go find Hitler in the Hinterlands.