I have disabled JavaScript (and plugins) in surf by replacing line static gboolean loadimage = 1, plugin = 1, script = 1; with static gboolean loadimage = TRUE, plugin = FALSE, script = FALSE;
BTW: why don't you use TRUE and FALSE constants here but use them in line static gboolean showxid = FALSE; ? But that way scripts from $HOME/.surf/script.js don't work. Is there any way to enable them and keep other scripts disabled? Another idea is do like Arora and implement link hinting in C with WebKit API, but Arora is GPL'ed so it should be done from scratch.