The Will of the [JDK Using] People

In an earlier blog, I wrote about what comes after JDK 8. This examined different factors that might affect people’s decisions about which version of the JDK to move to after JDK 8.

What’s becoming increasingly clear is that there is still considerable confusion about having a new JDK release every six months and how it will impact users and their choice of Java version for deployment.

Gil Tene, our CTO, ran a poll on Twitter last month to gauge what Java users were planning regarding deploying their applications on JDK 9 and JDK 10. The results are quite startling.

Now, I won’t claim that, with a little over 4,000 responses, that this is statistically significant, but I do think this is a big enough number to make some claims about what is happening. I also think that the respondents will typically be more experienced Java users and likely to be more aware of current Java events.

Gil was quite deliberate in the way he asked the poll question and the possible answers he provided. It was designed to see if people understood the current situation for JDK releases.

What’s surprising, then, is that most people do not appear to understand what is happening. Nearly two-thirds of the respondents are planning to put a JDK into production in a timeframe, which means public updates for those JDKs will have ceased. Anyone doing this would put their users at risk of stability issues (since they would not be applying any JDK-level bug fixes) and potentially make them vulnerable to security exploits — since there will also be no JDK security patches applied. With continuing security issues, even at the processor level, such as the recent L1 terminal fault following on from Spectre and Meltdown, it’s vital to ensure your Java deployment platform is kept up to date with security patches.

How to address this will require people to decide whether they want to update to a new JDK every six months, to continue to get updates for free, or find an alternative supplier of JDK binaries, which include long-term support for updates.

If moving to a new JDK that frequently sounds unrealistic, our Zulu JDK builds of the OpenJDK source code provide a low-cost alternative.

I’ll be delivering a webinar next week on the subject of what JDK you should use in the future. Why not join me to learn more?