Normally whenever a CAPTCHA might be needed I always present it to the user apriori but the StackOverflow approach is much better, it only shows me the CAPTCHA when it thinks I might be a bot.
I'm interesting in learning the requirements and how I could implement a similar system on my projects. What are the actions that make SO believe I'm a bot? Is there any time frame for doing such actions? Does such a system require any particular database design?
Best Answer
I would log time between actions, and if under (for example) 10 seconds then require a CAPTCHA to continue.