Best practices from Microsoft dictate that we link dynamically to the VC++ runtime for security reasons, and it sure would be nice if our application automatically picked up hotfixes without requiring a separate application update from our side.
However, over the past couple of years, I've been making installers for the Evolve client. Our single biggest issue with installing the client has been caused by failed vcredist installations. The biggest error codes being:
1612: The installation source for this product is not available. Verify that the source exists and that you can access it.
1638: Another version of this product is already installed. Installation of this version cannot continue. To configure or remove the existing version of this product, use Add/Remove Programs on the Control Panel.
We've also run in to cases where some third-party application had manually installed the 32-bit version of msvcr100.dll in System32 on a 64-bit version of Windows, obviously causing all applications on the system relying on this to fail.
Now, my question is this: If a developer wants to follow Microsoft's guidelines for the good of the land, how are we to succeed if our products can't reliably be installed? I'm at a crossroads right now where I only see two options going forward:
Link all my binaries statically to the runtime and take the hit on binary size and the security implications associated with it.
Manually distribute the VC++ runtime DLLs and dump them in my application's folder although I don't even know if I'm allowed to do that.
What is everybody else doing out there?
