vino-server running by default - security nightmare waiting to happen?

This is technically not a bug but rather a matter of security policy.

Noticed this first with gutsy (no idea if it applies to older versions). Actually noticed because a Mac user told me he could see be running a VNC server - he'd just updated to OSX Leopard where they now automatically show systems on the same network running VNC servers. So perhaps I'm dumb for not having discovered it myself, that ubuntu is running a vnc daemon, but it came as a nasty surprise.

Think it's a very bad idea to having the vino server running by default. That's heading into Microsoft territory, running a bunch of daemons by default (most of which are never needed by the average user), and leaving a huge attack area.

I assume (hope) you're not using a default password (i.e. to start with it has no password so no one could have connected) but, assuming I actually wanted to use it, I'd have to change the password, via the the Preferences > Remote Desktop dialog. So given that I need to actually take _some_ initial action in the first place, that action could also include checking that "Allow other users to access your desktop" option, rather than having it running by default.

It may also be interesting to you to see the actions I took from the moment of "Bloody Hell! I'm running a VNC server!"

Step 1:
$ps -ef | grep -i vnc

Nothing!

Step 2:
System > Administration > Services

"So where the hell is the VNC or remote desktop service?"

Nothing!

Step 3:
a: System > Administration > Synaptic Package Manager
b: Search: "vnc"

Aaha! So now I can see "vino" is installed.

c: vino > Remove Package : "Packages to be removed: ubuntu-desktop"

WTF!

Step 4:
A few minutes later, by chance, happen to see System > Preferences > Remote Desktop and finally I can at least disable it.