Heise has discovered some flaws in the Mac OS X 10.5 Leopard firewall that should give users pause. Undoubtedly, the user can tighten things up, but I have yet to find good directions for doing so.
Apple may or may not be as lackadasical regarding this as Heise depicts them, or they could be fixing this as I write. I would like to think the latter applies, but we shall have to see.
UPDATE!! Here is a point by point refutation of the Heise article cited above. This is very much worth reading.