While the images over HTTP seems really trivial to fix and can be considered as a "big mistake" from the devs, the other point in this article about the number of bytes is trickier: wondering if any other HTTPS traffic could be "guessed" like that (likes on facebook or instagram? ...), any other known case of that kind? how would one protect against that?