I've seen folks advocate www-data:www-data ... and others something along the lines of <username>:www-data.

I may be wrong, but the later seems more secure, given for example something like 755 on a particular directory where the former configuration would make it equivalent to 775. Am I missing something?

Thanks