As Java turned 25 in May 2020, it was going through changes which had nothing to do with the pandemic but everything to do with Oracle. Until 2019, Oracle allowed its JDK to be used for free for commercial purposes. Oracle had provided all Java users with free updates, and sold licenses to customers for added support and tools (“support” meaning a commitment to fix bugs and have staff available to answer customers’ problems; “tools” included Flight Recorder and Mission Control). Given the stately release train of Java versions and easy adoption of new versions, most companies did not choose a commercial support option.
Sowing the Seeds of Change in Java
But Oracle had sown the seeds of change in 2017 when it announced a new release schedule for Java. Instead of a new version of Java every few years, a major new version would now be released every six months. Every few years, one of those releases would be selected as a long-term support (LTS) release – the latest being Java 11, which came out in September 2018.
Oracle also announced in 2017 that it would stop providing free Java updates and start requiring paid subscriptions to keep production Java deployments secure and up-to-date. Companies requiring support and tools would now need to purchase explicit Oracle licenses.
Mo Money, Mo Problems
In December 2019, Azul Systems commissioned a Java market survey conducted by a leading independent strategic consultancy firm. The firm interviewed 432 senior Java decision-makers from a range of industries, approximately 80% of whom were CIO/CTOs, Directors, or VPs, mostly working for large enterprises. (You can download the full report here.)
The survey discovered that about 20% of Java customers have decided to stay with their existing Oracle-made JDKs, but are finding that their support costs often skyrocket as a result. These high and unpredictable costs are driving the rest of Oracle JDK users – as much as 80% of them – to consider other Java partners beyond Oracle.
Is Free Java Right for Your Business?
At last count there were at least eight organizations offering “free” builds of OpenJDK, including Oracle and Azul. With all these options, why pay? Why not just deploy a free JDK? How risky could it be?
When evaluating free OpenJDK vendors, there are critical questions to consider as to technical capability that will greatly impact your security stance.
- How will your OpenJDK supplier help to protect your IP?
- What kind of track record does the supplier have?
- How long do they take to release quarterly security updates?
- Is your OpenJDK distro TCK-tested?
And here’s a big one:
- Will an OpenJDK distribution provide security-only quarterly updates, like Oracle has always done?
This is where the jumbled, jostling pack of suppliers begins to get winnowed down to the two lead horses in the race. Everybody publishes consolidated updates containing security patches, new features, and bugfixes. But when critical CVEs become visible, only Azul and Oracle provide security-only updates that can be deployed without extensive QA cycles.
So how do these two main Java options, Oracle and Azul, compare?
Look for Java Experts
Global 2000 enterprises need enterprise-class Java that comes with timely, production-quality updates backed by deep Java expertise. Azul has been shipping Java products for over 15 years and today is the provider of the world’s most trusted open source Java platform – Azul Zulu.
An ideal Java partner is deeply committed to the community. For example, Azul works extensively within the Java ecosystem as a:
- Key contributor to Java Open Source community and the OpenJDK project
- Member since 2011 of Java Community Process (JCP) Executive Committee, driving the future of Java
- Member of OpenJDK Vulnerability Group ensuring coordinated release of critical security updates across the industry
- Member of the Java Experts Group (deciding features for each release) for 7 releases of Java SE (JDK9-15EA)
- OpenJDK 6 and 13 project lead.
Azul is dedicated to assuring that Java is secure and in compliance:
- All Azul products pass the TCKs for the appropriate version of Java. We prove that our builds meet every standard.
- Azul consistently delivers security updates to customers within one hour after release – others take days, even weeks.
- Azul backported 60 Java critical vulnerability fixes in the last 12 months – while Oracle stopped providing free security updates for the most widely deployed versions of Java (Java 8 and 11) in Jan. 2019, leaving users exposed.
- Azul also backports security updates and bugfixes to Java SE 6, 7, 13, and 14.
- Unlike all other OpenJDK vendors, Azul provides quarterly security-only Critical Patch Updates (CPUs) for rapid deployment plus consolidated Patch Set Updates (PSUs) that combine bugfixes, new features, and security patches.
Technical expertise matters. As one Director of Engineering quoted in the Azul survey explained, “It’s super difficult to upgrade your Java version, especially given the amount of testing it requires. Ideally, you want to do this in lock-step, but it’s difficult to pace re-writing across applications. Upgrading language can take anywhere from six or eight months to two years depending on the company and its products.”
Understand Your Costs
Let’s move to cost. The Azul survey found that, even for medium- and small-sized companies, “the price increase for Oracle is meaningful and will be noticeable to the organization.”
With Azul, customers typically save 50-90%. Azul guarantees a minimum saving of 25%. “Oracle is significantly more expensive than Zulu, which helps Zulu win customers for sure,” said one survey respondent, a Chief Strategy Officer. “This cost differential, and specifically the magnitude of it, is a calculus that procurement departments look at closely when advising leadership.”
You can get some sense of the differential between Zulu Enterprise and Oracle Java SE subscription costs for your own Java deployment by engaging with this cost savings calculator.
Ensure Quality of Support
Azul is known to provide the best global customer support in the industry.
Just as with technical expertise, the quality of support really matters. Azul is known to provide the best global customer support in the industry. “One of the big benefits of Zulu Enterprise is its strong support and the optionality of the level of support you want to receive,” said one of the survey respondents, a VP of Global Information Security. “Customers perceive Azul as really trying to work with them to find the best solution that fits their business needs.”
Choose the Right Java Partner for Less Cost, Better Support
There’s a major shift underway in the Java landscape. For some companies, a free OpenJDK solution will work. For many, it won’t. And with the changes at Oracle leading to consequent increases in costs for many enterprise Java users, this is forcing them to reassess their Java roadmaps and vendor choices. When you look at company viability, depth of technical expertise, relative cost, and quality of support, there’s one clear winner in the two-horse race between Oracle and Azul.
The post How to Choose the Right Java Partner for Less Cost, Better Support appeared first on Azul.