What are these certificates used for? It's to chain messages and say, yeah, this is really coming from this person.

Yes, so if we hold that for just a moment and talk a little bit about the fact that this is a very significant thing as well, in that when we talk about vulnerabilities that are in Java, you might think, oh, okay, well, it's vulnerabilities in the Java code, so the JVM, the libraries and so on, which is absolutely correct.

There are often vulnerabilities that we find there.

But you have to remember that OpenJDK is a full software package, the platform that you run applications on.

And so it isn't just about looking at those seven and a half million lines of code that we include in OpenJDK.

You also have to consider that there are lots of libraries which are used to build things like the JVM.

for the Windows platform or for Linux or for Mac, those libraries may well contain vulnerabilities.

Why should companies look for a paid distribution? What is the benefit there?

So normally we have every three months a new build of each version which is still supported, which contains security fixes, bug fixes, a lot of improvements, not really, right?

Yes.

I mean, as you quite rightly say, we have four scheduled updates, not releases, four scheduled updates for Java every year.

So this happens in January, April, July, and October.

And what those contain, as you quite rightly point out, are primarily there's the security patches.

There's also a number of bug fixes.

And then there may be some minor changes in terms of performance improvements and things like that, but they won't contain sort of features or anything like that so it's purely about updates that have bug fixes and so on and yes so we have four of those every year up until now we've had the capacity to include emergency updates if that has been required so if there was a security issue that was discovered and it had to be addressed really quickly because it was a zero day vulnerability we had the ability to do that we to my best of my knowledge we've never actually issued a security update out of bounds Java's a nice secure platform.

Yeah, it sounds great, doesn't it? Post-quantum

So maybe you will continue with C4 because, yeah.

Yes.

Yeah.

So, I mean, if we look at what Azul has done, as you say, there's Zulu, which is the idea of just a straight build of OpenJDK.

We can come back to what the benefits of that are.

But if we focus initially on what used to be called Zing is really still called Zing, which is the JVM.

And then we have a thing called Prime, Azure Prime, which is the product that we sell using Zing.

But this JDK is still the same, but all the garbage collectors are removed and you only get the C4 and you call it Zing.