The more sophisticated and less automatable techniques have higher overhead and can degrade user experience. You don't want to ask users to perform 10 special a

The more sophisticated and less automatable techniques have higher overhead and can degrade user experience. You don't want to ask users to perform 10 special actions in order to identify themselves as human. And if you pick 10 of those actions randomly out of a bank of 100 types of action then the spammers will reverse-engineer each type of action individually and then will produce a function to map what's displayed by the user interface to each type of action. The problem is that the more the CAPTCHA-like artifacts creation process is automatable the more their cracking tend to be automatable. And if you truly find a way to generate CAPTCHA-likes cheaply and that are impossible to crack by machines then the job will be shipped to the third world or the spammers will set up sites where you have to accomplish the cracking, perhaps without even knowing it, to get to the free stuff. I don't expect to see the Tragedy of the Commons problem resolved this century.