Every setting you expose
ships with a value
you picked in about four seconds.
That value is the real product.
Because almost nobody
will ever change it.
Nine people in ten
take what you handed them
and assume it was considered.
Sometimes it was.
Often it was whatever
made the test pass
on a Tuesday.
So the timeout is thirty seconds
because thirty is a round number.
The retry count is three
because three felt brave
without feeling reckless.
The log level is debug
because you were debugging.
And now a thousand machines
run your Tuesday afternoon
as policy.
A default is not a suggestion.
It is a decision you made
on behalf of everyone
who never opened the docs.
Treat it like one.
Ask the small question
before you type the value.
What happens to the person
who never touches this.
Is the safe path
also the lazy path.
Because if safety costs
one extra flag,
you have made safety opt-in,
and opt-in safety
is decoration.
Make the careful choice loud.
Encryption on.
Verbose off.
Destructive actions
asking first.
Limits that protect the system
from an honest mistake,
not only from an attacker.
And when you truly cannot decide,
that is information too.
A default you cannot defend
usually means the option
should not exist,
or the thing should refuse to start
until someone says
what they meant.
Silence is never neutral.
It just puts the cost somewhere
you will not see it.
There is a second half to this,
and it is the expensive half.
Changing a default later
is a breaking change
wearing a very small hat.
Nobody reads the release note
that says the default is now stricter.
They find out at three in the morning,
when the job that ran quietly
for four years
stops.
So choose slowly.
Write down why.
Keep the why next to the value,
not in a document
nobody can find.
And if you must change it,
say so in the loudest place you own,
twice,
before it happens.
Flags are for the experts.
Defaults are for everyone else,
and everyone else
is most of the world.
– Serguey Asael Shinder
Top comments (0)