They know perfectly well that with technology progressing constantly, anything they invest in will be good for only a short while (though comment-spamming and trackback spamming have been good for way too long already). It’s written into their cost-benefit analysis.

“I think the above is a no-brainer for anybody who’s already spamming.”

Just one problem: spammers do have brains.

A) Give up, or
B) Realize that some benefit is better than none, and raise the volume of your posting to take advantage of the inevitable few tenths of a percent click-through?

I think the above is a no-brainer for anybody who’s already spamming.

What will affect it, of course, is better spamming technology. That’s almost certain to happen no matter what the rest of us do. The only question is whether we’re going to have better technology to fight back. The nofollow attribute is an important part of it.

Nofollow takes away most of the benefit of one type of spam (the kind intended to boost page rankings), while creating no new benefits for the other (the kind intended to be read). From that, it’s axiomatic that the net impact on spam will be negative.

I think your analysis is off there; it takes away the benefit of one type of comment spam, sure, but in so doing it makes the other much more attractive to anyone who’s already committed to spamming as a strategy. The reasoning here is that one type of comment spam requires PageRank benefits to function, and the other doesn’t. Take away the PageRank benefits and it’s easy to see what will happen. Thus the net impact, insofar as it can be predicted, is an increase in the second type of spam.

More generally, look at the big picture. Nofollow takes away most of the benefit of one type of spam (the kind intended to boost page rankings), while creating no new benefits for the other (the kind intended to be read). From that, it’s axiomatic that the net impact on spam will be negative. If comment spam increases over the next few months (and I have little doubt that it will), it will be in spite of developments like nofollow, not because of them.

As to whether spammers are currently “holding back”, I’m still somewhat undecided but leaning in that direction. It’s true that there’s an awful lot of comment spam out there, but it’s a drop in the bucket compared to the volume we see in email and on USENET. Now I know for a fact that comment spammers have access to mass-posting software and other tools just like their brethren in other media, so why is that? I wonder sometimes if what we’ve seen up until now wasn’t just testing the waters; after all, certain weblogging tools made it ridiculously easy to ride the comment-spam gravy train for a very long time, so all a spammer needed was the occasional burst of posts to high-PageRank weblogs. And that was good business sense from a spammer’s point of view; if you don’t have to make twenty million posts to turn a profit, don’t. Now that we’re closing some of the loopholes I think we’ll see the firehoses get turned on in earnest.

However, it would be an effort to update the bots if posting systems change. Perhaps that effort is justified.