Question: we know that view state is easily get abused, but asp.net webform are heavily depending on this feature.

I want to know whether you disable viewstate by default, and ONLY add it wehn it's needed. Or you take the visual studio default, which actually enables viewstate by default.

Answer: 
As others have said, unless we are talking about a fairly static page, I tend to leave the ViewState on while developing, and begin selectively disabling it when the page works. That way, it's one less thing to worry about upfront. 

You may find this interesting, in ASP.NET 4.0, we will have more efficient control over disabling the ViewState: <http://www.asp.net/learn/whitepapers/aspnet40/#_Toc223325478>
Turn off the ViewState by default by using a `<page>` element in the web.config. Using `EnableViewState="true"` in the `@Page` directive will no longer work once you disable the ViewState in the web.config. If you decide later that you need the ViewState for a specific page, you can turn it back on for just that page using a `<location>` element.

```
<configuration>
  <system.web>
    <pages enableViewState="false" />
  </system.web>

  <location path="MyFolder/MyPage.aspx">
    <system.web>
      <pages enableViewState="true" />
    </system.web>
  </location>
  <location path="Site.master">
    <system.web>
      <pages enableViewState="true" />
    </system.web>
  </location>
</configuration>

```

You need to do the same for any master pages that your ViewState enabled page uses.