EmailKnow's extension rewrites your email as you send it β swapping links for tracked ones, injecting a pixel. Which means it's standing directly between you and the Send button. And that terrifies me in exactly the right way.
Because here's the failure I will not ship: you hit Send on something important, my tracking code throws, and your email doesn't go out. A tracker that eats your email is infinitely worse than one that occasionally misses an open.
So the rule across the whole extension is fail-open: if anything in the tracking path breaks β the rewrite, the pixel, a network call to my backend, a follow-up rule that won't load β the code falls back to Gmail's native send. You lose the tracking on that one email. You never lose the email.
This flips the usual instinct. Most defensive code fails closed: if you're unsure, stop. That's right for a payment or a delete. It's wrong here. The user's email is sacred; my feature is a bonus riding on top. When they conflict, the bonus loses, every time.
It changes how I write the code, too. Every tracking step is wrapped so its failure is contained. The follow-up engine treats a single network error as "keep this pending, retry next cycle" β not "give up." When a follow-up is due but a precondition isn't met (already replied, quota exhausted, not authorized), it skips safely instead of doing something dumb.
There's one deliberate exception, and it fails the OTHER way: the backend. If it boots in production with security secrets still set to dev placeholders, it refuses to serve at all β a hard 503. Because a backend running with a fake signing key isn't "degraded," it's unsafe, and serving anyway would be the real failure. Fail-open for the user's email; fail-closed for the user's security.
Knowing which way to fail is a product decision disguised as an error handler. Get it backwards and your "safety" code is the thing that hurts people.
Where do you fail open vs. closed in your own stuff? I'd bet most of us haven't made it a conscious choice.
β building EmailKnow in public, #6
