OpenHAB is Java based. Java has long been regarded as the most insecure of all programming languages and I will not allow it on any of my computers.
[...]
The Department of Homeland Security recommends removing/disabling Java.
The Department of Homeland Security recommends not using Java in a web browser and disabling the Java Web Plugin. If they recommend uninstalling the runtime too, I suspect that is for users who don't know how to disable the web plugin without removing the software or don't know how to practice good general security habits when trying standalone applications, which is not limited to Java. All of the news stories and discussion I have seen about the security dangers of Java has been specifically related to its use in a web browser. There is a difference between running a few standalone applications with it and giving it access to everything your web browser has access to.
For running standalone desktop applications, it's as secure as most any other runtime environment that desktop applications run in if not more so due to its sandboxing. Java is also the most popular language for development of server-side applications and it doesn't look like that's going to change anytime soon.
I haven't used OpenHAB, but it looks like the server (a standalone application) runs in Java. So it implements an HTTP server in Java code but doesn't directly install into or integrate with a web browser by doing that. The client connects to the Java-based server with a web browser, but I don't see anything on their pages about it requiring the Java Web Plugin on the client side. The only note I see about the client browser is that it is designed for Webkit-based browsers. If Java is not required in the client browser, the warning from Homeland Security does not apply.
I only say this to say that Java security concerns should not be something that scares people away from trying this application. By all means, disable the Java browser integration and the Java Web Plugin. If the software doesn't work at that point, then you can call it a security risk.
BTW, I have no business interest in Java or applications/services/companies that use it!