loop over bytes, not runes