In a world where bot herders try to blend in with the crowd, and historically lots of them aren't great at it, you have to be careful about your choices. It's v

In a world where bot herders try to blend in with the crowd, and historically lots of them aren't great at it, you have to be careful about your choices. It's very easy to look like a bot by accident, and odds are pretty good that anyone who sticks out is likely to be a bot. Just like odds are quite good that any HTTP request coming through Tor is quite likely to be malicious. This is a pretty shitty scenario all around. It shouldn't have happened. It should never have come to this! That said, I've yet to see a better solution on offer for general-purpose low-effort anti-abuse purposes. People here on HN generally seem to either hate CAPTCHAs with the passion of a million blazing suns (but have nothing better to offer) or want everyone to use something strictly worse (like argon2 hashing).