After trying a couple of the other "internet" thermostats (not Nest, though, that was too obviously creepy), I ended up springing for a Proliphix IMT550c, which I had to wait for a while to show up on eBay, since they stopped selling direct to consumers quite a while back.

It's not exactly open, but it's reasonably hackable, and works just fine with no direct access to the Internet. I've never tried the wifi model (replace the "c" in the model with a "w", IIRC), since avoiding wireless issues was part of what drove me to this model in the first place.

Security's almost completely absent, so you'd want to keep it on an isolated network with no direct Internet access, anyway.