I run Tor on a few flavors of Win7, also Win XP and a couple of GNU/Linux
distributions, including Tails. Even Tor I use in all its three states:
alpha, beta and stable. To make things worse, some run with all scripts
disabled, a few have extensions added.
The firewall should block (reject) outside access, than you open ports as
needed. Care should be taken to avoid some spoofs that might resemble coming
from the LAN. That's about all.
The fact that one app is free software or not is irrelevant in this case.
It's more about mentality. Everybody wants to be a guard in the Panopticon,
even if the guards are watched in their own small Panopticon. There's so much
to read about these concepts so I don't expect whomever is running one site
or another to act different than told on TV.
Everybody *should* have read only access to the entire site. Beyond that is
up to the admins to find a model that fits them best.