First, some background on where I’m coming from. I’m also a developer who once wrote an Eclipse plugin. I think I had a similar motivation - Eclipse lacks some functionality that I miss from my previous editor, Emacs (and so the name “Emacsish”). One of the things I miss about emacs is it’s “emacsclient”, which like “eclipseclient” can be used to trigger an existing Emacs instance to load a file from the command line. I was thinking about writing something like this for Ecilpse, but you beat me to it.

Here are some of my thoughts about the FileDrag plugin:

1) Version 3.2.0 of eclipseclient-* does not seem to work with Eclipse 3.3 whereas latest CVS does. Maybe part of the point your changes in latest CVS is to support Eclipse 3.3 in which case this does not surprise you.
2) I don’t recall trying it in Eclipse 3.2, but drag and drop seems to be natively supported in Eclipse 3.3. Specifically, if I drag something like “/etc/profile” in nautilus in Fedora 8 to Eclipse it works with or without the FileDrag plugin. I set some breakpoints and it seems that the FileDrag code is not playing a role when the file is dragged over. Maybe you want to try to detect the Eclipse version and disable the drag and drop functionality if it is Eclipse version 3.3 or later.
3) You enforce whether or not remote connections are allowed by checking if the remote address of the socket is the loopback address. That approach is *probably* secure since if a remote host tried to forge its return IP address in the IP header the reply packets wouldn’t route back to the remote host. But it might just be simpler and more secure to bind to localhost instead of checking the remote address.
4) It would be nice if there was something more secure than accepting any local connection, but that’s a harder problem to solve. Some ideas:
4a) The X cookie approach - Keep some secret piece of information in the user’s home directory that is only readable by that user. eclispeclient-* reads it and sends it to port 7400. The FileDrag plugin verifies it.
4b) Use named sockets on platforms that support it. Permissions can be set on the named socket so only the user that started Eclipse is able to bind to it. I don’t know how this in done on Windows.

I might be willing to help with some of this, if you are interested. Feel free to contact me.