iptables vs chkconfig off

On a laptop though, it's unlikely that you have a multi-homed network scenario, so surely
"open to the local network" is basically only the alternative to "disabled". So in general
users who don't want services accessible to "the local network" should just switch those
services off altogether.

One thing I don't much care for (including in Red Hat's offerings) is adding a service,
enabling it by default, and then firewalling it so that no-one can use it. This is pointless.
Just disable the service by default, and eliminate whole classes of vulnerabilities at once.