There are 2 things going on here. One is permission for people to pull up that file in their browsers (really, that’s permission for your webserver to serve that page), and the other is permission for other people logged in to that machine to read and write that file.
The first is probably prohibited in the server configuration. It’s pretty common for people to put something in apache configuration files to prohibit from serving any file that starts with “.ht”. In fact, I think that’s default in a lot of setups. That may be why you can’t pull the page even when you don’t specifically deny it in your .htaccess. I think you’re alright here.
The other kind of security needs a little work. I recommend a permission setting of 644 on your .htacess. The first digit is for permissions of the owner of the file. 6 is 4+2. The 4 is for reading, and the 2 is for writing. (and the 1 that’s not there is for executing). the second digit is for people in the group that owns the file. You may as well give this 4 for read access. The third digit is for all others. You need to give this a 4 so that the user that runs the webserver process (probably ‘nobody’)can read the file in order to determine what special stuff you’re doing in it.
That’s a pretty quick summary, but you can search google for more on unix file permissions and use of chmod.
