[peoplewindow]

How is selling security fixes unprecedented? That's basically the entire Red Hat business model in the early years - yes the fixes are "free" if you want to spend all your time downloading and recompiling software, or you can buy RHEL and get a steady stream of backported fixes to your server for years. But it'll cost you.

As far as I can tell, the reason Oracle is the sole maintainer of Java is mainly historical (Sun legacy) and because no one felt an urge to do anything about it before. I'm sure it's going to change now.

Why? Neither Google nor IBM particularly require Java bug fixes from Oracle. Google maintains an in-house OpenJDK already and IBM actually maintains an entirely separate JVM. Also Google is hardly famous for its long term commitment to stable APIs and old versions of software, quite the opposite.

It doesn't make much sense for a company to pay for the expensive work of finding, fixing and backporting bug fixes to years old software .... all for free.

[the_grue]

> or you can buy RHEL

Or use CentOS. Oh wait, that's exactly what tens or hundreds of thousands of small businesses did and keep doing even today. Besides, that's not even a good comparison - Red Hat Linux was and is mainly about packaging other vendors' software, as opposed to Java, which is a monolithic piece of software developed as a single project.

> Google maintains an in-house OpenJDK

Didn't know that. How can they do that while keeping compatibility with Oracle's OpenJDK? Well, this information just reinforces my point, actually. Google is already in position to ditch Oracle as an upstream and unite with other parties to build a new foundation for open-source Java.

> Google is hardly famous for its long term commitment to stable APIs and old versions of software

Nobody likes to use other people's buggy code. I think you are mixing up two different things. Google does iterate their own software at a fast pace, but that doesn't mean it doesn't want the underlying infrastructure to be as stable as possible.