also the write bit of the owner should be removed imho (to protect against bugs in other install scripts).
but ofcourse, this should be clarified in the umask help (ie the mask does not cover the write bits), but then we might not call it umask anymore.