Spoon/library — pull request #15 by janmoesen (2011-10-22 17:24:44+00:00)
Title: Spoon{File,Directory}: try to use 066 for files

There is typically no need for files used by web applications to be executable.
In fact, it might make it slightly easier for attackers to do nasty things.
What use is an executable JPEG, for instance?

This does not address my general concern about permissions being too open: why
would you want the web server to generate files that are overwritable by other
users? In general, shared hosting running under the same user (`www-data`, for
instance) is at risk anyway, and hosting with `suEXEC`-like configurations that
run as a specific user (e.g. `joebloggs`) should definitely not make the files
overwritable by others.