Java To Be Removed from Ubuntu, Uninstalled from User Machines

By , Published December 18, 2011

Oracle’s Sun Java JDK packages are to be removed from the Ubuntu partner repositories and disabled on users systems.

Oracle, in retiring the ‘Operating System Distributor License for Java’, means Canonical no longer have permission to distribute the package.

The change will affect Ubuntu 10.04 LTs, Ubuntu 10.10 and 11.04 users only.

Users who have the ‘sun-java-6′ package installed on their system will see it removed via a future software update – the exact date of which is ‘TBD’.

Anyone requiring the software will need to switch to open-source alternatives (many of which are readily available in the Ubuntu Software Centre) or by manually installing the Java packages available through the Oracle web site.

OpenJDK – Succeeding Java

OpenJDK – which until now has been the open-source alternatives to Java – will now become the official implementation of Java. Oracle themselves will be using OpenJDK as the basis for their own future releases.

Security Risk Update

The expiration of license coincides with a number of security issues present in the version of Java available through the Ubuntu partner repositories.

“Due to the severity of the security risk, Canonical is immediately releasing a security update for the Sun JDK browser plugin which will disable the plugin on all machines.” Ubuntu’s Marc Deslauriers wrote in a mail to the Ubuntu Security Mailing list.

“This will mitigate users’ risk from malicious websites exploiting the vulnerable version of the Sun JDK.”

Thanks to Erik Nasaroff

Related posts:

  1. MeMenu now displays full user name in Natty
  2. Father of Social Networking worms comes to Linux and Mac OS X via Java
  3. GIMP To Be Removed From Lucid; F-Spot Has Challengers
Trackbacks are closed, but you can post a comment.
  • Samuel Orr
    • Anonymous

      Pretty sure it’s removed from every distro.

  • Sebastiaan Franken

    Such a shame, Oracle is really killing itself like this. They’re just way to greedy..

    • Anonymous

      It’s not Oracle being greedy, but acknowledging OpenJDK. Oracles Java runtimes will be based on OpenJDK starting with version 7. That’s the very reason they retired license.

      • Anonymous

        O_o Really? So no more closed source java?

        • Anonymous

          Like I said, Oracle Java – the closed-source one – will be based on OpenJDK starting with version 7.

          • http://alaukik.myopenid.com/ Alaukik

            source?

          • Anonymous

            Sorry, I don’t remember. It was mentioned a blog post from one of the Oracle guys announcing the license being retired.

          • Anonymous
      • Anonymous

        And by that they think there is no use for Sun java for linux any longer or what?

        • Anonymous

          What do you mean? Oracle Java for Linux is still available form their website. The only difference is that Oracle Java will no longer be packaged and available on Linux repositories.

          • Samik Ganguly

            like Opensolaris and Solaris and the previous one discontinued?

          • Anonymous

            I’m not quite familiar with the OpenSolaris and Solaris situation,

          • Anonymous

            No, it’s the other way around this time. Oracle is using OpenJDK instead of their own Java implementation for version 7.

            This is actually good news. The only problem is that they pulled Oracle Java 6 from distributions[1] before  Oracle Java 7 is widely used.

            [1] It’s only being pulled from distributions. It’s still available for download from their website: http://java.com/en/download/manual.jsp

          • http://pulse.yahoo.com/_TOAP2YXEUL6HBNSCRICYVVMKSY Teg

            For those curious about OpenSolaris: https://en.wikipedia.org/wiki/OpenIndiana

          • Anonymous

            I mean, because sun java is now going to be (or already is?) based upon OpenJDK, they don’t need to package their own java version for linux because there will be no reason to use it over openJDK?

            Or what did you mean by
            “It’s not Oracle being greedy, but acknowledging OpenJDK.”

          • Anonymous

            Basically there is no reason to use Oracle Java over OpenJDK, but the Oracle employee who explained the retirement of license claims that Oracle JDK is “more thoroughly tested”.

            Ref. http://robilad.livejournal.com/90792.html

          • Anonymous

            I know of a reason, I use zoneminder on 64-bit.
            For some reason to get the cameras working you need to use a piece of software called cambazola, and that only works with oracle java.

      • Anonymous

        this is good news then openJDK FTW !!1

        • Anonymous

          Yea, it sounds good but it also seems premature. There are incompatibilities between the open source and binary forms.

          They’re already moving to the gpl w/ version 7.. didn’t think they’d just dump their binary version 6 that most java apps rely on.

          • Anonymous

            How do you mean? JDK 7u2 is perfectly binary compatible with sun-java6.

          • Dan Netwalker

            Why, then try and play Minecraft with that. Tell me later how perfectly binary compatible it is…

      • http://www.paulgraydon.co.uk Twirrim

        Yes, but it’s irritating for those of us who use Java 6.  Version 7 isn’t there yet, note Oracle as still advising desktop users to rely on 6u30 (
        http://www.java.com/en/download/manual.jsp ), and there are no desktop releases yet for it.

        OpenJDK 6 is not 100% compatible with Java 6 (it breaks most of our java 6 webapps we have in very interesting, and difficult to fix, ways), so a switch to OpenJDK for some folks is likely to result in software they rely on no longer functioning.  It’s not Canonical’s fault and I don’t blame them for their actions; it’s just Oracle being its usual self and screwing things up.

        • http://jeremy.bicha.net/ Jeremy Bicha

          If you want Java 7, you can get it from http://www.oracle.com/technetwork/java/javase/downloads/index.html but you’re correct: Oracle recommends most people stay with Java 6 for a bit longer.

          • http://twitter.com/g_saab Georges Saab

            Actually, Oracle recommends that developers move to Java 7, consumers are still pointed to Java 6 for now

    • Van Long Pham Cong

      Oracle could have been a 2nd Google… what a pity

      • http://androidism.org Anuj More

        They could have been the first Google.
        They have existed since quite some time (before Google)

    • http://twitter.com/iyumgeek Geeky Geek

      I used to be greedy like Oracle … then i took an arrow in the knee

      • http://yourethemannowdog.com Shasta McShasta

        *sigh*

      • http://twitter.com/rodcapaz Rodrigo Martins

        Skyrim…

        • http://www.tux-crazy.com Tux Crazy

          AH! Thank you. I finally understand this “arrow to the knee” nonsense.

          • http://twitter.com/jordanbadangayo jordan badangayon

            kindly explain please.. i don’t get it… :)

          • http://www.tux-crazy.com Tux Crazy

            It’s to do with the upcoming game “Skyrim”

          • Bjørn Madsen

            One of the standard phrases by guards in Skyrim as you walk by is “I used to be an adventurer like you, but then I took and arrow to the knee.”

          • Anonymous

            Skyrim isn’t upcoming, it’s been out for months.

      • Aidan Sheridan

        I used to take arrows to the knee like you… then I took an arrow to the knee

        • http://profiles.google.com/erick.bergamini Erick Bergamini

          Hey, bro, I herd you like arows in the knee…

          • Santiago Burgos

            Yo Dawg i heard you like arrows in the knee, so i put an arrow to your bow so you can shot an arrow to the knee

            Sorry dude, i couldn’t resist and i wanna try :D:D:D

  • http://tomslominski.net/ Tom Slominski

    What a joke :/

  • http://profiles.google.com/lilianftp Moraru Lilian

    If I need java I always install openjdk anyway…

    • Anonymous

      Doesn’t ubuntu come preloaded with openJDK?

      • Anonymous

        Yes, it does.

        • Anonymous

          No, it does not. Go try a live CD/USB right now if you think otherwise.

          • http://twitter.com/MotionShot Heimen Stoffels

            It was installed on the Live CD 11.10 64-bit that I downloaded and installed 2 weeks ago (yes, I had to reinstall).

          • Anonymous

            Did you format your HDD? Packing all of Java on the CD would make it go way beyond the storage limit.

            Ref. http://packages.ubuntu.com/oneiric/ubuntu-desktop

        • Anonymous

          I thought it does, but it doesn’t. It’s setup as a dependency on all things that require java I think.

      • Anonymous

        Non.

      • Rodislav Moldovan

        it’s available in repositories, but not installed by default, and if you install ubuntu-restricted-extras it will be installed 

  • http://twitter.com/dagenham_dean Dean Westray

    Are these security risks also affect OpenJDK?

    • http://kyoushuu.users.sourceforge.net Arnel A. Borja

      Seems not.

  • Anonymous

    But what are they going to do to inform the users? Users won’t know what hit them when Java suddenly stops working. And, as far as I’m aware, there is no official status sort of page for Ubuntu.

    • http://www.op-ezy.co.uk/~ian/ Dave

      It shouldn’t be too difficult for the updater to uninstall the Oracle one and install the open one in one update. Users will probably not even notice the change.

      • Anonymous

        Sure it won’t be difficult, but as far as I remember, the original announcement in the mailing list did not mention anything about installing OpenJDK.

  • Anonymous

    OpenJDK is default and won’t be removed, right?

    • Bilal Akhtar

      Correct.

    • Anonymous

      It’s not default for anything though.

      • Anonymous

        Yeah, I had to check. It’s funny because I use it all the time – I just didn’t bother to check how is it set up in Ubuntu – apparently you have to install it. :) I had to do it one time and forgot about it. :)

  • https://wiki.ubuntu.com/ActionParsnip ActionParsnip

    Not hard to install. I have a script to install Java 1.7 here :)
    wget http://download.oracle.com/otn-pub/java/jdk/7/jdk-7-linux-i586.tar.gzsudo apt-get -y install unpunp ./jdk-7-linux-i586.tar.gzrm ./jdk-7-linux-i586.tar.gzsudo mkdir /usr/lib/jvmcd /usr/lib/jvmsudo mv ./jdk1.7.0 .tar zxvf ./jdk-7-linux-i586.tar.gzrm ./jre-7u1-linux-i586.tar.gzsudo update-alternatives –install /usr/bin/java java /usr/lib/jvm/jdk1.7.0/bin/java 71sudo update-alternatives –config javacd /usr/lib/chromium-browser/pluginssudo ln -s /usr/lib/jvm/jdk1.7.0/lib/i386/libnpjp2.so .

    • https://wiki.ubuntu.com/ActionParsnip ActionParsnip

      Link to the file needs updating, but you get the idea

  • http://twitter.com/jackfifield Jack Fifield

    So wait.. will we still have OpenJDK? Besides, if people want to, they can install it from the official site, like it says in the article. I think the software update should install OpenJDK if it’s been uninstalled, aswell as removing Java, so as to save confusion for people who don’t know what’s happened

    • http://dismaldenizen.wordpress.com dismal_denizen

      The problem with silently replacing Oracle Java with OpenJDK is that it could easily break applications and leave end users very, very confused. There is a reason why people used the official version of Java in the first place :)

  • http://www.icedrake.co.cc Icedrake

    Lol, and OpenJDK doesn’t even work correctly with everything yet.

    • Anonymous

      It works with Minecraft, that’s enough for most users.

      • Zombifier

        MINECRAFT!
        Agreed, if it works with Minecraft, then it will work.

      • http://twitter.com/strycore Mathieu Comandon

        That’s misleading. OpenJDK works with pretty much every java program you can think of.

        • http://newstechnica.com David Gerard

          I work in a Java shop. We run Ubuntu. I’ll be handrolling a deb from the Sun Java tarball precisely because not everything works identically between Sun Java 6 and OpenJDK 6. We’ll be moving to OpenJDK, but only after thorough testing.

          OpenJDK 6 is a proper Java, but we’ve discovered the hard way not to make *any* such move without thorough testing. Never trust, always verify.

          • http://twitter.com/strycore Mathieu Comandon

            Well if it’s OpenJDK6, it’s different. OpenJDK 6 is not the official Java VM and is not as powerful as sun-java6. Of course the switch from Sun Java 6 to OpenJDK 7 will require testing, but that’s always the case when upgrading software (and it would have been the same if you wanted to switch from Sun Java 6 to Oracle Java 7).

          • http://newstechnica.com David Gerard

            Yep. Never trust, always verify!

        • Anonymous

          Try foto.com… doesn’t work with OpenJDK

          • Anonymous

            I’ve just tested it and it does work.
            Something which is not working well sometimes is the java plugin under google chrome… But on firefox, I’ve just tested that site and, at least the uploader works ok.

          • Anonymous

            Great :-) (for foto.com at least). I had a serious discussion with their helpdesk a couple of months ago, when it did not work. They actually might have listened to what I had to say :-p

          • Anonymous

            Wanted to let you know, I tested it myself, and it did not work. I don’t know why it differs. Perhaps the Belgian version works differently, though it would be strange to have a different java app for different countries.  I had to install the oracle plugin. The Icedtea plugin did not work at all.

          • Anonymous

            Somehow I can’t reply your last comment (maybe too many levels), but I’m attaching the screenshot of the foto.com uploader using OpenJDK / IcedTea plugin…
            Which Ubuntu version are you using?
            The one in 11.10 works ok. I did have some issues with OpenJDK included in previous Ubuntu versions…

          • Anonymous

            Running 11.10 too, 64 bit, doesn’t work here with icedtea plugin, only with oracle java plugin. Trust me, I really tried… several times

        • http://twitter.com/PunkCapitalist GG

          False. The other day I tried running another game (the only time ever I had to CARE about java) and I runned into the OpenJDK-won’t-be-enough issue (I think it was the roguelike JADE, but can’t really remember)…

          • Anonymous

            I could never get JADE working with OpenJDK, so I think you are right.

        • http://twitter.com/MotionShot Heimen Stoffels

          Try Yahoo Chess then. Won’t work with openJDK. And there are more websites/apps that don’t work correctly with OpenJDK. So don’t call anything “misleading”. A lot of people complain about incompatibilty with OpenJDK. If everything works so perfect, then why all those complaints and bugs?

        • Georges Kesseler

           My webbanking does not work, even no webbanking in whole Luxembourg does work with openJDK as all banks use the same luxtrust CA system.

    • http://twitter.com/strycore Mathieu Comandon

      That statement clearly shows you haven’t tried OpenJDK this year.  Name one single piece of software that doesn’t work with OpenJDK 7. At least I know you won’t be saying Eclipse, Solr, Hudson and Minecraft because I use all of them almost daily and they work perfectly well.

      • http://www.icedrake.co.cc Icedrake

        Sweet Home 3D: http://tinyurl.com/84abynf

        • http://twitter.com/strycore Mathieu Comandon

          Sweet Home 3D runs fine here.
          I noticed that the link you posted mentions OpenJDK 6. The one that works well is OpenJDK 7, not 6.
          When I was using Java 6, I was still using Sun’s VM because it was better.

          • http://twitter.com/MotionShot Heimen Stoffels

            It’s fine that you test OpenJDK 7, but it’s not out yet (stable I mean). So it doesn’t make any sense to wash away all problems as most people are still using the stable 6.

          • Anonymous

            You can install both.

        • http://twitter.com/icalper Ivan Calderon Perez

          Works on OpenJDK IcedTea 7
          BTW, im running Arch ;)

      • http://newstechnica.com David Gerard

        People were naming quite a few on the Slashdot thread: http://developers.slashdot.org/story/11/12/18/1425230/canonical-to-remove-sun-java-from-repositories-users-machines

        The problem is that proprietary software is generally badly-written rubbish, well below the typical quality of open source (and many studies have shown this). However, many companies still run proprietary software, and being terrible rubbish with no peer-review it’s often only certified against specific versions of Java and will actually break with any other version. Heck, one package we’re stuck with was only certified against Sun Java 6 a few months ago, and Java 5 was EOLed end 2009!

        tl;dr proprietary software, being terrible, can be very platform-specific

      • Robert Ross

        FYI, for starters.  The last time I checked, OpenJDK is installed without any certificate authorities.  This makes working with SSL a PITA.  Sun/Oracle JDK has a base set of certauth built-in.

        • https://launchpad.net/~cxl Chen Xiao-Long

          I thought that was what the ‘ca-certificates-java’ package was for.

      • Topias Virta

        Big Finnish bank Sampo Pankki requires java plugin for ebank and it doesn’t work with OpenJDK 6. I haven’t tried OpenJDK 7 becouse there is no browser plugin in Ubuntu’s repositories.

    • Anonymous
    • Subhadip Ghosh

      I have been using Open JDK for quite long and haven’t faced any problem since. I always look for open source alternatives if there’s an easy option.

    • Anonymous

      I was using OpenJDK not even knowing (I didn’t check what Java is installed, just used it), didn’t have any problems.

  • http://twitter.com/hiwaypilot Hiwaypilot

    Guess it’s back to Window$ and Apple O$.  I thought we were past the days of manual installs and terminal screen configurations.  So long Linux desktop.

    • http://twitter.com/natrixgli natrixgli

      Nice troll. Java has to be manually installed on Windows, too. And if you get a new Mac, you will promptly do eleventy billion updates before it works.

    • http://zifre.myopenid.com/ Zifre

      Good job making very little sense…

    • Anonymous

      The title of this article is very misleading. There will be Java available for Ubuntu still, in the form of OpenJDK, which is nearly identical to Oracle’s implementation.

    • Zombifier

      Wow bad troll is bad.
      *claps hand

    • http://www.icedrake.co.cc Icedrake

      You make me sad.

    • Anonymous

      What do you mean? Windows is a synonym for manual installs.

  • http://twitter.com/natrixgli natrixgli

    Couldn’t future versions of Ubuntu have a download/install meta package in Software Center so long as it directs the user to agree to Oracle’s license? A nice touch would be to detect if the OpenJRE was failing and prompt the user to install the Oracle one.

    (and maybe think about getting away from using the term “Restricted” to something less scary like “Third Party” or “Proprietary”?)

    • http://newstechnica.com David Gerard

      It’d have to be a complicated thing that downloads and installs the Oracle tarball, the way they install Flash. Perhaps someone will bother.

      • https://launchpad.net/~cxl Chen Xiao-Long

        Yeah. The problem is that if it file is to be included in a DEB or tracked by apt/dpkg, it has to be done at build time. Any files downloaded while installing the package isn’t tracked by apt/dpkg. The reason this works for the flash package is that flash only contains one file. That makes it easy to find out what to remove if the user decides to remove the package.

        • http://newstechnica.com David Gerard

          Java is actually pretty well-behaved in this regard – all the files go in one directory, and there’s a thicket of symlinks pointing to it. I do this all by hand on our Solaris machines and it’s literally just changing the last symlink in the chain to point to the version I want. So I anticipate few problems handrolling a deb of the Linux tarball with fpm.

          (fpm is great, by the way. Just the thing to handroll debs with. https://github.com/jordansissel/fpm )

          • https://launchpad.net/~cxl Chen Xiao-Long

            That’s really convenient then :)

            By the way, fpm looks awesome!

          • http://newstechnica.com David Gerard

            fpm is in fact that good for deb-rolling. Saves a lot of trouble. Although we try to use distro stuff wherever possible, we handroll Tomcat 6.0.29 (distro is 6.0.24) and ActiveMQ (no distro package for Lucid). I recommend it highly over slinging tarballs about.

    • http://newstechnica.com David Gerard

      They could move from “Restricted” to “Stuff capricious copyright holders could change the terms on without notice and mess up your machine” or something equally innocuous and neutral.

      ;-)

  • Freddi

    Nobody commented yet on the fact that (if I understood right) Canonical more or less intervenes into user’s machines by disabling Oracle Java (by the means of a normal update).

    This is something that we know from several app stores (Google, Apple) and didn’t always get good reactions by the press.

    I have no doubt that Canonical does it for good reasons, nevertheless the important part is how they do it and how they communicate it to avoid that this action might be perceived as evil.

    • Anonymous

      yea they havent answered if users will at least get openjdk as a substitute.

      i dont want to get a call at 3am from someone new to ubuntu and minecraft suddenly stops working after the update..

      • Anonymous

        If you read the email linked in the article, Oracle Java is simply going to be removed without replacement. OpenJDK and manually installing Oracle Java from it’s website is listed as options.

        • Anonymous

          i think this kind of update is un user friendly. How are mom and pop going to figure out why their app suddenly stopped working?

          updates should not uninstall software like this without at least installing one of the replacements.

          is like if msft or canonical suddenly uninstalled and old browser from peoples computers and left them browserless without a substitute..

    • http://forteller.net/ Børge / forteller

       Thank you for voicing this concern! The others that have done this previously have also (until now, as far as we know) only used this to remove bad software. None the less the FOSS community berate them for having that power at all.

      Canonical should perhaps warn their users in a message trough the Update Manager, about this threat. In some much more serious cases (not only security holes, but actively malicious software) they should probably even warn the user and give them a one click way of uninstalling it.

      But I find it very disconcerting that they seem to be able to just plainly uninstalling software from peoples computers unilaterally.

      Isn’t this the sort of thing we’ve warned about: “Imagine, what if Apple had the power to do this on the desktop!”

      Please correct me if I’m wrong! I just feel that this is both a terribly wrong thing to do, even to have the power to do, in and of itself, and that we lay ourselves bare to ridicule from those defending the closed and controlling practices of Apple (and to some degree Google and Amazon).

      In addition to that, and also very seriously: If they just uninstall it with no warning, and don’t automatcally install an alternative they will break an important part of all their users computers. Then what happens to the “human beings” who suddenly can’t log into their online banks or do other stuff they’re used to. They will never be able to figure out what happened or how to fix it. If so many thousands might be expected to flee (back) to Win or Mac…

    • Anonymous

      So how the hell are they able to remove software from my machine.
      I don’t want them to have that power.
      In fact i don’t want anybody except me to have it.

      • Anonymous

        right on.

        worse is when non tech users apply updates and their apps stop working all the sudden with at least a replacement.
        good move canonical.

      • Anonymous

        They just need to update the Java package which tells the computer to remove files related to Java.

        Unfortunately, legal stuff and licenses is overriding users control over their own computer. As long as the code belongs to and is controlled by someone, you cannot achieve complete control on your computer. Hence free software.

        • Anonymous

          So they place a package named Java that ain’t Java? and if i check it in the update manager it will remove Java? I don’t really understand how they are able to remove something without my consent.

          • Anonymous

            You need to understand the concept behind apt packages and repositories used in Ubuntu.

            When you install a package containing a program, files are installed in various directories like /usr/bin, /usr/share, etc. A package (those .deb files) is like a zip file with instructions telling what files in it goes where.

            Upgrading downloads a new .deb package of the program in question. According to what’s in it, the files in the directories will be changed.

            In case of Oracle Java here, a new package is downloaded but it does not have new files – only instructions telling it to remove the files installed previously. 

          • Anonymous

            So will this package be displayed as a update to java (A package named java but not java only instructions to remove java) ? Or can it be another package named “blabla” that removes java?

          • Anonymous

            @sfantu:disqus Yes, Canonical can only control the packages in the repositories, not the packages installed on your computer itself. Canonical cannot mandate installing a new package on any Ubuntu system, unless it’s a dependency of a package already installed.

            Besides, if some other package interfered, it would cause conflicts since the Java package won’t find the file it installed.

    • Anonymous

      Well, I’ll comment now, as that is exactly what happened to me.  I’m now in the process of figuring out how to work around it with the binary Oracle install, so that the one critical app I have which depends on java (Netilla) can work again.

      I totally agree that Canonical should clearly mark updates which are not intended to be backward compatible and give users an easy way to avoid taking them, while continuing to install other updates.

      What a mess.  I would *much, much* rather live with whatever piddly security issues were present in the working version of java that I had, rather than go though this mess. 

  • Zombifier

    Canonical needs to make the removal of Java/addition of OpenJDK as user friendly as possible, so that the users don’t wake up one day finding out that Java has disappeared from their machines mysteriously.

    • Subhadip Ghosh

      I hope they will show some sort of warnings when Oracle java will be removed from system by updates.

      • https://launchpad.net/~cxl Chen Xiao-Long

        It is not technically possible to apt/dpkg to remove a package when updating. However, it is possible for them to make the OpenJDK package to ‘obsolete’ the ‘sun-java6-jre/jdk’ packages, so that when you update, you’ll be switched over to OpenJDK.

    • http://pulse.yahoo.com/_TOAP2YXEUL6HBNSCRICYVVMKSY Teg

      They need to turn the sun-java6 packages into transitional dummy packages that installs the OpenJDK 6 equivalent.

  • Anonymous

    Just wondering is this a clear sign that we should NOT trust any software from partner repository? Because uninstalling software from end-user computers is just a crazy idea. Uninstall something to brake the system is by definition a madness.

    • https://launchpad.net/~cxl Chen Xiao-Long

      Well, it’s actually not technically possible for Ubuntu to trigger a package uninstall just by updating your system. What they did is prevent the browser plugin from loading due to a security issue. You can see this in the package changelog: http://i.imgur.com/Fzxjp.png

      • http://forteller.net/ Børge / forteller

         Really? It is portrayed as an uninstallation here in this article, and other places I’ve seen IIRC.

        • https://launchpad.net/~cxl Chen Xiao-Long

          Yeah, the only way to ‘uninstall’ a package is to add Sun Java 6 to the ‘Replaces’ array in a package already installed on your system. When you perform an update, apt/dpkg will think that the updated package can ‘replace’ Sun’s Java and therefore, remove it.

  • http://profiles.google.com/drraczgabor Gábor Rácz

    Ah, this is why I could not use an internet banking site yesterday.

    • Anonymous

      no, it isn’t. *Nothing* has happened yet, except an email to the security announcements list stating an intention at some unspecified point in the future to do the best thing possible from a list of bad options.

  • http://profiles.google.com/nathanlee2 nathan lee

    Nice. As a regular listener to Security Now, apparently Java is right up there with Adobe Flash for things you should try to avoid; they have a history of bugs and security holes up to wazoo.

    • Anonymous

      I’m pretty happy with C++11. It just works and GCC 4.6 is great.

  • Cristiano Almeida

    What a shame! Where is the respect to the Linux’s users? Sun just disaponted me.

    • http://twitter.com/icalper Ivan Calderon Perez

      You mean Oracle.

      • Anonymous

        Sun java was good people. Oracle £££

  • Justin Beaird

    anyone else miss Sun Microsystems or is it just me?

    • Anonymous

      RIP Sun Microsystems. It was really to bad they got acquired by Oracle, particularly since Oracle only cares about the money and not the community, case-n-point Openoffice. Lucky for us the original dev community took and forked the code.

      • Anonymous

        OpenOffice has been donated to Apache Foundation. lets see what happens now.

        • http://newstechnica.com David Gerard

          Nothing. Apache OpenOffice will last precisely as long as IBM is contributing to it, and not a second longer. The project is crippled in all sorts of ways, big and small. LibreOffice is where *all* the action is.

          • Anonymous

            A merger should be the better option now that Oracle is out of the picture. 

          • http://newstechnica.com David Gerard

            I wonder if Apache OOo will have any changes that will actually be any use to LO. I’m not expecting it, but I could be wrong.

    • Anonymous

      I won’t (and I’m a Java developer).
      The last thing which didn’t work with OpenJDK for me was Banco do Brasil’s login applet (https://www2.bancobrasil.com.br/aapf/login.jsp?aapf.IDH=sim&perfil=1 ), and, since the version included in Oneiric, it works flawlessly….

      • Waldir Leôncio

        Last time I checked, Brazilian income tax declaration apps also didn’t work with OpenJDK.

  • http://twitter.com/Rixzard Rikard Johansson

    The title of this article is pretty lame. Java won’t go away, only Oracle’s Java.

  • Jonathan Wong

    Why did Oracle retire the “Operating System Distributor License for Java”

    • http://kyoushuu.users.sourceforge.net Arnel A. Borja

      From the post:
      “OpenJDK – which until now has been the open-source alternatives to Java – will now become the official implementation of Java. Oracle themselves will be using OpenJDK as the basis for their own future releases.”

      • http://jackyalcine.co.cc Jacky Alcine

        You’d think that they’d open up Sun’s Java and add it to the OpenJDK code-base.

  • https://openid.org/zaipai zaipai

    Well my updates are now disabled. I will be doing this on all machines at work until I have time to test OpenJDK with our applications. Ubuntu should notify users but should NOT uninstall users instances of Java, we have programs that look for very specific versions of Java and this will surely brake them. Sad, its yet another poor decision on Ubuntu and any other distro.. Notify, don’t remove.. errr..

  • http://profiles.yahoo.com/u/KME6NDF3KTWK6NNPG5SF36PLBI Ambleston

    This is bad news indeed. I have customers who use an SSL VPN on some SonicWALL boxes and their TS link relies on Sun/Oracle Java. I have tried with OpenJDK and it don’t work. How come this doesn’t affect 11.10 users?

    Is this going to be distro wide or just *buntu’s?

    • Kyle Osborne

      this is being done because of a number of known security flaws in the version ubuntu distributed. They can’t send out patches for this version, so their options are basically this or leave big ‘ol security gaps on a whole slew of machines, which is never good.

    • http://jackyalcine.co.cc Jacky Alcine

      Only Ubuntu, it seems. Just hold the package; preventing it from being upgraded, and they should be fine.

  • http://profiles.yahoo.com/u/KME6NDF3KTWK6NNPG5SF36PLBI Ambleston

    There is a good how to here: http://sites.google.com/site/easylinuxtipsproject/java for those who need to install Oracle Java. Its quite command line heavy, but us old pro’s who remember Windows 3.11 its a walk in the park. Not sure about newb’s though!

  • http://profile.typepad.com/6p0120a5509de8970c Mikko

    icedtea-plugin is useless

    • Anonymous

      file bugs.

      • http://profile.typepad.com/6p0120a5509de8970c Mikko

        allready filed and no one cares

  • Glennz NL

    Nice, with Java and Mono gone, they can keep the 700 MB limit…

    • http://pulse.yahoo.com/_GE4EYP3QOQ246PLG2Y2DOD2NIQ Dr. Fly

      I was actually going to wonder out loud why people hate Mono so much but not Java. I thought Java was subject to just as much of a potential legal issue as Mono was…?

  • Chad Germann

    Removing it from repos is one thing
    fsking up peoples software stack by disabling installed copies is another.

    enterprise users of 10.04 are going to love canonical for that move.

    • Ralph Bromley

      But its Oracles fault, they want to screw us.

      • Chad Germann

        true Oracle did change the licance and canonical pulled Sun-JRE to comply that was enough to comply

        Disabling the package in running system is overboard and is not a thing to do to Enterprise deployments.

        the only thing that move will do is Push the enterprise further into the hands or Red-hat and SuSE

        • http://jackyalcine.co.cc Jacky Alcine

          But this could have happened with RedHat or SuSE as well. They’re pushing empty packages into your system; if you don’t upgrade or hold the package and prevent it from upgrading, then you’re fine.

          You can also go download it yourself. What happened to the IT squad?

          • Chad Germann

            Just a bad precadent (on a side note red hat and suse never package this in official repo just in case this happened. They were right and now look better for it.

            As for the IT staff Current busness trend is close the department and outsource

          • http://jackyalcine.co.cc Jacky Alcine

            Well, neither did Canoncial, this was in the partner repository, one that users have to choose to open. It’s a way to letting them now, they don’t maintain the code, only the packages.

    • Andrei Gudiu

      Hello Boss, Yes, I lost countless hours trying to compile the sun jdk on my machine because Oracle and Canonical decided to fiddle with our company desktops, so… I am sorry I could not finish the project in time.
      Boss: There goes your bonus !

  • http://twitter.com/jspaleta Jef Spaleta

    Canonical is between a rock and a hard place here as a distributor. There’s no optimal choice here really. Either leave users exposed to security risks or not. 

    If you really need Oracle’s java then you need to contact Oracle and get them to provide usable deb packages in an apt repository on their download site or convince them to re-instate the distributor license so Canonical can continue to do that distribution packaging work on the user’s behalf.

    -jef

  • http://dismaldenizen.wordpress.com dismal_denizen

    I miss Sun Microsystems, they had become such a great company that seemed to understand open source to a reasonable degree by the end. It looks like Oracle will slowly undo all of Sun’s good work…

  • http://profiles.google.com/mpnordland Micah Nordland

    Ubuntu can remove an app from a user’s computer? man, I’m glad I switched to arch.

    • http://jackyalcine.co.cc Jacky Alcine

      That’s only if you upgrade.  It can happen on any package management system. Technically, this could be trolling, but I’m guessing you didn’t know :P

  • http://profiles.google.com/airtonix Zenobius Jiricek

    has anyone tested if subsonic media server works with openjdk7?

  • Anonymous

    OMG. That is such a rubbish excuse from Marc Deslauriers.  If it’s a severe security risk why didn’t you disable it last month? Or last year? And the fact that the Oracle licence has expired at the same time you’re removing it for security reasons is a coincidence, I suppose? 

    Nothing is going to make disabling packages on user’s machines more palatable, but at least be upfront about why you’re doing it. Don’t expect us to swallow flimsy excuses.

    • https://launchpad.net/~mdeslaur Marc Deslauriers

      We didn’t disable it before because we could update it when security issues arise. This time, there are _critical_ security issues being exploited in the wild, and Oracle will no longer permit us to update it.

      Oracle’s license doesn’t prevent us from distributing the old version, only newer versions. If there weren’t _critical_ security issues in the version currently in the archive, we would have just left it there.

  • http://profiles.yahoo.com/u/YHCV3BMA7ORRBXFJH4AENLUQRI Al Bundy

    Oracle is the second evil. Microshit is the first one.

  • http://twitter.com/Tuxduino Tuxduino

    I have just read this whole thread and I think I now understand.

    Just kidding!

  • Anonymous

    I’m a Linux user, if I choose to run software with security flaws that is my decision. Removing it from the repository is one thing (for Canonical to adhere to license expiration) but forcing a change to existing machines by pushing empty packages during an update is just wrong. 

    If this were ever a scenario the package should not have been included in a Canonical repository.

    GNU Freedom 0:
    “The freedom to run the program, for any purpose”

    The Sun-Java stack is not free software (by GNU standards) but Ubuntu is. Canonical, whilst striving to win, you have again forgotten who and what you’re fighting for.

    • http://twitter.com/zc456 Squeaks

      Just because the system is under the GNU license, doesn’t mean the software is too.

  • Ziv Leyes

    The problem with OpenJDK not running some apps properly is not a OpenJDK problem, but a specific app problem that doesn’t work fine in OpenJDK. You may think this is only a semantic statement, but in fact, is the reason it pisses me off everytime.

    The problem resides in developers!
    The same example I can give about Firefox, Chrome, etc and some websites that didn’t work fine a couple of years ago, why? Because the were wrote and tested only on IE!
    Same reason now, instead of coding in a standard that OpenJDK respects, they code specifically for Sun Java, or Oracle Java, and this causes the problems!
    If Oracle made the move to work based on OpenJDK it will be a good thing, but it may take a while until everyone straights up with this standard and start coding/fixing things that will work fine with it.
    I believe it’s a good thing, but we’ll have to be patient…

  • syncdram syncdram

    It would appear this has already taken place and at what point in time in the updates not quite sure. I do know its been a while ago and never gave any thought to this until now when i noticed a while back sun-java-6 was not being used at all in 10.04.  OpenJDK is being used. For me its been about a month and with no i’ll effects.

  • Marco Ceppi

    Those looking for how to install Oracle Java JDK 7: http://askubuntu.com/q/55848/41

  • http://marc-andre.cc Marc-André Appel

    That news coincided with the recent release of PHPStorm 3, which finally can run on OpenJDK  as well, so I don’t need Oracle Java anymore – good news!

  • Anonymous

    This seems like a good thing in the long run – the official Java being GPL should make it a lot easier to distribute, and all new Java apps should be compatible with it.

  • Rey Angeles

    No Way this is not good as most of our Web apps run off this Java Version. Damn it man!

  • http://www.7gen.com reikiman

    There’s nothing to worry about here.  FYI I used to be the DLJ Project Lead back when I worked for Sun. 

    The DLJ project is no longer necessary.  It was necessary several years ago when we started the DLJ project.  It was launched back before the launch of the OpenJDK project, and was a useful temporary measure to provide Java to Linux distros under lax terms.  But progress in the OpenJDK made the DLJ packaging irrelevant.

    Nothing evil – nothing to worry about – it’s actually a good sign of progress with the OpenJDK.

  • http://pulse.yahoo.com/_TOAP2YXEUL6HBNSCRICYVVMKSY Teg

    If you want to get the sun-java6 packages for Oneric, the Linux Mint team has them for their “Lisa” distro at http://packages.linuxmint.com/list.php?release=Lisa.

    Add this to your /etc/apt/sources.list in Software sources or terminal:
    deb http://packages.linuxmint.com/ lisa main upstream import backport

    Followed by this in the terminal:
    sudo apt-get update && sudo apt-get install linuxmint-keyring

    Finally update one more time and install:
    sudo apt-get update && sudo apt-get install sun-java6-jre

    Of course if you do not use Mint, it may be best sometimes to disable the repository due to some of their custom modifications to the system which may clash with a stock Ubuntu install.

  • xpress razor

    Since openjdk is oracle-jdk from now on, it is what should have happened and makes no sense to keep on supplying a zombie package. For time being we only need to rely on alternatives command to stick with jdk-6. That should not be too hard for anyone who wants to work with java on Linux.

  • http://twitter.com/g_saab Georges Saab

    OpenJDK was originally created from the Sun JDK  code base.  From Java 7 onwards, OracleJDK is based on OpenJDK with a few additional pieces which for various reasons (like 3rd party encumbrances) cannot be open sourced.

  • http://twitter.com/flibblesan flibblesan

    This is going to cause problems for Android since it only builds correctly using Oracle Java and not OpenJDK. 

  • Anonymous

    But will I be able to install oracle java from packages from oracle website?

  • http://twitter.com/snivy0 Rok Fajfar

    Come to the evil side, we got cookies :3

  • Anonymous

    Be used to this kind things happening…!

  • http://twitter.com/ugm6hr Hari

    So.. Is locking your version of sun-java6* packages on synaptic illegal?

  • Michael Kjær

    Thank god I still have sun/oracle java through PPA. Since the crap openJDK doesn’t work as well. Why not wait with the removal till openJDK works just as well?
    They must be stoned when making decissions at Canonical, with the Unity/Gnome Shell disaster as well.

  • Andii

    The only way for OpenJDK to improve is for people to use and report issues they see that aren’t present on the proprietary Oracle JDKs.  Also note that both the 6 & 7 binaries from Oracle are proprietary.  The only FOSS binaries are the reference version (which no sane person would use as it doesn’t get security updates) and the binaries built using IcedTea and packaged in the main repositories in Ubuntu, Fedora, etc.

 
News