Yesterday, I had to get a PHP app running locally on my brand new, plain-vanilla Mac Mini. I was disturbed (to put it mildly) to discover that Apache was already installed, and running, and serving connections to the outside world. I also discovered that the Mac firewall is off by default.
So I went to System Preferences / Security and Privacy / Firewall and turned it on. I rebooted and confirmed that it's still on.
And I can still access Apache from another machine on the subnet! Which means that anyone in my office can now run this PHP app without restriction!
It would not be appropriate for me to use the language I would like to use to describe the extraordinarily poor judgment that Apple has displayed by setting the system up in this way. So I'll just ask -- what, exactly, is going on?