I found this link quite helpful:
The Canon Question | Called to Communion
Granted I am still a Protestant, though some days I'm not sure why.
This site, Called to Communion, is specifically written by former Reformed/Calvinist people who've become Roman Catholic. As such their inevitable conclusions to all questions of authority, etc. go back to the RC Magisterium. They, as well as all people, are bound by presuppositions. The EO obviously would reject the conclusions, which kind of boil down to "The Canon is the Canon because the Roman Catholic Church has defined it as such, through councils ratified by Popes, please see Matt. 16:18." However they do a very good job of uprooting the assumptions of
sola scriptura, and in particular (see Section B) the "must be in Hebrew" criterion.
I'm finding that what drives the Protestant understanding of the Canon is the need to not allow any earthly authority to "stand above" the Canon itself, because then God's word would be subject to human authentication or authority. So the Bible floats above the Church, which must derive all doctrine from the Bible, but must first know what the Bible is. So the end result is often some mixture of subjective opinion, feelings of being led by the Holy Spirit, selective appeals to the universal witness of the early Church (except when the early Church endorsed the deuterocanon), and most especially to the "self authentication" of Scripture. So circularity does indeed rule that roost. Calvin's own criteria included things like "I can detect the presence of the Spirit in it, it contains nothing unworthy of the Gospel, and it has the universal acceptance of the Church through history." At least he applied that to some questioned NT books (I think it was Revelation...). Problem is, when I apply that same set of criteria to the book of Wisdom, I score 3 out of 3, yet Calvin would disagree. So obviously I'm either misled, deceived, or duped by the Devil? Or, as often happens in Reformed circles, assumed to be under-informed or not have studied enough.
I have lately been having talks with some of the elders and pastors at my church about this very topic. So far I'm finding nothing but the same circular arguments repeated, or recommendations for 800 page books that are supposed to answer my questions.
Here's what I've come to see: the Protestant position was driven by a need to still have authority in the Church, but without any dependence upon bishops--or else they would have to acknowledge that they had broken away and lost authority to teach and exercise discipline. So they assume that the Bible is given by the Spirit, but that the Church is essentially left to figure out the rest. In fact, despite talk of the church being led by the Spirit, in practice it's treated as though God wound up the springs and then just let it run. If one believes that the same Spirit that gave the Scripture through humans in the Church (whether the Old or New Covenant), also guided humans in the Church to recognize and receive those Scriptures, and then to understand and teach those Scriptures, there's no longer a problem of some human authority "standing above" the Scriptures. Rather there's just the work of the Holy Spirit from start to finish.
It seems, to me, futile to either (a) start with a church and derive the Scriptures from it, or (b) start with Scriptures and derive the Church from it. Both must be present together because they're interdependent.
And I would not have said stuff like that a year ago.
Anyway maybe that link will give you some new questions to ask your friend. I will say that if one is led away from
sola scriptura, it doesn't immediately answer the question of where authority lies. That apologetics site assumes that the only viable option is Rome and does a dandy job of entirely ignoring Orthodoxy.