This not universally good, but I would never open a port to a VNC server anyway, encrypted or not. Tunneling a passwordless unencrypted protocol through a SSH tunnel is fine, still.