At first it was sharing with your list of friends and others (including non-friends) at your location, which was your school. So, from the beginning, your default sharing included people you did not know and had not listed as people you wanted to share information with.
Seven years later that is still the case, and Facebook's business plan seems to depend on you being willing to share with strangers.
Facebook's default sharing profile has changed over the years. See Matt McKeon's great visual presentation of the changes here. The scope of who gets to see information about you if you do not exercise any control has grown significantly as has, until very recently, the complexity of what you had to do to rein in the scope.
After months of relentless bad publicity about its privacy assumptions and controls, Facebook has heard a message -- maybe not "the" message, but at least "a" message. The social networking site has significantly simplified its privacy controls, but its recommended, and I assume, default setting is very broad. Facebook still wants the world to know you, and part of that world includes Facebook applications and partner Web sites. The latter function is benignly called "instant personalization." Facebook has now added a way to configure what information instant personalization will hand off about you.
I first got my Facebook account in March 2004, just about the time that Facebook expanded from being just Harvard to include Stanford, Columbia and Yale, because my boss wanted me to see if Facebook's privacy seemed OK. As Harvard's CIO, he was curious, even though Facebook was not a university effort. I did some poking around and remember talking with Facebook co-founder Mark Zuckerberg on the phone or via e-mail. Things seemed fine to me.
But, when I was asked for my birthday as part of the registration process I did not see a reason that Facebook needed this information, so I made one up.