I've just put up a new essay on my web site on whether challenge/response anti-spam systems are good or bad

As some may know, I've been running such a system longer than anybody, having written one in 1997. I wrote a white paper on best practices for such systems that some have found useful.

However, I also see a lot of complaints about C/R systems. Most of those complaints are about the new crop of C/R systems, many of which have annoying bugs. Because some of the concerns are real, however, I felt it was time for an article on those issues for a well-behaved C/R system.

Note that even my own system, in spite of being better behaved that most newer systems, does not meet all my own best practices, though it would if I were writing it again.