Suggestions

[aceres]

When working with something like a game, these issues may not be too likely to surface but you need to remember that this model viewer has direct access to the filesystem on the server and, as such, poses a much more significant threat. While there is no way to completely avoid potential problems when giving applications filesystem access, using JavaScript as the primary method of interaction forces all of the processing to happen on the client and reduces the number of ways it can be abused.

Either I or you misunderstand something here. I believe SWF files are just like JS files in this regard. They just get downloaded and their codes run on client side. Flash player can send requests but without something to respond to them on the server side, nothing will happen. There's a Flash Media Server program but you don't need to install it on your server to have SWFs on your site. SWFs are played by the Flash Player on client PCs (like JS are run by JVM on client) and I think as long as there're no malicious codes in their sources, SWFs can't harm client side either. Also I don't think someone can embed malicious code in their model archives which will somehow run when viewed by the 3Dviewer so both client and server should be OK. At the very least, server should have no risk since SWF is not a server side file (unless your server has an ability to run them).

Even if we ignore the security issues though, the big one for a site like this is compatibility. Looking at the last month of visits to tMR, a little over 10% of them came from mobile devices (either phones or tablets). This may not seem significant since that implies 90% came from desktops but 10% is still a good number of visits and a Flash-based model viewer wouldn't work for any of them. I realize our sites aren't currently optimized for a mobile experience yet (though it is on our roadmap) but if we're going to spend time developing a feature as complex as an embedded model viewer, it needs to work everywhere. That automatically means Flash is off the table for the final product.

Well, this concern is understandable but I have to warn, HTML5 never guarantees perfect compatibility either. Some browsers/devices may not be able to handle properly so at the end of the day, there's no absolute solution for all here. Still I hope someone can make one in HTML5.