In practice, there are several types of CAPTCHAs: text-based, image-based, audio-based and behavior-based.

Computer scientist writing an article about captchas doesn’t know that proof-of-work captchas exist… Such a joke.

Of course those don’t do much against automated fake form filling, but against DDoS they’re THE solution.

Proof of work (PoW) captchas make the (computing) cost for the attacker exponentially higher than for the website. Basically the website creates a challenge, which has to be solved by the client/attacker before getting access to content. Best of all the website can set the difficulty of the challenge to anywhere from instant to seconds to solve, so normally the users don’t even notice it (as it runs in the background) but once someone starts DDoS’ing the difficulty goes up.