Option 2 is the most complex to set up, and the one that will suffer most from whatever security products the clients have set up. It is best to avoid security issues, since most of the clients are not always in full control (translation: know what the hell they are doing, if they have not outsourced the entire security thingo).
With option 2 you are also going to have some compatibility issues between Windows/Linux/Mac and whatever. If you would require any setup on the client's computers, you may be going up against his Holy Standard Computer Setup, and lose more bids.
Option 1 is the best long-term solution, as everyone has a working browser. It is an acceptable risk (but still a risk) to require a reasonably modern browser (meaning ignore IE6).
Option 1 is subdivided into (1) Web-services, and (2) Web interface. You may need the first one if the client wants to use your system inside his web-portal. However, with a good modular software design, both interfaces use the same basic modules and are just additional thin interface layers.
It is good to use technologies that the client hears about all the time and knows that they are "good". So using a Linux server with Apache and PHP (LAMP) is "good" and "safe", and not to forget to mention : free.
Have you seen Spoon (http://spoon.net/)? This is exactly the kind of thing they're trying to help companies do: run their desktop apps and cloud-based applications.
– Ian C. – 2010-12-15T14:33:15.550