1. Are there any security requirements documented for this project? Not aware of any. 2. For each service that is created, installed, used, or depended upon, describe, how it is compliant with the Install-Time Security Policy ( http://sac/cgi-bin/bp.cgi?NAME=ITS.bp and/or http://www.opensolaris.org/os/community/arc/policies/ITS/ N/A 3. Describe how to disable each service from your project and the side effects (e.g. dependencies) of doing so. N/A 4. For each service, discuss how it protects its communications from: theft, replay, content change and user impersonation within the following sub-sections: N/A 5. For each network (e.g., RPC over IP, TCP/IP, Serial, etc.) used by a project describe the following: Eclipse uses netqoek access to connect to it update center. It could also use network to connect to different servers: version control servers, Java EE servers, database servers, etc. 6. Does this project use secret information (e.g. passwords, passphrases, PINs or equivalent authenticators) during authentication and/or authorization? Eclipse uses secure storage system: http://archive.eclipse.org/eclipse/downloads/drops/S-3.4M6-200803301350/eclipse-news-M6.html#Equinox 9. Except for networking (discussed above), does this project use cryptography for any purpose? Yes. Eclipse uses ssh connection for CVS access (JCraft plugin). http://www.jcraft.com/jsch/