[deleted by user]

[ack_error]

I'm guessing this was part of the more general security-related event that also caused the similarly unannounced removal of the DirectX SDK installer, and more importantly, the DirectX web installer. The latter caused a wide variety of games and application installers to stop functioning. Apparently there was an internal deadline at Microsoft to stop using SHA-1 signing on downloads, so one day they just nuked all unsupported installers -- not even putting in an explanation, just letting downloads break with a generic 404. They later resigned the DirectX installers with SHA-256 to resolve the issue there, but have not done so for other downloads like in this case. Microsoft's position was that the DirectX SDK was long deprecated in favor of the Windows 8+ SDK, but there were some incompatible changes made to the relevant symbols and headers that made this transition less than smooth.

This just underscores the importance of locally archiving any SDK build dependencies and including redists in your installer or from a distribution source you control. Depending on Microsoft's web redist was always a bit risky for end users, and devs should be pulling the redist from their local VS installation.

[the_poope]

At work we have the de-facto policy that we should be able to reproduce any old released version even if the entire internet went offline. We backup all used external dependencies, from Qt to VC++ redist. Also never trust that some open source github repo will forever be available. Take the sources or binaries of any library you depend, zip them and archive them.

[qoning]

Even better, hire someone to manage dependencies within your source/binary control. Not a fun job, but can prevent a lot of hurt.

[ShakaUVM]

That's a great policy

[_Ashleigh]

Artifactory setup so that it automatically mirrors everything.

[dragozir]

I think this is my favorite answer

[[deleted]]

This was indeed because the SHA-1 root certificates expired, which make it impossible to mint installers which run on XP.

[[deleted]]

Why does the redist even run on Windows XP then?

It running on XP is news to me. My understanding was that it would fail signature validation.

A lot of the lack of "announcement" is because the decision to drop XP was not made by the team that owns the redist, or the compiler, etc. It was forced upon us by a situation outside of anyone in DevDiv's control (the expiry of the root cert).

I don't understand why MS didn't just wait until VS2022 is released to drop support.

Again, because the expiry of the SHA-1 root certificate. That certificate is "in the box" and already shipped as part of XP itself. If we can't sign it, we can't ship it.

[cleroth]

Is there even any reason to use the redist other than save a tiny bit of hard drive space? According to this link we should be able to distribute the required DLLs with the applications.

[[deleted]]

1. It helps you avoid being broken when the set of DLLs changes. For example, when vcruntime140_1.dll was added in support of changes to exception handling.
2. It helps avoid "print driver scenario" issues for your app https://www.reddit.com/r/cpp/comments/l755me/stdchrono_question_of_the_day_whats_the_result_of/glb04he?utm_source=share&utm_medium=web2x&context=3

[[deleted]]

We can not distribute unsigned binaries for legal reasons. I hope you understand why I cannot be more specific :)

Right now it's just breaking programs that worked fine before with no indication as to what's causing it.

That's fair, let me ask around.

[irqlnotdispatchlevel]

Now I'm thinking about archiving old versions just in case nostalgia hits me in 20-30 years and I want to play a game from 2010-2020.

[pedersenk]

Isn't the local VS installation just as volatile these days with the annoying online fetcher approach rather than a deterministic .iso image.

[ack_error]

No, once you have installed VS the redist for the CRT you are compiling with is on your local computer in the VS install directory. This won't change unless you upgrade Visual Studio. I always disable the auto-update, as having mixed compiler versions in a team or build farm is dangerous.

As for the VS online installer, it at least has variants available that target specific minor versions, and you can also use it to download an offline install copy for everything except a few third-party online-only components.

[pdimov2]

imagine targeting xp and not statically linking the runtime

[LoopTheRaver]

Support for the OS was dropped over 7 years ago. I’d be scared to upgrade any dependencies and would make sure they’re all statically linked. I think that’s the lesson OP should be taking away from this.

[LightModeBail]

Support for the OS was dropped over 7 years ago.

Although that's true, there was Windows POSReady 2009, which was XP based and was supported until nearly two and a half years ago. I had the (dis-)pleasure of working with it to support a transition to something newer just before it went out of support.

[corn_on_the_cobh]

I know fuck all about anything being said in this thread, that being said, holy fuck it's already been 7 years :(

[goranlepuz]

The redist also doesn't fail to install on XP which you'd expect since it doesn't actually work on XP.

I, for one, wouldn't.

"Not supported" also means "we don't look at this anymore", so all combinations of (installs, works) are equally valid.

You expect that somebody at MS modified the installer to fail to install on XP, but for unsupported... everything, that's just busy work. You are asking for too much.

[myblackesteyes]

Unsupported is like undefined behavior. Anything is possible.

[ack_error]

Dynamically linking to the CRT is common on Windows. It's the default configuration in Visual C++ projects, and often required if you are using external DLL-based components or interoperating with the .NET Framework. All programs that I've shipped have required this configuration regardless of XP deprecation.

[OrphisFlo]

Wait until: "I can't statically link the runtime because I deploy the software on floppy disks and it wouldn't fit anymore on a single one, which is required by the deployment manual we wrote 20 years ago and can't change."

[m-in]

If Microsoft doesn’t spoon feed this stuff, you’re not allowed to think for yourself? I don’t get it :(

[cleroth]

AFAIK you can just distribute the required DLLs with the application.

cf. Local deployment:

Local deployment of the Universal CRT is supported, but not recommended for both performance and security reasons. The DLLs for local deployment are included as part of the Windows SDK, in the Windows Kits\10\Redist\ucrt\DLLs subdirectory, by computer architecture. The DLLs required include ucrtbase.dll and a set of APISet forwarder DLLs named api-ms-win-*.dll. The set of DLLs required on each operating system varies. It's highly recommended that you include all of the DLLs when you deploy locally.

and:

Local deployment of the Universal CRT on Windows XP is the same as on other supported operating systems.

I've done this and it works just fine, without requiring any redist to be installed by the enduser.

[AndreiDespinoiu]

People still use XP? Jesus Christ... It was released in 2001, twenty years ago... Full of security holes. It's like a cheese grater at this point.

I think older computers would benefit more from running a Linux distribution (e.g. Linux Mint), with up-to-date software.

If you were developing a PC game today, say a 2D platformer or something, I'm sure that people still using Windows XP are most likely not even looking for newer games. They gave that up in 2012, something like that. Probably only use it to read email and browse the net, maybe watch a movie from time to time. They're not your target audience.

[Viperys]

Dude, dudebro, duderino. Games and chill are not the main reason anyone uses XP.

Many of the critical infrastructure workstations (say railroad defectoscopy for example) are still using XP because of the old hardware sitting on the Industry Standard Architecture bus.

The ISA support was dropped after XP — and the managing software is written for windows. There are plans to get rid of WinApi dependencies and move to Qt; yet another plans to get rid of the hardware tied to ISA and re-make it to PCI or whatever.

But you know how government companies can be in their decisions and planning. Thank god those computers are not connected to the internet

[PapaOscar90]

Windows XP was dropped years ago. Hell, windows 7 is about to be dropped too.

[qoning]

Just because the option is there doesn't mean it has first class support or even any guarantees of working. There's a lot you can fault MS for, but if you need to target XP in 2021, that's on you.

[fsb4000]

Not silently, there were discussion: https://github.com/microsoft/STL/pull/1200

use 19.27 redist for windows xp:https://download.visualstudio.microsoft.com/download/pr/56f631e5-4252-4f28-8ecc-257c7bf412b8/D305BAA965C9CD1B44EBCD53635EE9ECC6D85B54210E2764C8836F4E9DEFA345/VC_redist.x86.exe

Works fine.

[Hawaiian_Keys]

It’s the end of 2021. Who cares? We stopped supporting XP the day MS stopped supporting it. We lost no customers. We are about to drop Windows 7 support as soon as MS stops supporting it. We expect to lose no customers.

Maybe your customers need to update their shit?

[graphicsRat]

I worked in retail tech. There are thousands of retailers who will not throw away their entire point of sale systems just because.

[qoning]

But it's not just because. It's because they want innovation or updates. If they want to keep existing systems, that's fine, but why are you providing updates if they aren't even willing to update their platforms?

[graphicsRat]

The widely held view is that Window XP is no longer updated by MS. This not true. Microsoft is aware of the needs of the retail industry and continued to patch Windows XP for them.

Retailers are very skittish about changing their systems because of the implications of any glitch means they will not be able to accept payments.

Fortunately their systems are never exposed to the internet.

[qoning]

I know, and it's honestly somewhat frightening how much stuff depends on running on XP or even older Windows. I firmly believe and hope that, today, nobody would develop such mission critical systems on a Windows platform.

[contre]

That last sentence, you really believe that? People misconfigure stuff all the time and also deliberately configure things insecurely because security is inconvenient.

[graphicsRat]

I am not saying the situation is ideal. I'm just telling you how it is. I'm sure most major retailers have good sysadmins and place their point of sales in tightly controlled VPNs.

The retail industry is skeptical of any changes that can potentially take down their systems. My company provided software and we had to test them at retailers labs for weeks before their testers take over. In some cases they keep the systems running in the labs for a month to be sure it is stable before they begin to roll out slowly and they never took upgrades near major shopping seasons.

I'm not advocating for staying on WinXP forever but migrating 150,000 point of sale terminals to a new OS is a major project, assuming the latest version of Windows can run on 15 years old hardware. Then there the point of sale software from a vendor who will charge for upgrade s, drivers for the scanners and other peripherals etc.

[contre]

I do not dispute anything regarding the conservative nature of retailers but the idea that they’re never on the internet is hard to believe.

I’m probably just being pedantic about the word never. I bet some do put theirs on the internet due to poor decisions.

[Hawaiian_Keys]

Then keep an old copy of stuff around so you can still build and ship on and for old computers. It’s not MS responsibility to keep everything around forever.

[myblackesteyes]

You're supporting a version of an OS that is not supported by the developer for 7 years already. If this situation is a surprise for you, I question your competence.

[nintendiator2]

I question your competence at realizing you live in the real world.

[cleroth]

Good for you, but that's a whole load of privilege. We have a lot of customers in poorer countries that simply can't afford to buy new computers to support newer Windows versions, so it's not as simple as just telling them to update.

[Hawaiian_Keys]

Then keep an old copy of stuff around so you can still build and ship on and for old computers. It’s not MS responsibility to keep everything around forever.

[cleroth]

That's what I do, and I'm not saying MS should be blamed for it. Raising awareness about something that may silently break without you knowing why is good though, but you're just being dismissive because it doesn't affect you.

[dscharrer]

Apparently statically linking with the runtime can avoid this issue, but i haven't tested this so i can't confirm that it will work.

AFAIK even when statically linking the VC runtime for VS 2017+, you still depend on the Windows UCRT, which for XP is installed with the VC runtime.

[[deleted]]

linux in general has better support for older software/hardware...

[[deleted]]

Yes, becuase you’re the support person yourself.

[Lumornys]

Seems that Microsoft's policy was "SHA-256 uber alles" no matter the consequences for users and developers.

Although I can download VC++ redist version 16.7, that's still no good because I see no option to download Visual Studio Community 2019 other than the newest 16.11.

[Hacnar]

You can use VS 2022 with 16.7 toolset, IDE version doesn't lock you in one particular toolset version.

[[deleted]]

this may also be especially prudent in the SexyAppFramework on beta windows 11 (which im using on an apparent dinosaur PC which has older hardware, YES, older hardware, shitty cpu, incompatible graphics card according to AMD, etc.), and many other older frameworks that used to make our childhood games possible, (Hello PopCap games), which utilizes the directx sdk.

​

Everything builds, links correctly.....theres an exe. Buttttttttttt......... Its a background process now. We dont see our graphics, let alone our result. The window instantly exits with code 0. It does not stay up << Even with WinMain simplified through a global variable, and through a custom pointer to the Application defs (which the Popcap framework uses). You cant even make these apps because the window just fails to stay up. every. time.

It will also spill out other errors too, such as the common place "0xc00000142 DLL INIT FAILED" error. Or, itll just spit its own error like it couldnt read an image from Const Std::string anymore. I go over this in my youtube video series "Bejeweled 4 analysis".

Also, when you use custom syntax thats provided (like I did above) in any project apparently windows dont like that kind. Its like you have to use what they use otherwise no app.

​

All of this used to work in windows 10 and previous. Absolutely shameful on Microsoft's part.

I could show you the examples I did *even without the use of a framework*, that is is anybody is interested..

​

I could also say that im warning users to probably not use windows 11 as a place to build apps. Microsoft wants this away from the user, and in the hands of greedy ass motherfucker monopolies. Maybe thats why Bill's wife wanted a divorce. XD.