The org.apache.shiro.util.ByteSource ideally shouldn't be in a generic 'util' package. We have an existing org.apache.shiro.io package where it should reside.
Also, the org.apache.shiro.codec.CodecSupport implements a lot of byte-related procedural logic and is subclassed by mostly Hash and CredentialsMatcher implementations. Ideally this class should either be removed or cleaned up to use ByteSource constructs and the other classes changed to prefer delegation to ByteSource behavior instead of inheriting from CodecSupport.
Initially slated for 2.0 due to the backwards incompatibility this would cause.