about the extension fingerprinting
It's a shill classic that I have seen from such at many other places, and mostly bullsh*t as I explained. True, extensions should be careful not to expose more fingerprintable content than necessary. But unless using Tor Browser you will be fingerprinted anyway (maybe even with it), and without privacy extensions, you will be fingerprinted and not have privacy extensions. In fact you will give third-parties more opportunities to fingerprint you because they were not blocked, or if you don't use fingerprinting blockers like Canvasblocker, you will be also obviously be fingerprinted even more.
A more general version of it is: "for privacy, do not alter browser preferences towards more private ones, or that will be fingerprinted !". I have also seen "For privacy use Chrome instead of Firefox, because the less used browser means more fingerprinting !". Or "for privacy do not use private Firefox forks, because less used browser means more fingerprinting !". Obvious bullsh*t for the same reason, do not trust any source that uses such arguments, it's Google and friends behind.
I'd love to possibly get some sources from you, as you seem to know a fair bit about it, so it'd be a great place to start.
Unfortunately given the sad current state of things, I would be in a better position to tell you what sources you should not trust, like that AF project that you linked to, the one that wrongly dismissed LocalCDN.
For example, the two or three most prominent privacy subreddits are deeply corrupt. They will shamelessly recommend everything Apple as a privacy company, for example, and harass, silence and ban under false pretexts those who disagree. Lots of that process is invisible.
The AF guy however is welcomed there to justify the presence of Google Analytics in Firefox code, and all their profitable malware deals, like the Mr Robot ad extension scandal. That's appreciated speech there.
There is a general rule on reddit that conflicts of interest are not allowed from the moderation. However the site reality is that it's the businesses who control the subreddits to discuss their products, either officially or hiding it, and from what I have seen it is the norm for them to abuse that power for their own interests against their users. It's also true for more general subreddit concepts like linux or privacy, it happens that it's lobbies that are the sworn enemies of free software or privacy that control those.
Firefox preference change lists and Firefox forks were also supposedly a good privacy source. However I have already explained above what the AF pref list has become, and that was only giving a few examples about it. There was also the LW Firefox fork that started well although made stupidly unusable for normal users (browser updates had to be downloaded and installed manually, easier install can't even be opted in), which already seriously smelled like deliberate self-sabotage considering that it was not even consistent with their other privacy choices. For some reason, in spite of not having dirty money ties, they were scared of speaking bad about Mozilla's wrongdoing, while it was one the most obvious places were to educate people. But at least it included ubo by default and didn't have a search deal (the beginning of the end when there is one, systematically). But that same AF guy succeeded in indirectly taking control of their pref list too, and already had some flipped back towards the abysmal Firefox state with bogus justifications. Last time I looked, it remained deliberately unusable however, that is probably to stay. More well known Firefox forks typically have search deals and therefore can't really be trusted for privacy. At the minimum, they won't include ubo by default for example, because it might not please their revenue source, or they whitelist their partner site by adding rules by default. Often they won't dare to speak bad about Mozilla (or their own search deal partners like Google or Microsoft), and not even allow it from others, fearing that they could be crushed like insects by harassment, defamation campaigns and more subtle technical sabotage (maybe user agent filtering from large web site security companies ? widevine DRM license ?...) from trillion dollar companies, or that it could reduce their income. If they want to benefit/profit from surveillance, they have to prove that they are part of the family. The PM fork is more outspoken, although not always for the best, but still a search deal, and no ubo by default.
I am sorry to have to say that even ubo, although the most trustworthy nuisance blocker and mostly clean, isn't 100% clean from the influence of Google and advertisers. The main developer who ordinarily behaves heroically in that storm, for some reason, doesn't seem able to lose trust in Mozilla's honesty whatever they do. This means less self-defense against their repeated attacks against his software, that he always considers as justified, not having realized yet that it's Google speaking through Mozilla's mouth. And once even refusing to block their ads. Also, the main maintainer of the main blocking list of ubo, Easylist, is currently employed by an adware company. The other main blocking lists in ubo are from Adguard, sure at least a nuisance blocking company, but that in its own tools whitelists some Google ads under the false pretext that they could be useful.
Such problems need more exposure, we can't let the surveillance industry slowly take control of all the supposed opposition spaces.
