meta-attack: unfriendly contribution setting dissuades participation and thus peer inspection of source code

[kristovatlas]

Perhaps it should even be valued if the source is free software: projects that are open source but using restricted licenses tend to have less peers than free software projects.
-- @schildbach
#13 (comment)

A countermeasure would be to have a less restrictive software license explicitly stated on a repo, I suppose.

Some other things that could dissuade community participation could be:

• lack of contributing guidelines on repo
• low rate of accepting PRs

Bounty programs might also be some kind of metric for peer review of security.

As it's late in the game to include this in our 3rd edition threat model, I'm setting this to a 4th edition milestone.

Two open source wallets that come to mind as interesting to compare:

1. https://github.com/blockchain/My-Wallet-V3 (The JavaScript wallet engine for Blockchain.info's web wallet and iOS app)
2. No contributing guideliens
3. No apparent license
4. https://github.com/bitpay/copay
5. Has contribution guidelines
6. MIT license