This is true, but what needs to be understood is that one really, really should use some form of encryption.... one way or the other. VNC is very easy to install, and most default installations are wrong and highly insecure. RDP is secure by default, so if you're doing windows-to-windows, go with that unless you want to configure VNC properly. For unix end points, a correctly configured VNC session is your main choice. If one can't handle that for some reason, then buy a commercial release of RealVNC.
C//
|