depend on bytes; compliant with -safe-string