> But that allows trivial JavaScript injection from the Flash object, doesn't it?

Does it? As far as I know iframes are isolated from the embedding page, but I don't know about flash objects. I'd be okay to disallow `<object>`, if flash through an iframe is secure. Otherwise, we could allow custom markup (through a markdown extension or not), which is evaluated through Javascript (e.g. `<div class="embedded-video" data-service="youtube" data-id="xyc">`). But I'd prefer to avoid this if it isn't needed.

> How about something completely different: If we make the changes in #203 conditional upon an installation-specific setting adhocracy.allow_user_html (we can even default that to true for a transition period), legacy users can continue to use HTML, while other installations can simply default to markdown. Does that work for you?

Making either *user html entirely* or *embedded content in user html* configurable is fine for me (in addition to this pull request and the potential changes regarding embedded flash insecurity).