I've just put up a new essay on my web site on whether challenge/response anti-spam systems are good or bad
As some may know, I've been running such a system longer than anybody, having written one in 1997. I wrote a white paper on best practices for such systems that some have found useful.
However, I also see a lot of complaints about C/R systems. Most of those complaints are about the new crop of C/R systems, many of which have annoying bugs. Because some of the concerns are real, however, I felt it was time for an article on those issues for a well-behaved C/R system.
Note that even my own system, in spite of being better behaved that most newer systems, does not meet all my own best practices, though it would if I were writing it again.