I think in either case little is gained or lost. Enough people disable javascript that the set size is still going to be significant, and if somebody is skilled enough to hack you with javascript they can probably hack you without it as well. I choose to disable javascript primarily because I am more concerned with having a slightly more hardened browser than I am with blending into a larger crowd. I don't really care if they can determine that there is a 1:50,000 chance that kmfkewm visited some other site, versus a 1:500,000 chance. I would rather make life a little bit more difficult for the person who tries to root me.