On 2/20/2014 6:32 AM, Kai Schaetzl wrote:
Kevin A. McGrail wrote on Mon, 17 Feb 2014 13:18:12 -0500:
body BAYES_99 eval:check_bayes('0.99', '0.999')
body BAYES_999 eval:check_bayes('0.999', '1.00')
score BAYES_99 0 0 3.8 3.5
score BAYES_999 0 0 4.0 3.7
I've also just recognized the presence of BAYES_999 and searched my local
copy of this mailing list for a discussion of it :-)
The problem that I see with this rule is that it seems to *replace* the
BAYES_99 hits *when* it hits and thus downscores the normal hits
*significantly* if you don't take manual action.
Which was not the intention... The score of 1.0 for BAYES_999 was an
error. We fixed it and then rulesqa got stalled because ASF changed
their SSL certificates. I fixed that yesterday and we published new
rules today with the correct scores. They should be available right now.
We also have issues where 3.4.0 is not getting automatic revision
updates for DNS. I'm working on that issue still but manually ticked
the revision and updates should be working now.
Anyway, this lapse also made me look at the latest improvements :-)
Silver linings are always good!
I have set 999 now to 6.0 and also added the body eval per your advice
above. Generally, 999 is a welcome addition as it might send those spams
over the border that used to get scored under 5.0 because of hits on the
negative values for whitelist, RP_MATCHES_RCVD and other "positive" stuff.
Agreed.
Which SA versions do get this new 999 rule? e.g. I have also older
installations with 3.2.4 and 3.2.5 that would need careful updating. Am I
safe to assume that these won't get this new rule?
3.3.0, 3.3.1, 3.3.2 and 3.4.0 as well as trunk should all get this rule.
3.2.0 hasn't had updates since at least Jan of 2010 from looking
regards,
KAM
