File create permissions, what am I missing?

[João Carlos Mendes Luís]

Brooks Davis wrote:
> On Fri, Aug 12, 2005 at 06:34:34PM -0300, João Carlos Mendes Luis wrote:
> 
>>In a directory with -rwxrwxrwx, any user can create files, but who should 
>>be the owner/group of this file?
>>
>>Long time ago in Unix history, the owner would be the user who created the 
>>file, and the group would be the users's primary group.
>>
>>Later, IIRC, if the directory group was one of the user's secondary groups, 
>>the file would also be from this group.
>>
>>A later modification defined that a setgid directory would effect in all 
>>files created belonging to the directory's user.
>>
>>Am I correct?
>>
>>But I have already tested 3 system, 2 with 5-stable and 1 with 4-stable, in 
>>which the created file inside a -rwxrwxrwx directory is created belonging 
>>to the directory's group, WITHOUT the setgid bit.  What did I miss?
> 
> 
> On BSD systems, the group of a file is always the group of the directory
> it is in.  This differs from SysV UNIX.  The resident grey-beard at work
> feels this is a new and annoying behavior. (i.e. it wasn't always this
> way. :)

So this is expected behavior?  Isn't this someway insecure?