ratcline

I believe this is often people who ARE in fact contributing via the mailing list -- but want a track record tied to their GH account.

It's not doing it on it's own, I believe what they're referring to is a a pre-configured distribution of a shell packaged with some distributions of Git, for some OSes.

It's mainly mitigating exposure. Some possible vulnerabilities would be social engineering(i.e. it'd be easier to send a targeted phishing URL to gain recon on an employee of a company if you know an internal domain), or injection into a public facing service that has access to internal services.

what's with the weird underscore repo name?

Re:Captcha uses your IP and Google account to try to determine if you're a real human or a bot. If you're signed into a brand new Google account, or logged out of one, it'll be more likely to prompt for Re:Captcha.

Little did we know how realistic that would end up being.

I heard that systems like this were designed when there was a point in time(this may just be erroneous and such a time never actually existed) where keyloggers were more common than RATs, so government websites would often have this requirement due to the higher probability of access from public computers(library, etc), since that was also a point in time when fewer people had their own at home.

It may not be if it's songs that were popular in that area during that time rather than songs FROM that place. I'm not sure if they differentiate which it is, I didn't see any at a glance.