"One of our working-group members, Dan Blumstein at the University of California, Los Angeles, looks at how marmots respond to predators. He has noticed there are marmots he calls "nervous nellies" that signal all the time. Rather than ignore them, the others spend more time on the nervous nellies' signals because they're trying to find out if they are honest or not," Sagarin says.

Like the nervous marmots, software vulnerability bulletins can raise awareness of real danger, but they can also distract from other activities that could be more productive. In the case of a large-scale software project, such as the Linux kernel, all that wasted effort can become a serious drain.

"One reason I refuse to bother with the whole security circus is that I think it glorifies -- and thus encourages -- the wrong behavior," Torvalds says. "It makes 'heroes' out of security people, as if the people who don't just fix normal bugs aren't as important." In other words, it draws attention to the people doing the signaling -- the so-called security experts -- rather than the overall process of improving software quality.

"In fact," Torvalds goes on to say, "all the boring normal bugs are way more important, just because there's a lot more of them."

Could Torvalds and Ounce Labs both be right? In nature, different organisms approach security through different means. Similarly, what works for the Linux kernel may actually not work for the Spring Framework, and vice versa. As Savio Rodrigues points out in the Open Sources blog, Spring is largely a single-vendor project, while the Linux kernel's governance model is much more community- and merit-based.

As developers, then, how do we find the right balance? How can we make sure that users stay informed of the security risks associated with our software, while at the same time maintaining an orderly and holistic development process? Ultimately, we may be forced to confront an uncomfortable thought: If software ecosystems really do resemble their biological equivalents, then the process of natural selection may play a greater role than we suspect.