I was reminded earlier today about one of my biggest XF peeves: The repeated and frequent insistence by a whole lot of folks that data and internal_data need to be set to 777 because it's a "XenForo Requirement". The requirements may in fact tell you to do it, but it's bad form. All you really need to do is ensure that your webserver can write to the directory. That's it. That might mean chowning the directory apache:apache and setting the permissions to 700. It might mean chowning it to root:apache and setting it to 775. But 777 is not required.