Rust

Last updated: Oct 28, 2026

Rationale

Rust is the language of Fluid Attacks for low-level components where performance is most important.

These are the primary reasons why Fluid Attacks selected it:

It is open source.
It is memory-safe by design. Its type system prevents full categories of bugs at compile time, for example, null dereferences, data races, and unhandled error paths.
It has very powerful static typing with algebraic data types and exhaustive pattern matching. Developers can use them to encode business invariants, so that incorrect states are not possible.
It is a compiled language that makes self-contained native binaries. Thus, the distribution to clients and CI environments is easy, and an external runtime or virtual environment is not necessary.
It supports cross-compilation to many OS and architecture targets from one build environment.
It is one of the fastest programming languages on the market. Its execution is predictable and has low latency, with no garbage collector pauses. This is essential for the scanner workloads of Fluid Attacks.
Its dependency management with Cargo is much better than the Python dependency management, with a reliable build system and reproducible environments.
It naturally supports the engineering values of Fluid Attacks: immutability by default, first-class functional programming patterns, and algebraic data types as parts of the language.

Some of these languages have strengths that Rust also has. But none of them has the combination of correctness guarantees, native binary distribution, and predictable performance that Rust has. These three attributes have the highest weight for the workloads of Fluid Attacks. (a) If Fluid Attacks changes to one of these alternatives, it must migrate the current components. (b) Each alternative has important disadvantages for these three attributes. (c) In the evaluation, Rust had the highest total score for the weighted attributes.

Python

It is open source.
It is a high-level language that is easy to read and write.
It has a very large community and ecosystem.
It has a large market. Thus, it is easy to hire developers.
It supports static typing only as an optional extension with mypy, not as a built-in compiler guarantee.
It is an interpreted language. Thus, it cannot produce self-contained binaries for distribution.
It is much slower than Rust for CPU-bound workloads, and it is a bottleneck in the scanner components of Fluid Attacks.

Python is the current baseline of Fluid Attacks. These problems started this evaluation: no compile-time correctness, a hard binary distribution, and a slow scanner throughput. They are structural limitations of the language, and tools alone cannot resolve them.

Go

It is open source.
Its syntax is not as easy as the Python syntax, but the difference is small. Most developers can learn it easily.
Its community and market become larger.
It compiles to native binaries and supports cross-compilation.
It has a garbage collector, which causes non-deterministic pauses under memory pressure. Thus, its performance is less predictable than Rust for the workloads of Fluid Attacks.
Its type system does not support algebraic data types or exhaustive pattern matching. Thus, it is not easy to model domain invariants at compile time.

Go is a strong general-purpose alternative. But it does not have the correctness guarantees or the performance predictability of Rust for CPU-intensive applications.

Haskell

It is open source.
It has the strongest functional programming and type system of all the candidates, with full support for higher kind types and purely functional idioms.
Its community and ecosystem are small and specialized.
It has a very small market. Thus, hiring and onboarding are much harder than for the other candidates.
Its ecosystem for the critical dependencies of Fluid Attacks (AWS SDK, tree-sitter) is small and has no commercial support.
It is hard to learn, and it is very different from Python or TypeScript.

Haskell has the highest score for the engineering values. But it has a low score for ecosystem viability and talent. Thus, its onboarding and ecosystem risk are too high for production workloads.

OCaml

It is open source.
It has a strong type system with algebraic data types and pattern matching.
Its community and ecosystem are small and become larger slowly.
It has a very small market, and the number of experienced engineers is very small.
Its ecosystem for AWS and tree-sitter is not mature.
It does not have the native safety guarantees for memory and concurrency that Rust has.

OCaml has some of the type system strengths of Rust. But it is not as good as Rust for performance, memory safety, ecosystem viability, and available talent.

Usage

These components use Rust:

Scanners: Sniffs, Peels, Pings, Probes, and Flags.
Libraries: The core libraries, which are the shared crates of Fluid Attacks on crates.io.
SDKs: The Tracks Rust SDK.

All the Rust components have the same architecture. They get their build, linting, testing, and deployment from one federated foundation.