I haven't seen bot spam go past trivial things. A text field name="url" that's hidden via css gets filled by them. They don't execute JavaScript. Granted, those solutions won't work forever, once they are widely adapted, bots will adapt too, and they obviously won't stop targeted spam.