So, you think that programs like 'cp', or even perl (for files opened with 'open') should be restrictive, and always generate files with permission '0400' (why stop at 0600?)?

If the answer is yes, there's little point in using a umask, is there?

Their umask is set, they have no way of changing it, and for a long time the umask was set to '0' (which I would not call sane).

Ah, I see. So, because your site used to have a dumb policy, all programs should create files with as restrictive permissions as possible? Now, that's what I call stupid. Fix your site-wide policies.

Abigail