I have disabled JavaScript (and plugins) in surf by replacing line
static gboolean loadimage = 1, plugin = 1, script = 1;
with
static gboolean loadimage = TRUE, plugin = FALSE, script = FALSE;
BTW: why don't you use TRUE and FALSE constants here but use them in line
static gboolean showxid = FALSE;
?
But that way scripts from $HOME/.surf/script.js don't work. Is there
any way to enable them and keep other scripts disabled?
Another idea is do like Arora and implement link hinting in C with
WebKit API, but Arora is GPL'ed so it should be done from scratch.