Here's a practical solution I have proposed in my community (autonomous robots):<p>1. package code and data into tarball or VCS repo.;
2. place package on long-lived website;
3. compute SHA1 hash or similar from package (if git is used, this is the revision ID, conveniently);
4. publish the URI and hash in any paper that makes claims based on that code or data;<p>5. as a reviewer, prefer papers that follow this method, all else being equal;
6. as an editor, suggest that submissions use this method.<p>(Edit 2: In case it's not obvious, the purpose of the hash is to allow users to be pretty confident that the code they downloaded is indeed exactly the code used in the paper. By putting the hash in the paper, I make this promise. If I want to make an improved version available, I just put it up at the same site, but I <i>must</i> make the exact original available and identifiable as such. This simple method of ensuring identifiability is our contribution.)<p>My group does this with every paper. I have a paper describing this method coauthored with a student under review now at a good journal, and I'm looking forward to seeing the response. (Edit 1: see link in comment below)<p>I'd also appreciate feedback from HN.