Defensive Default
A substituted value that papers over a missing input and hides the misconfiguration that produced it.
A defensive default is a value supplied when a real one is missing, so the program can continue. Used well it is ordinary hygiene; used on identity or configuration values it is a way of converting a loud, local failure into a quiet, distant one.
The tell is whether the default can be wrong. An empty array standing in for an absent list cannot be wrong — nothing downstream misbehaves. A hostname, port, tenant identifier, API key, or feature-flag value absolutely can be, and a default silently supplies a plausible answer to a question the environment failed to answer. The environment stays broken; only the symptom moves.
Defensive defaults also distort verification. A fallback branch that is unreachable in one environment and reachable in another produces coverage numbers that differ by machine, and a test that never exercises the real path. Removing the fallback often removes the untestable branch along with it — see Unreachable Code and Branch Coverage.
A related shape is the defensive guard: a null check protecting against a state the surrounding invariant makes impossible. It reads as caution and behaves as noise, since no input can reach it and no test can cover it.
See also5
Hand-picked in the note itself — the neighbours worth reading next.
Fail Fast
Crash at the point of misconfiguration rather than degrading quietly into a wrong state.
Method12 connections
Silent Failure
A failure that produces no signal, so the absence of an error reads as success.
Method44 connections
Environment Variable
A named value in a process's environment, inherited by its children — the standard configuration channel.
Systems & Tooling14 connections
Secret Management
Storing, distributing, and rotating credentials without embedding them in code or history.
Systems & Tooling15 connections
Chesterton's Fence
Do not remove something whose purpose you cannot explain.
Method11 connections
Related2
Nearby in the graph rather than deliberately chosen. Looser, sometimes surprising.
Linked from7
Notes elsewhere in the wiki that reach for this one.
- Branch CoverageTesting & Verification
The proportion of conditional outcomes exercised — the strictest ordinary coverage metric, and the most informative.
- Chesterton's FenceMethod
Do not remove something whose purpose you cannot explain.
- Environment VariableSystems & Tooling
A named value in a process's environment, inherited by its children — the standard configuration channel.
- Fail FastMethod
Crash at the point of misconfiguration rather than degrading quietly into a wrong state.
- Secret ManagementSystems & Tooling
Storing, distributing, and rotating credentials without embedding them in code or history.
- Silent FailureMethod
A failure that produces no signal, so the absence of an error reads as success.
- Unreachable CodeTesting & Verification
Code no input can execute — usually a guard against a state the surrounding invariants forbid.