<pflenker>’s top level post makes a good point here, suggesting that because untargeted bots are your biggest concern, even the simplest custom challenges tend

<pflenker>’s top level post makes a good point here, suggesting that because untargeted bots are your biggest concern, even the simplest custom challenges tend to work quite well (e.g. “enter the number 123 in the last box”) — with ”custom” being the key here! Because: Until large strides are made in artificial general intelligence [1], simple little challenges that are creatively designed will be very difficult for a single general-purpose AI system to crack 100% automatically. In contrast, if your site is targeted with actual human engineers trying to crack your anti-bot system, there’s a good chance they’ll succeed no matter how strong your system [2]. In the case of such targeted attacks, presumably your company will be so important and successful that you’ll be able to afford similarly expensive resources to defend from such attacks. [1] Don’t get me wrong, I’m not doubting that sufficiently general AI is coming that can easily solve such challenges. But for now, to get your startup off the ground, this is apparently an effective short term solution that is very easy to implement. [2] Human-operated “sign up farms” are definitely a thing, in addition to actual human-operated spam / advertising / propaganda farms (imagine a typical “call center”-style office hired to do this).