Mark Shuttleworth is the founder and former CEO of Canonical, the commercial company behind the Ubuntu Linux distribution. Today he holds the position “Lead Product Design”, a role in which he shapes desktop and cloud product strategy. I spoke with him recently by phone about the increasing role of Linux in the enterprise, and the shift from traditional enterprise computing to cloud computing.

Canonical and Ubuntu made a big splash early on by intensely focusing on a usable Linux desktop experience. They pared down the dizzying number of packages available in Debian and selected a few best-of-breed applications to install by default. The installation process was streamlined to be as easy and as intuitive as possible. Ubuntu was a huge success and quickly gained a passionate following.

Since its debut in 2004, Ubuntu has gone beyond just being an easy-to-install variant of Debian, and Canonical has worked to extend Ubuntu’s reach beyond the traditional desktop. Most recently Canonical has been pronouncing Ubuntu as the most popular OS for cloud computing environments; and they’ve also been trying to establish success in the enterprise data center.

Shuttleworth opened our conversation with a quick overview of what Canonical and Ubuntu have been doing of late. He articulates clearly that Canonical’s focus on quality is the same in desktop and enterprise markets. Just as consumer-oriented businesses are extremely sensitive to product flaws and issues that lead to customer dissatisfaction, so too are enterprise oriented businesses who focus on mission critical operations.

Canonical employs many practices that build a quality baseline that are good for both consumers and enterprises, asserts Shuttleworth. More specifically, any efforts Canonical might apply toward enterprise customers are not done at a cost to desktop success.

We’re in scale-out deployments
Ubuntu is now available as a supported operating system from Dell, HP, and other OEMs, which makes it much more viable for enterprise customers. But desktop and server certification is only part of the story: SAN systems, database servers and more all need to be fully supported before they can be used in an enterprise. I asked Shuttleworth whether Ubuntu was pursuing certifications from the likes of Oracle in order to gain more enterprise traction. “I wouldn’t use anything other than Oracle Linux if I was running an Oracle database,” was his response.

He told me that Oracle has made it clear to them that Ubuntu will not be a certified platform for Oracle databases. This didn’t bother Shuttleworth at all. “We’re in scale-out deployments, like Hadoop, OpenStack, nginx, Condor, etc,” he said. Shuttleworth believes that all of these technologies should be on every CIO’s roadmap for the next five to ten years, and that Oracle really isn’t relevant to this market.

Shuttleworth went on to say that virtualizing computing power is getting to middle age. In his opinion, there are good proprietary and open source solutions for compute virtualization. “That scene is settling down,” he said. But, according to him, storage and network virtualization are just getting going. Cloud solutions don’t often rely on SAN storage, but rather use Hadoop, Swift, Ceph, and the like. The commodity hardware underneath open source infrastructure — compute, storage, and network — is going to be key topic in next 5 years, and Ubuntu is right in the middle of this.

Ubuntu is the best place to consume these resources, thinks Shuttleworth — it offers frequent stable releases of these and other new technologies. Red Hat, Shuttleworth concedes, is still relevant for mission critical single server solutions. But he believes that Ubuntu is better for scale-out deployments. Similarly, in Shuttleworth’s estimation SUSE has a strong mainframe and POWER architecture relationship with IBM, and they remain relevant in those sorts of environments “but we don’t see them in cloud or scale-out conversations much.”

As popular as “the cloud” is, the reality is that many organizations aren’t yet embracing it fully (if at all). With this in mind, I was curious about Shuttleworth’s opinion of the value proposition for Ubuntu versus other, more established enterprise Linux distributions like Red Hat and SUSE. He acknowledged that traditional workloads were more likely to be deployed on those other distributions, but insisted that companies building internal cloud infrastructure are more likely to do so on Ubuntu.

And Ubuntu is still extremely popular for traditional web server roles, as well as a platform for handling big data and quick scalability. Shuttleworth mentioned Instagram’s use of Ubuntu with obvious pride.

One of the reasons Ubuntu is so popular as a cloud guest is that it is completely free. Red Hat doesn’t provide a free distribution, and CentOS doesn’t provide any support for their compiled version of the Red Hat sources. As such, Ubuntu offers the best of both worlds: free to deploy en masse, but with a paid support option available when it’s needed. This begs the question: if Ubuntu “wins” the cloud guest OS competition, how does that affect Canonical’s revenue stream?

Shuttleworth claims that as deployments grow, so too do paid support subscriptions. Without offering hard numbers, he said that Canonical has seen a very satisfying acceleration of paid customers. This is completely typical — first Linux gets deployed for internal development purposes, then it sneaks into skunkworks applications, and is finally recognized as a first class offering. At that time, support becomes necessary.

Ubuntu sits at the intersection of free software and users
My day job uses mostly Red Hat Enterprise Linux, and as such I track a number of upstream projects in which Red Hat participates and which might land in future versions of that distribution. I don’t track as closely the things that Canonical is doing. With that caveat, it seemed to me that a number of recent Ubuntu initiatives — Juju, Metal-as-a-Service, and AWESOME — had a decidedly Ubuntu-only feel to them.

I asked Shuttleworth about this, and what I perceived as the contrast between Red Hat’s upstream-first development policy. The Canonical founder got fired up in his response. I clearly struck a nerve with Shuttleworth. “There’s nothing Ubuntu-specific in any of these,” he told me somewhat curtly.

He went on to articulate that Ubuntu sits at the intersection of free software and users, and that they act on what they see — whether that’s fixing bugs or building new tools. Shuttleworth highlighted Canonical’s long-running support for GNOME, KDE, and XFCE, and observed that several patches were landed in Unity to specifically benefit other Linux distributions.

“I respect Red Hat, they’ve played an important role bringing commercial software to the mainstream,” Shuttleworth told me. But he took exception with the notion that Red Hat was somehow more “upstream first” than Ubuntu. He pointed out that Juju has been ported to Mac OSX, there’s nothing Ubuntu-specific in MaaS, and that AWESOME is simply a Python daemon not tied to any particular platform or distribution. Saying that any of these projects are Ubuntu specific is “like saying ‘DeltaCloud is Red Hat specific’,” Shuttleworth said.

He expanded on the issue of “contribution” by pointing out that it involves a lot more than just lines of code. Indeed, that alone is a poor metric for measuring contributions. There’s also design, quality, ease of use, leadership and other harder-to-track but vitally important contributions, all of which Ubuntu provides to different projects in different ways.

We are strengthened by diversity
I next asked what Canonical is doing, if anything, to encourage diversity in open source communities? Shuttleworth told me that Ubuntu had just recently updated their community Code of Conduct. Ubuntu, according to Shuttleworth, has led the use of codes of conduct in open source communities. This was an intentional decision based upon founding members experiences with vitriol, personal skirmishing in mailing lists, and other less-than-welcoming behaviour.

The Ubunutu community decided collectively to take a strong stand against this kind of behaviour. They wanted a community that was pleasant and focused on a shared view of bringing goodness to people, rather than one based solely on personal interests. “We are strengthed by diversity,” Shuttleworth said.

“Because we explicitly frown on flaming and hostility,” Shuttleworth said, “we have retained good people for a longer period of time.” According to him, it’s hard to participate long term in any open source project because of so much change: it’s hard to keep up. “If people are unpleasant to one another, the motivation to stick around diminishes greatly.”

He railed against what he called the “bad culture of ‘bro-gramers’,” where participants insult one another. Worse yet, according to him, was hostility between competing open source projects and companies. “If Microsoft said some of what Red Hat says about Ubuntu, the community would be outraged!” Shuttleworth exclaimed.

Society is not benefitted by software patents
I switched topics in our conversation, and next asked Shuttleworth how he felt about software patents, and how Canonical as a company felt about them? This was another topic about which he got fired up. He told me that he’s long been interested in the intersection of society, technology, and economics. The history of patents, he said, is grounded in the question “what will accelerate human progress?”

Patents were designed to get people to talk about their secrets, Shuttleworth opined. Industrial progress used to be all about keeping secrets — sometimes for generations at a time — but in Shuttleworth’s opinion science and society move faster if we can encourage disclosure. When one inventor talks about her insights, another inventor can build upon those insights in novel ways for the betterment of everyone. “You should only be able to patent those things you could keep secret,” Shuttleworth said.

“People have become confused,” Shuttleworth lamented, “and think that a patent is incentive to create at all.” No one invents just to get a patent, though — people invent in order to solve problems. According to him, patents should incentivize disclosure. Software is not something you can really keep secret, and as such Shuttleworth’s determination is that “society is not benefited by software patents at all.”

Software patents, he said, are a bad deal for society. The remedy is to shorten the duration of patents, and reduce the areas people are allowed to patent. “We’re entering a third world war of patents,” Shuttleworth said emphatically. “You can’t do anything without tripping over a patent!” One cannot possibly check all possible patents for your invention, and the patent arms race is not about creation at all.

“The challenge,” Shuttleworth continued, “is how to open up a legislative discussion not dominated by companies that have been successful in the past.” It’s no secret that the majority of funding and lobbying comes from people with a strong interest in blocking new entrants. The voice of the people — and the voice of the individual inventor — is simply not heard.

Canonical, Shuttleworth told me, is a paid-up member of Open Invention Network, but according to him this is “really quite distasteful.” “It’s like saying ‘I have friends with big guns’,” he remarked. According to Shuttleworth, Canonical does not file patents defensively or offensively; and although it would be straightforward for them to patent their work they don’t. They feel it would be actively harmful to what consumers want: ever improving products at ever lower prices.

I pressed the issue and asked about the Google vs Oracle lawsuit. I was specifically curious about the question of whether APIs were copyrightable. “As far as we’re concerned, this is a settled matter,” Shuttleworth stated. He said there are prior cases of people trying to copyright some kind of interface — mechanical, software, etc — and that these had all been resolved. “To countenance that would be to throw a spanner in the works of progress in general!” Shuttleworth exclaimed. “Technology should be easy to consume, and widely available. Innovation should respond to what customers what and need,” not to what established businesses feel they need to protect.

It’s fantastic up there!
No interview with Shuttleworth could be complete without the obligatory question: Would you like to return to outer space? His emphatic response: “Of course! It’s fantastic up there!” He proceeded to tell me how it was the experience of a lifetime. According to him, it wasn’t just the trip, but the entire experience of being immersed in an industry dedicated to exploration. “The folks I met were all wonderful, amazing people.” Despite his enthusiasm, he has no specific plans to leave the planet again any time soon.

Coupa, the creator of spend optimization software for businesses, which brings something of a Mint.com-like view into where a company spends on operating resources, is today announcing the close of a $22 million Series E round of funding led by a new investor, Crosslink Capital. Previous investors Battery Ventures, BlueRun Ventures, El Dorado Ventures and Mohr Davidow Ventures also committed to the round.

Although CEO Rob Bernshteyn says that Coupa could be profitable in a month if it cut back on its investments, the company is raising the additional funding to help it expand its product as well as move into new markets.

The new round comes on top of Coupa’s $12 million Series D from February of last year.

Founded in 2006, Coupa now has 250 customers using its service, which includes companies like Rent-A-Center, Salesforce, Pandora, Ross, The Limited, The Container Store, many Subway and McDonald’s franchises (35,000 locations at Subway, 3,000 at McD’s) and even some Fortune 50 companies like Toyota, Armstrong, and Gannett. Customers seem to be pretty happy with the service, too – Coupa’s renewal rate is 96%, Bernshteyn tells us.

“For all of the last three years [2009 to 2010, 2010-2011, 2011-2012] we’ve grown roughly 130% in our recurring revenue, well more than doubling every year,” says Bernshteyn. Plus, he adds, “we’ve had thirteen quarters of sequential growth in new, first-year subscription revenue.”

For those unfamiliar, Coupa is a platform for managing operating expenses, meaning anything that goes into running a business – the purchases, contracts, and suppliers who provide everything from office supplies to temporary labor. In Coupa, customers find the product or service they need, add it to the cart and then get the product approved through a workflow process customized to their business. Over time, Coupa builds up data on how the money is spent (which invites the Mint.com comparison).

But Coupa does more than give businesses insight into spending – it focuses on both the procurement and expense management side of things, and even includes interesting features, like being able to tweet from the platform, “thank” employees when their expense is below the category average, or warn them when they’re high.

On the product side, the company is planning to use the funding to introduce more capabilities around tracking contracts, building out its communities of customers, and improving its mobile footprint. It’s also working on bettering its budget approval app. Updates roll out quarterly, and since the service is paid for by annual subscription, the updates are free for current customers.

In terms of geographic expansion, Coupa plans to increase its presence in Europe, where it has seen “huge demand,” and it will build a channels organization that will help it get more reach, globally.

About six years ago, Google launched Apps for Your Domain, which, for the first time, wrapped its suite of emerging cloud products under one umbrella — as a service for businesses and the enterprise. The service combined Gmail, Google Talk, GCal, and Google Page Creator, offering the suite to businesses, non-profits, and schools for free, with no hardware or software required. Thanks to something called “the cloud.” Today, the service is better known as Google Apps and is, according to Google, being used by at least 4 million organizations, with some 40 million-plus end users.

Yet, as the Google Apps ecosystem has expanded, and its tools have become integral to the day-to-day operations of millions of businesses, many are looking for better ways to monitor, control and secure end-user access to apps like Google Docs, Sites, and Calendars. That’s why BetterCloud launched earlier this year — to provide a suite of complementary products that provide Google Apps with enhanced management and security tools for both IT admins and end users. To help it get off the ground, the New York City-based startup has raised $2.2 million in seed funding from undisclosed angel investors.

BetterCloud will use the capital to accelerate the development of its security and management tools and broaden its strategic partnerships, says founder and CEO David Politis, who left his position running the SMB group at Cloud Sherpas (one of Google’s top enterprise partners, which recently merged with GlobalOne) last year to launch the new company. At Cloud Sherpas, Politis helped hundreds of organizations transition to Google’s cloud products, and led the development of its management tools for Google Apps. Prior to Cloud Sherpas, Politis was a founding employee at Vocalocity.

When Politis left Cloud Sherpas, he brought a handful of his team members with him, along with the IP and customers database of SherpaTools, the companion app for Google Apps that offered advance IT management functions for admins and end users that he and his team helped develop. If the concept behind SherpaTools sounds familiar, that’s because it is.

Politis and team are retiring SherpaTools, replacing it with a new and improved product, which launches today in tandem with its funding announcement. The new app, called FlashPanel, is available today in exclusive beta (the first 500 readers can sign up on its landing page), with public availability in the Google Apps Marketplace slated for the summer.

FlashPanel follows the February release of BetterCloud’s first product, DomainWatch, a Google Apps security tool for domains, created to ensure greater visibility and control for IT admins over their users’ activity. Politis says that he thinks the funding represents a validation of the maturity of the Google Apps ecosystem, and, in turn, the need for organizations to get better ways to make the most of Google’s products, both in security and management for admins and end users.

So what is FlashPanel? The management tool offers IT admins comprehensive domain management from one dashboard, giving them access to info on users, groups, and organizational units, Google Docs quota usage, as well as a chart profiling active, suspended, and unused seats.

BetterCloud also wants to provide granular management, as some small companies may not use CRM tools, so the suite offers shared contact management, which admins can use to disseminate information to individual users and sync with their mobile devices, add users to new groups, shuffle them around, remove them, or back up inboxes — which gives them a standard template to make it easier for onboarding new employees and deprovisioning those who’ve left.

FlashPanel also offers email signature standardization so that businesses can create a unified brand image for their employees, and its so-called “App Butler,” which users can enable via Google Chat to retrieve company directory contact info on-demand or broadcast company-wide events.

In addition, the suite includes scheduled and on-demand scans of domain activity, stats, email inbox monitoring, and delegation, as well as a product called Google Gooru, which offer companies training videos on each new Google Apps feature as they’re released, making it easier for admins to get employees using new features without the hassle of having to create their own or hold company-wide onboarding sessions.

As the Google Apps ecosystem continues to grow and develops new products and services around Vault, Chromebooks, and Android, BetterCloud wants to be the end-to-end service that provides the best management tools — for everything from domains and groups to reporting, security and compliance — for Google’s enterprise suite.

For more on BetterCloud, check ‘em out at home here.

Ask a VC, the TCTV show where you ask the questions, is back after a long hiatus and we’re kicking things off with two partners this week from Spark Capital and Andreessen Horowitz!

If you’ve got questions about what it’s like to shift from being an entrepreneur to being a venture capitalist, both our interviewees can actually tell you.

So how does this show work? You ask questions either in the comments or at askaVC(at)TechCrunch(dot)com and we’ll put them forward to our VC guests.

So for our first taping, we have Nabeel Hyatt, who just joined Spark Capital in February after serving as a general manager at Zynga (pictured at the right). He sold his company Conduit Labs to the social gaming giant and that deal set the groundwork for Zynga’s Boston studio.

Before that, he was a vice president of product at the MIT Media Lab spinoff Ambient Devices, which embedded information from the web into everyday objects like light bulbs, mirrors, refrigerators, and umbrellas to make the physical environment an interface to digital media.

If you’ve got questions about what the “Zynga mafia” will end up being like, he’s probably the one to ask.

Then later this week we have Peter Levine, a general partner at Andreessen Horowitz, who is extremely seasoned at company building (pictured at the top). Not only does he teach at Stanford’s Graduate School of Business and do mountain climbing, he has also served as CEO of XenSource, a provider of open source virtualization solutions that was acquired by Citrix Systems. He then became the senior vice president and general manager of Citrix’s data center and cloud division.

He’s also actually a two-time venture capitalist. Before XenSource, he was a managing director at Mayfield. And then, before that, he was at Veritas Software where he started as an engineer when the company had just a few people. By the time he left 11 years later, the company was doing $1.5 billion in revenue, had nearly 6,000 people and he was one of three executive vice presidents, responsible for sales to hardware manufacturers, marketing, mergers and acquisitions and the Veritas venture fund. Like his firm’s other partners, he also writes regularly and has some good advice on how to run board meetings and evaluate sales deals here.

Levine has recently gotten the firm into deals like Actifio, the virtualization data management software maker that raised $33.5 million in December. So if you have questions about Andreessen’s enterprise strategy or the firm’s unique approach, he’s the one to ask.

As a data center manager, the deeper your knowledge of what is happening in your environment, the better you can provide and show value to your organization. Every year, Nemertes interviews hundreds of enterprise representatives asking, among other things, where they are investing, in what...

Online education has been around for years, but they were largely viewed as experiments. Over the last year, things have changed. Elite universities are not only taking online education seriously, they’re building it into their 10-year plans. Harvard and MIT’s EdX is one example, Coursera another, while startups like CodeAcademy, Treehouse, StraighterLine, Khan Academy, Lynda.com, Udacity, and Udemy (among others) are carrying the torch for the flipped classroom.

Interestingly, what unites these platforms, aside from the fact that that they’re all in some way educators, is that each has built their own custom software and infrastructure to deliver their content. Are any using traditional learning management systems, like Blackboard or Moodle? Nope. That’s because viable, interactive online education requires software that can meet a new generation of demands: Social, mobile, rich multimedia, flexibility, and scale.

Yet, while these well-funded startups have the resources and capital to build custom platforms, there are thousands of traditional schools, education providers, learning coaches, etc. producing stellar learning content that lack the tools necessary to share their awesome content with the masses.

That’s where Pathwright comes into play. Greenville, South Carolina-based Pathwright was founded by a team of hackers (and educators) who have set out to build a platform for “the next wave of educators” — a simple, DIY content management system that lets any and all educators create, distribute, and sell online courses under the banner of their own branded, online schools.

Today, those looking to take advantage of online classes basically have two options. Hack together an LMS like Moodle or Blackboard, or build their own education software. It was the same problem that led to open source CMSes, or DIY mobile app software, and white label solutions of all stripes. Moodle and Blackboard are notoriously bad, and taking the former route generally leads to poor design, UX, and suffers from a lack of branding options. In terms of the latter, if you have the time/resources to build your own great, but it’s not for everyone.

So Pathwright worked with educators and students to fine tune and simplify the process of building a DIY tool for educators. The startup beta tested with an early client, which has already delivered 8K courses and growing, Pathwright Co-founder Paul Johnson tells us.

The co-founder says that the big vision is, like that of Udemy, to give educators direct access to students anywhere in the world and to make a living without the need for institutions or legacy tech. Johnson sees a coming increase in the number of niche education options, with the best courses being offered by practitioner teachers, a la Lynda.com, as the lines between educational publisher, institution, and teacher are blurred. A tool that makes Lynda-style distribution possible (the model itself is hard to mimic as Lynda has professional studios to produce its video content) will be in an advantageous position.

That’s why Pathwright allows users to teach anything by way of creating interactive learning paths, create a single course, or build an entire online school, train employees and customers, offer courses as curricula, and coach or mentor people in any location.

How does it work? Users create a simple path of action steps to guide their students through each course on a single page. These pages can include video or audio lectures, assessments, readings, exercises, or any other type of learning action, and offer the ability to easily upload, create, or embed content from YouTube or Scribd, etc.

Each course comes with a built-in social network for every student taking the course, allowing students to share notes, ask or answer discussion questions, and receive grades and feedback from teachers. Teachers can then publish their courses is a built-in, branded catalog and sell them directly, make them invitation-only, or offer monthly subscriptions that unlock all the courses. Educators can also offer online-only or location-based courses, or both, may be self-paced, or on a schedule with varying degrees of teacher interaction.

While the increase in scalable, online learning options is good news for the soaring price of education, some online education startups suffer from undercooked business models or stifled revenue streams. In the end, this is a business, so taking a cue from the popular software startup pricing scheme, Pathwright makes its platform cheap to get started, with pricing increasing with scale and users.

There are no setup or fixed fees, but once a user has over 10 course registrations, Pathwright charges $7 per registration, plus four percent of sales made through the startup’s built-in catalog. If the school isn’t selling courses using their Pathwright account, then the four-percent fee is removed, and schools can pre-purchase registration credits in bulk to lower the per-registration fee. Find more here.

Additionally, the startup recently launched an option for schools to sell their courses on a subscription basis (a la Treehouse) as well as offering courses for other teachers to use in their own private classes. Pathwright also provides related services for a fee, like video hosting and encoding, branded, custom themes, curriculum conversion, etc.

While Pathwright’s suite of tools are going to make it an appealing option, the startup is not alone in this market. Under its current model, Pathwright will certainly have overlap with Udemy, which also allows anyone to build and sell online courses, as well as Litmos, an LMS that is more focused on business training but offers basic course building and selling options — to name a few.

Both companies are well established and have been in the game for several years at least (Litmos was acquired by Callidus Software last year) and are profitable, so Pathwright has some ground to make up. While we’re seeing a flood of new online ed players entering the space, the landscape is still largely emergent, and I’d say there’s still plenty of room for each to scale before they’re competing directly for customer acquisition. There are just too many entities looking for easy ways to offer, sell, and distribute their own courses, and the market is still largely underserved.

Pathwright hasn’t raised any funding to date and remains focused on product and marketing, but will likely look to begin fundraising later this year.

For more, check out Pathwright at home here. What do you think?

The iPad has, quite quickly, become the tablet of choice for enterprises, with some 97 percent of all tablet activations in Q1 of 2012 attributable to Apple’s tablet, according to Good Technology. So it comes as no surprise that apps are rushing into the wake of those purchases to make the iPad more work-friendly.

The latest in that story is a release of some social software from harmon.ie that will make SharePoint, the collaboration software from Microsoft, usable on the iPad, as well as the iPhone. Harmon.ie’s CEO, Yakov Cohen, says this marks the first time that business users can access SharePoint from both the iPad and desktop with the same user experience.

“Until now, you had solutions for business users only for the iPad or only for the desktop but not for both,” he says.

Harmon.ie has carved out a niche for itself as an integrator for enterprises that want to incorporate more “social” collaboration tools into their workflow on Windows but have held off for problems of security on consumer-grade social networks or for the fact that workers are not necessarily going on the internet as much as they are nosing around their own networks working on email.

The company says it already has 1 million people using its existing edition for Outlook, which which adds social features and collaboration to a user’s Outlook mail and calendar applications.

Putting SharePoint accessbility on the iPad gives harmon.ie a lot of potential in tapping a big market that has yet to be served: some 78 percent of corporate America already uses SharePoint, according to Forrester, with half of their workday (yes — half!) spent in email. Microsoft, perhaps understandably, has not created iPad and iPhone support for SharePoint itself.

The new service lets users create a presentation, drop it into SharePoint, send a link to colleagues via harmon.ie in Outlook or IBM’s Lotus Notes. Then users in that worker’s circle can subsequently access those documents on their PCs or their iPads (or iPhones). The system allows for both offline and online collaboration.

The product is available as a free, read-only version, and a full version for $19.99 that lets users edit and collaborate on documents on the SharePoint platform. An MDM version, allowing for more secure connections, will be available in Q2, the company says.

Similarly, support for Android and Windows 8 coming “in future,” says Cohen. (harmon.ie for iPad is HTML5-based, he says, which makes it relatively painless to provision it for all HTML5-based platforms.)

As you may have seen over the weekend, someone has discovered a security hole in FileVault, which arose with the OS X Lion security update, version 10.7.3, back in February: FileVault encryption passwords are now visible in plain text outside of a computer’s encrypted area.

The hole was apparently spotted by someone back in February, although it was most publicly first pointed out by security consultant David Emery on the Cryptome blog a few days ago and the rest of the blogosphere has run with it.

Now, it appears that the problem could be bigger than previously thought: it turns out that the developer who first noticed the hole back in February has discovered that it exists outside of FileVault, too, with at least one other company’s security encryption software, Lion VM, from VMWare Fusion, showing the same behavior.

From earlier this morning, he wrote, in answer to his own thread started in February:

I’m not sure if I can support the assumption that this is an error in filevault.

I’ve just tried logging in as an network user in an newly setup and updated Lion VM (VMware Fusion) and run into the same behavior. Filevault was never active on this system.

Can someone with the following environment please verify:

- OpenDirectory users with Network Home on AFP

- Lion (10.7.3) Clients

- Snow Leopard or Lion Server

Steps:

- Setup a new machine, or use one that never had filevault enabled

- Login as a (unprivileged!) network user with a Network Home on an AFP share

- logout, login as an admin user

- Check “Console” for log messages containing the string “_premountHomedir”

Please help to get to the bottom of this!

The security hole, as it exists in Apple’s own FileVault (and potentially other) encryption software, means that passwords for the encrypted part of a person’s computer are revealed in plain text to a user who knows where to look. As Sophos’ Naked Security blog notes:

Anyone with access to the disk can read the file containing the password and use it to log into the encrypted area of the disk, rendering the encryption pointless and permitting access to potentially sensitive documents. This could occur through theft, physical access, or a piece of malware that knows where to look.

That is yet another reminder of how, although we hear a lot about passwords needing to be   cryptic enough, ultimately if the encryption falls down on implementation, those passwords will be useless anyway. “How products store, manage and secure keys and passwords is the most common failure point in assuring data protection,” Chester Wisniewski of Sophos points out.

The advice he gives is to upgrade to a full-disc solution, such as FileVault 2 or another, and also to change your passwords if you’re a FileVault users.

It’s not clear how many users have been affected by this security flaw, which follows on another security mis-hap for Apple last month, when 600,000 Macs were apparently recruited into a botnet after a security update for Java was delayed in its release.

Apple’s been working for some time on improving the security of its operating systems — partnering with the security community to advance that aim — but as the company’s ubiquity continues to grow this will become even more urgent an issue.

We have contacted Apple for a response to this story and will update as we learn more.

Trying new APIs is tricky. You can spend hours setting things up, gaining permissions, and learning syntax before you even get to write one line of code. That’s why CodeNow.com is cool. In short, it allows you to try APIs before you invest too much time into them and, as an added bonus, it acts as a code repository.

The site is currently in private beta but it’s accepting users tonight.

Take a look at this screen:

In the left pane you have the code and in the right pane you have the results. This is a very basic piece Facebook call that returns a list of users. Once it’s part of CodeNow, however, you can run this code in a virtual machine or share it with one link.

Without having to do very much, you can change the code on the fly:

In short, you can basically experiment with almost any API, including services like Dropbox, Twilio, and Facebook. Then, if you’ve created something cool you can simply share it with others or keep it for yourself.

Founder Yash Kumar was a former Amazon employee and found the impetus to build the site when his boss came to him with a problem.

“A Product Manager came up to me complaining it took her 2 days to get a make a basic API call to Facebook. She had taken a programming class in college, but struggled with getting a basic app up and running. There are tens of millions of code literate users that struggle to overcome the basic barriers of setting up code and project environments. We plan to empower millions of such users to create, build and play with code,” he said.

CodeNow is the first AngelPad company to launch this year. They plan to monetize by offering API discovery by charging providers to take part. They are currently supporting Facebook, Twilio, and Dropbox and there are many partners on the wait-list for inclusion. They also include the API’s own sample code to ease entry.

Kumar used his experience at Amazon to build a system of virtual machines using AWS. They also sandbox code so developers can test apps without having to create official accounts. “Users don’t need to authorize and setup app keys or OAuth to run apps,” he said.

“CodeNow runs completely in the browser. There is nothing to set up. No software package, no Amazon EC2 server instance. Just type and hit run,” said Kumar. “We plan to empower millions of such users to create, build and play with code.”

Do thoughts of Hadoop send you into a tizzy? Do petabytes of data make you wild?

If so, then we have just the thing for you. Accel Partners, the firm that will be scoring a touchdown this month with Facebook’s IPO, is holding a big data conference next week.

It’s a one day event at Stanford University on May 9 from 9 to 5 p.m. There will be discussions and fireside chats with entrepreneurs like Sun Microsystems and Arista Networks co-founder Andy Bechtolsheim, Hadoop founder Doug Cutting, Cloudera co-founder Jeff Hammerbacher and former Yahoo chief technology officer Raymie Stata.

Also speaking there are Aditya Agarawal, the crucial early Facebook director of engineering and the current vice president of engineering at Dropbox, Factual founder Gil Elbaz and Metamarkets chief executive officer Mike Driscoll. On top of that, there’s Amazon Web Services director Peter Cohen, Nimble Storage chief executive Suresh Vasudevan and Lookout co-founder Kevin Mahaffey.

There are more than 500 attendees so far.

If you’d like a ticket, please comment below and post the story to Facebook. Accel will pick 10 winners this way and they’re looking for entrepreneurs! Otherwise, reach out at accelbdc.com to attend.