5 ms·

Microsoft's the one to blame here. If they made sure their systems automatically come with MSVCRTs pre-installed, and new ones downloaded through the update sys

Microsoft's the one to blame here. If they made sure their systems automatically come with MSVCRTs pre-installed, and new ones downloaded through the update system, this problem wouldn't exist in the first place. Asking your users to install some sketchy 'runtime' won't work. And not every app should need or want a specific install script to verify for the umpteenth time that something as basic as the C/C++ runtime library is available.

cesarb 9y ago
AFAIK, you are supposed to distribute the MSVC runtimes as merge modules within your MSI package, which is what for instance LibreOffice does.
- Const-me 9y ago
  > you are supposed to distribute the MSVC runtimes as merge modules Right, that’s what MS tell. What they don’t tell is these merge modules aren’t compatible enough. E.g. it’s impossible to install VC 2015 runtime DLLs (so-called Universal CRT) on a never updated Windows 7 SP1 machine.
  - pjmlp 9y ago
    Well my work laptop is Windows 7 up to date, with VS 2015 Update 3. So it got installed there somehow.
    - Const-me 9y ago
      The problem only affects PCs that aren’t up to date. Specifically, PCs without KB2999226 installed. Not all people update their Windows. Some just don’t care. Others people don’t want to connect PC to the internet. There’re also people who use mobile internet and pay for bandwidth. When they’re unable to run the software they’ve paid money for, I don’t want to update Windows for them, I want my software to work. Hence, no dynamic CRT.
      - cesarb 9y ago
        > Not all people update their Windows. Some just don’t care. Others people don’t want to connect PC to the internet. There’re also people who use mobile internet and pay for bandwidth. And sometimes Windows Update simply stops working. I've seen it happen more than once.
      - hypervis0r 9y ago
        So you're refusing to have a basic update installed? Let me guess, you're going to complain and say Windows is insecure because you got WannaCry'd because you didn't update your system and blame it on MS instead? (you = whoever "doesn't care" about updates)
        Const-me 9y ago
        It’s unlikely to get WannaCry unless the PC is connected to internet or LAN. The software we’re offering doesn’t require to be online. It normally works unattended for hours, controlling some specialized industrial hardware. Not unlike embedded software. For this particular use case, being offline has it’s upsides: no downloads, no updates, no reboots. The users who discovered that bug (initially I did include these CRT merge modules in my installer, as recommended by MS) didn’t even send us a screenshot. Instead, they took a photo of their PC’s screens with the error message, and sent us that. Then I was able to reproduce on an offline Win7 VmWare machine, and deliver a fixed version with statically linked CRT, which BTW worked OK even on a vanilla Windows 7 sp0 from 2009. Personally, I would recommend updating Windows instead, and I do update the PCs I own. But I can, and do, support running my software on a never updated system.
userbinator 9y ago
MS does supply the MSVCRT.DLL with Windows, and even link their apps with it, but then said you (as in, non-MS apps) weren't supposed to use it in lieu of the MSVCRxxx (and now, the even worse "split the libc into several dozen pieces, each in its own file"[1]) mess. Most developers grudgingly obeyed, bloating their apps either through static linking, including a copy of the set of runtime DLLs, or the .MSI installer in their own distribution. But then there are those of us who saw through that ruse, gave MS the proverbial finger and linked with the "system MSVCRT.DLL". The result being tiny, highly portable binaries which don't require any installation or dependencies beyond what Windows already has. [1] https://blogs.msdn.microsoft.com/vcblog/2014/06/10/the-great-c-runtime-crt-refactoring/ https://blogs.msdn.microsoft.com/vcblog/2014/06/10/the-great...
pjmlp 9y ago
Many OSes unlike UNIX, including Windows, traditionally don't have a system C library, rather multiple compiler vendors each with its own C library. Which is one reason, when you look at Windows 3.x code, it was common to call Win16 APIs directly instead of ANSI C ones. For example, ZeroMemory() instead of memset().
int_19h 9y ago
In Win10, it does come with a preinstalled CRT, which is going to remain ABI-compatible. https://blogs.msdn.microsoft.com/vcblog/2015/03/03/introducing-the-universal-crt/ https://blogs.msdn.microsoft.com/vcblog/2015/03/03/introduci... Also, please don't call them "MSVCRTs". That - MSVCRT.DLL - is the name of the binary of one particular version of the runtime, corresponding to VS 6.0. All further versions had different names. The proper generic term is CRT (as in, "C runtime").

cesarb 9y ago

AFAIK, you are supposed to distribute the MSVC runtimes as merge modules within your MSI package, which is what for instance LibreOffice does.

Const-me 9y ago
> you are supposed to distribute the MSVC runtimes as merge modules Right, that’s what MS tell. What they don’t tell is these merge modules aren’t compatible enough. E.g. it’s impossible to install VC 2015 runtime DLLs (so-called Universal CRT) on a never updated Windows 7 SP1 machine.
- pjmlp 9y ago
  Well my work laptop is Windows 7 up to date, with VS 2015 Update 3. So it got installed there somehow.
  - Const-me 9y ago
    The problem only affects PCs that aren’t up to date. Specifically, PCs without KB2999226 installed. Not all people update their Windows. Some just don’t care. Others people don’t want to connect PC to the internet. There’re also people who use mobile internet and pay for bandwidth. When they’re unable to run the software they’ve paid money for, I don’t want to update Windows for them, I want my software to work. Hence, no dynamic CRT.
    - cesarb 9y ago
      > Not all people update their Windows. Some just don’t care. Others people don’t want to connect PC to the internet. There’re also people who use mobile internet and pay for bandwidth. And sometimes Windows Update simply stops working. I've seen it happen more than once.
    - hypervis0r 9y ago
      So you're refusing to have a basic update installed? Let me guess, you're going to complain and say Windows is insecure because you got WannaCry'd because you didn't update your system and blame it on MS instead? (you = whoever "doesn't care" about updates)
      - Const-me 9y ago
        It’s unlikely to get WannaCry unless the PC is connected to internet or LAN. The software we’re offering doesn’t require to be online. It normally works unattended for hours, controlling some specialized industrial hardware. Not unlike embedded software. For this particular use case, being offline has it’s upsides: no downloads, no updates, no reboots. The users who discovered that bug (initially I did include these CRT merge modules in my installer, as recommended by MS) didn’t even send us a screenshot. Instead, they took a photo of their PC’s screens with the error message, and sent us that. Then I was able to reproduce on an offline Win7 VmWare machine, and deliver a fixed version with statically linked CRT, which BTW worked OK even on a vanilla Windows 7 sp0 from 2009. Personally, I would recommend updating Windows instead, and I do update the PCs I own. But I can, and do, support running my software on a never updated system.

userbinator 9y ago

MS does supply the MSVCRT.DLL with Windows, and even link their apps with it, but then said you (as in, non-MS apps) weren't supposed to use it in lieu of the MSVCRxxx (and now, the even worse "split the libc into several dozen pieces, each in its own file"[1]) mess. Most developers grudgingly obeyed, bloating their apps either through static linking, including a copy of the set of runtime DLLs, or the .MSI installer in their own distribution. But then there are those of us who saw through that ruse, gave MS the proverbial finger and linked with the "system MSVCRT.DLL". The result being tiny, highly portable binaries which don't require any installation or dependencies beyond what Windows already has. [1] https://blogs.msdn.microsoft.com/vcblog/2014/06/10/the-great-c-runtime-crt-refactoring/ https://blogs.msdn.microsoft.com/vcblog/2014/06/10/the-great...

pjmlp 9y ago

Many OSes unlike UNIX, including Windows, traditionally don't have a system C library, rather multiple compiler vendors each with its own C library. Which is one reason, when you look at Windows 3.x code, it was common to call Win16 APIs directly instead of ANSI C ones. For example, ZeroMemory() instead of memset().

int_19h 9y ago

In Win10, it does come with a preinstalled CRT, which is going to remain ABI-compatible. https://blogs.msdn.microsoft.com/vcblog/2015/03/03/introducing-the-universal-crt/ https://blogs.msdn.microsoft.com/vcblog/2015/03/03/introduci... Also, please don't call them "MSVCRTs". That - MSVCRT.DLL - is the name of the binary of one particular version of the runtime, corresponding to VS 6.0. All further versions had different names. The proper generic term is CRT (as in, "C runtime").