Why New Files Default to 644

When you create a file with touch, on many systems (macOS, for one) its permissions are automatically set to 644 (rw-r--r--). You never configured this yourself. The mechanism behind this default is called umask.

umask specifies which permissions to remove when creating files. A common umask value, 022, means "remove write permission from group and others." Take the base value 666 (= everyone can read and write), remove the bits in 022, and you get 644. It is not subtraction; it switches bits off. Where the umask is 002, as for regular users on Ubuntu, you get 664 instead.

You can change the umask value in .bashrc or .zshrc. Adjusting it to match your team's security policy is part of a server admin's job.