Being on the receiving end of comment spam sucks. I use two techniques to try to slow it down, but some still manages to get through.

The first of my techniques is wrapping the actual comment posting form in an ajax request. This weeds out bots that can’t handle javascript or XMLHttpRequests. The second is a double-encoded hidden form field in the actual comment posting form. Both the name and the value of that form change every few minutes, rendering old name-value pairs useless and basically preventing comment spam posting without actually hitting the site immediately beforehand.

Like I said, some manages to get through anyway. But I’m trying to do what I can without resorting to blacklists or capchas — which I think are tantamount to giving up, though I admit they may be in my near-future.