.gitignore Everything by Default

Look, the traditional `.gitignore` workflow is a reactive mess. You commit something you shouldn't, panic, `git rm --cached` your way out of it, and then add another line to a file that's already longer than your project's README. The "ignore everything by default" pattern — where you use `*` in `.gitignore` and then force-add exceptions with `!` — inverts the whole model. Instead of asking "what should I block?", you ask "what should I track?" That's a fundamentally more intentional approach to source control, and it's the kind of contrarian thinking that actually saves your ass. The beauty of this pattern is that it forces you to confront every file you add. No more accidental commits of IDE configs, OS junk, or credential files that slipped past a denylist. In security, we know allowlists beat denylists every time — denylists are always one step behind, chasing the newest threat or the weirdest file extension. Git is no different. By defaulting to "no," you eliminate an entire class of "oops" moments. For dotfile repos, for projects with heavy generated output, for monorepos with mixed languages — this is a killer workflow. But let's be real: it's not all sunshine and `git add .` rainbows. The friction is real. Every new file requires an explicit `!` exception, and if you're working on a team, you'll get side-eye from the dev who just wants to commit their scratch file without reading a manual. The pattern also has sharp edges — once you ignore a directory, you can't re-include files inside it without un-ignoring the directory itself first. Git's negation rules are notoriously finicky. So this isn't a silver bullet; it's a tool. Use it for projects where discipline matters more than speed, not for your weekend hackathon repo. What I appreciate most about this article (https://packagemain.tech/p/gitignore-everything-by-default) is that it challenges a default we've all stopped questioning. Git's "track everything unless told otherwise" model was designed for a simpler era. We've spent a decade layering band-aids on top of it — global gitignores, template repos, pre-commit hooks. This is a reminder that sometimes the cleanest fix is to invert the default and make the safe choice the easy choice. The HN thread (https://news.ycombinator.com/item?id=49576258) is already lit with the usual "just use a better tool" crowd, but for those of us stuck in plain old git, this pattern is a genuine upgrade worth stealing.