[vetinari]

'disable' can still start the service, if another service claims it as a dependency. It will not start the service, if it is the last one in the dependency chain.

'mask' will not start the service, not even as a dependency to another service; instead it will rather let the dependent service fail to start.

[brazzledazzle]

That would surprise me at some point. Kind of counter intuitive. Good to know, thanks for the info.

[lallysingh]

Difficulty of naming in software. If they'd named it "block" instead of "mask", perhaps it'd be clearer?

[tremon]

In everyday usage, "disabled" is stronger than "masked". It is indeed surprising that masking is a stronger operation than disabling. It would be clearer if the systemd operation names were reversed.