Clever. I assume the only way for Facebook and Twitter to circumvent this would be to fake all of the HTTP headers sent by, say, a modern version of Firefox. I

Clever. I assume the only way for Facebook and Twitter to circumvent this would be to fake all of the HTTP headers sent by, say, a modern version of Firefox. I don't think it's cheating - even though the tools are bots, their job is to preview the content their users are about to see. Even then, the author could probably find out which IP addresses are used by Twitter and Facebook's lookup engines and send them the innocuous version. However, I just did a test on my own server, and Facebook used two different IPs (69.171.228.246 and 69.171.224.245) for the same request. Pretty big range.