Well, after sleeping on it (and I god damn needed the sleep; I'd been running on six hours over two days) I came to the conclusion that I'm probably being backasswards about this. If the concern is security then in theory uploaded files ought to be more secure than arbitrary urls. We've only had a problem with it historically because early versions of SMF were horrifically naive about what they did with attachments.
The fact that gif animations get nuked in the processing is probably a limitation of gd and not Vanilla. I'll see if that can be fixed. If not, I'll try to figure out what PA's solution is (probably some custom hack - for as modular as this thing is stopped to be, most solutions seem to involve changing something in the core files).
The name issue boils down to "I need to go drop the display name mod in". Kind of irritating that this thing doesn't have a front-end mod downloader like SMF does, but whatevs.
So that leaves uhh... it's ugly, it enforces gender, and post length requires a hard limit. For obvious reasons fixing that last one is going to be super important. I'll check it out tonight.