FWIW, all major browsers use partitioned cookies and cache, rendering LocalCDN useless.
Always avoid addons that inject content into the page since they are trivially fingerprintable. Seriously, I honestly think Mozilla should de-list addons like Canvas Fingerprint Defender; they basically broadcast their use.
When you use an adblocker, stay away from third party filters that include advanced filters containing scriptlets. You have to trust all your filter lists to not contain any vulnerabilities or malware. Many filter lists compile resources from other lists with minimal oversight given limited resources.
If you can get by without an addon, then do so. If you only want to use an enabled-everywhere addon on a handful of sites, your only option is Chromium since that allows selectively enabling addons on select sites and one-off enablement on a single tab on-click.
I’d reconsider Ungoogled-Chromium; if you turn off all the telemetry and safe-browsing in regular chromium, the only automatic connections it makes are for:
- component updates
- extension updates
- langpack updates
- Opensearch updates (I think they stopped this).
Don’t take my word; use a packet sniffer with key logs for traffic decryption.
Ungoogled Chromium builds typically significantly weaken upstream’s hardening flags (esp. CFI, let alone their work on shadow call stacks) and hardened libs like ffmpeg, so if you run complex web apps and play media in the browser that might be relevant. I’d also double check to make sure extensions can be updated; they might have stubbed out the URL for extension updates.
I personally split my browsing between Firefox with Arkenfox and Chromium. Firefox for websites and Chromium for webapps. I disable JS by default and also disable JIT compilation (at least, until the V8 team lands the virtual memory cage for some more advanced JITsploitation mitigations).
I’d also think twice about LibreWolf’s fingerprinting defenses. The “resistfingerprinting” setting is an all-or-nothing game; turning it on makes you look like all other RFP users. Librewolf allows changing the color scheme to dark with RFP enabled; this makes you look identical to other LibreWolf users who have RFP and dark mode enabled, which is a population way smaller than regular RFP users; RFP is easily detectable, so this arguably makes users easier to identify. LW devs on GitHub seemed aware of this but haven’t rolled it back. I’d much rather stick with Arkenfox.
