Use Subversion ( http://subversion.tigris.org/ ) , when it is ready.
I would say, "use CVS", but it will never be ready, because the backend storage model does not support sandboxes (many short-lived experimental branches) well.
Why does Subversion work?
secure: branching/merging are almost trivial. rejecting/accepting a patch is very easy.
barrier to entry: actually lower than with web/email-based interface.
a developer with the commitment/skill level to contribute useful patches will probably already have the tools installed
the tools create a valid patch automatically (no fiddling with diff options) based on current development (not what the person downloaded a week ago when he started the project)
other developers can immediately (and easily) apply the patch and evaluate it.
the automated build/test procedure can see and verify the change very quickly, rather than waiting for a harried developer to download the patch from the clunky web interface and apply it to code that has changed four times in the week since the patch was created.
(all of these points except the first also apply to CVS.)
Combined with a Roundup discussion, this is a killer tool with very useful history features.
Bonus: subversion uses WebDAV as its native network protocol, so you get a simple browser interface for free.
-- TerrelShumway - 16 Apr 2002