I stopped using default passwords on self-hosted services after realizing how quickly they get compromised
Keeping default credentials on your self-hosted services is the biggest mistake you can make
We haven't written up this one. XDA Developers has the full story — the link below goes straight to it.