Online or as an open-box special from Best Buy is the most-oft used way. Almost all the STBs on the market are tied in to one of the two US satellite providers (dish/directv); the DirecTV recievers let you watch HD OTA programming whether you are subscribed to their service or not. All you need is an antenna.
BE AWARE though: If you buy a unit new from a store, they may require you to keep satellite service on the unit for up to a year. Ask them all about it.
the Dish 6000 rcvr also allows OTA without subscription, but the last info i had you still need a dish pointed at the sat. this is supposed to be changed thru an upgrade (available OTA via sat), but i don't know if/when this has/will happen. keep in mind that the 6000 needs the 8VSB plug in module for OTA reception.
to my knowledge, Samsung makes the only "OTA only" STB, the $599 SIR-150 (i think). it appears to be on closeout as they have three new units expected soon, around June. the 150 can be found on the net for around $500 shipped, combine that with the current $100 mail in rebate from Samsung and you're in for $400. i expect that it will be available even cheaper before too long. go to www.pricescan.com for the cheapest prices.
one of the new units will have an MSRP of $399, so i'd expect it may be the hot product for a while, as long as it is a decent performer.