Just like hashcash trying to prevent mailspam... you just need a bigger botnet. Spammers were never spending their own energy/money.

Well, at least there are less CPU cycles left to ddos wikipedia I guess..

Wouldn't it be more effective to throttle on the server side? You could have the server just artificially take 10 seconds to respond to the request and get the same effect.

Not necessarily. Somebody can spam your form from multiple hosts. If you enforce a proof of work they will all need to work for it.

But somebody can also do the proof of work from multiple hosts (or parallelized on the same host, e.g. with GPU computation). How does a proof-of-work in this case actually do more than just throttling the server's responses?

Because there’s more work involved.

Okay, but that's kinda like saying eating healthy is good because you get to deprive oneself of donuts: that is, I feel like it's mixing up the cost and benefit. The point of the work is (from what I'm understanding here) to make it less feasible for bots to flood a server with requests, but doing the throttling server-side would have the exact same effect more consistently (i.e. in a way that's not easily evaded by GPU/FPGA/ASIC acceleration and doesn't punish normal users).

uhmmmm

okay. I think my compute instances could handle that. the way I pay for them (heroku) usually results in underutilized resources which could accommodate this level of computation.

And pushing these costs to legit users.