I have seen some services ask the user to create a password on the initial signup form.
I have seen others only ask the user to create a password after clicking on a verification link sent to their email address.
Which is best, and why?
Remember that you're always balancing your business needs against users' needs, so create as few barriers to entry as you can get away with.
If it's possible for users to engage with your site without creating an account or logging in at all, then let 'em: they'll appreciate you for it, and when it's time to gain additional value from your site with an account, they'll be in a mood to do so.
Once they have decided to sign up, ask for as little information as possible: email address (which can serve as their username, provided that it's not displayed, to avoid spammers scraping your site), optional username (if and only if it's valuable to the user to have an identity on your site) and password (without making them type it twice, for Krum's sake!).
Later, if you need more information to deliver further value, then (and only then) can you ask for it.
Finally as @Perchik says in his trenchant comment to @Nick_M's answer, don't force them to sign in once they've already given you their email and password (and, possibly, a username), even if you have to go through an email verification loop: they've paid the price of admission already, so let 'em in right away.
You should have the user get as much of the necessary information the site needs out of the way quickly. It is better UX practice to have them create their password when they sign-up and then send a verification e-mail.
I could see users getting frustrated having to jump from sign-up to e-mail to password creating. It is more efficient to have them fill out username/password on the sign-up and then receive an e-mail verification which re-directs them to their account information after which they can edit if they wish to. Just a suggestion, hope it helps.
I would think its best to ask for a password at the same time as asking for a username and/or email address. This way, the user can (hopefully) log in with their password, AND be able to recover their password via email, if needed.
If you only ask for (or provide) a password during/after the email confirmation, you completely cut off the user in the event of a typo in their email address.