What is a use case for init -deterministic-names ?

[impredicative]

What is a well-defined example or use case for init with -deterministic-names? It is not entirely clear to me when and why I should use it to avoid any issues, preferably before I encounter such an issue.

[rfjakob]

The man page is a little terse on details, but the idea is to use it when you have two (or more) infrequently synced gocryptfs filesystems.

Or any use case where you create overlapping directory hierarchies in two (or more) copies of the filesystem and want to to merge these hierarchies later. This does not work in default mode because of the random gocryptfs.diriv files, which will cause sync conflicts.

[impredicative]

What purpose do the gocryptfs.diriv files serve in increasing security? What is the significance of the harm to security if these files are disabled? Is it still safe to sync the encrypted files with gocryptfs.diriv effectively disabled?

[rfjakob]

It prevents the "identical names leak" ( https://nuetzlich.net/gocryptfs/comparison/#file-names ). This allows an attacker to determine more information about the encrypted files than they would otherwise.