Small programs survive. Their bugs do too.

You can fit a Base64[1]Ref. 1Base64 rfc-editor.org encoder, connection setup, argument handling and a relay loop into 291 lines of C[2]Ref. 2C (programming language) en.wikipedia.org. That is the reviewed corkscrew.c -- 291 lines, and I can inspect the whole damned thing without trying to remember which service owns which part of a request.

The security review found memory corruption and authentication lifetime errors, and it found tunnel framing failures too. All in my little file. I could inspect those defects easily enough, but being able to read them did not magically repair shit.

I need to be able to hold enough of the program in my head to establish that it's correct. An explicit state machine[3]Ref. 3state machine en.wikipedia.org might be longer than my loop, and still be easier to follow because the assumptions are written down.

I like having 291 lines. But if an intact byte stream takes another page of C in the next version, I'll write the damned page.