Flash required adding a repository for Lenny backports, warnings that my system couldn't be considered stable any more, and warnings from Firefox that I was running an insecure version of Flash until I realised I had to enable automatic upgrades for backports.
MP3 ripping required adding the Debian Multimedia repository, and installing the package gstreamer0.10-lame.
The Sun Java package is in the Debian non-free repository, as is the browser plug-in. (sun-java6-jre and sun-java6-plugin were the required packages.) Marking the packages for installation resulted in a scary message:
You are about to install software that can’t be authenticated! Doing this could allow a malicious individual to damage or take control of your system.This message is scary because malware can find its way into a Linux repository, if the packages are not digitally signed, and ignoring messages like this is the last thing users should be doing. I couldn't find an answer on Google, but the Debian Forum was helpful. It seems I needed the package debian-keyring. Quite why Debian doesn't prompt you to install the debian-keyring package when you enable the non-free repository is a bit of a mystery- maybe I did something wrong or missed a message, I don't know.
All in all, installing Flash, enabling MP3 ripping, and installing Java was a lot less painful in Ubuntu.
And the site that required Java? I went back and tried it again, but nothing happened- either a broken applet, or not compatible with the Sun Java version I have installed. The site wasn't that interesting, so I couldn't be bothered to find out which. So I still haven't really come across a site yet where I really need Java, but at least it's installed now in case I ever need it. :-P