There are a few features of Flash that require either filesystem access or TCP/UDP sockets, which we are never going to be able to support while interoperating with native Flash Player. We can at least hypothetically emulate RTMP and some peer-to-peer functionality by wrapping it in WebSockets or WebRTC, but that only allows communication with Ruffle-aware servers and Ruffle peers (or a patched version of Lightspark). Local Shared Objects can be emulated with cookies but we cannot share LSOs with Flash Player, which stored everything in a separate Flash-specific cookie jar. Flash also had it's own cross-domain policy mechanism, which we could technically support with the extension, but for security reasons we're probably going to just use standard CORS fetches and hope any websites that need it are updated or proxied to support it.

We obviously also cannot support any of Flash Player's DRM features, not for any particular technical reason, but because we (and likely Adobe) are legally restricted from shipping a pure-web decoder for that DRM. We probably could proxy to an Adobe-provided EME plugin, but that would require cooperation with Adobe and major browser vendors for a 0.01%er preservation use case. We also cannot proxy early Flash video as no browser appears to expose native/hardware H.263 or VP6 decoding, so we'll have to ship software codecs that will probably perform like hot garbage on HD video. Fortunately, I don't think there's a lot of SWFs or FLVs with HD video in those codecs anyway.

Flash also allows you to enumerate device fonts, which used to be possible on the Web but isn't anymore. I don't think anyone will miss it.

However, the web sandbox is so large and all-encompassing nowadays that all of the above seems like small caveats. The vast majority of Flash content that people actually want to use is either standalone movies (Newgrounds, Albino Blacksheep, other portals) or static websites (e.g. Homestar Runner, Homestuck). The big hurdles for that are AVM2, dynamic text & inputs, and Stage3D. All of those are almost-perfectly enclosed within the web sandbox. Most of the sandbox-prohibited stuff is necessitated by websites which likely either have executed a transition plan to web standards (and thus won't be using Ruffle) or are willing to put up with whatever extra wrappers or steps we require to make these old APIs work.