[shmerl]

> Also, running a browser (or anything as complex as a GUI app, but especially anything as wildly complex as a browser) as root is probably a bad idea security-wise anyway.

Yes, that's why using mar + updater is probably the only "right" option, but it's way too manual. I even thought about writing some script which would extract http sources for mar file based on the current update channel but didn't figure out yet where it's configured.