You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Matus UHLAR - fantomas <uh...@fantomas.sk> on 2014/02/17 14:43:41 UTC

BAYES_999 of score 1.0 (default)

Hello,

seems after last rule update we've got new rule BAYES_99 in 72_scores.cf but
without score (and thus default 1.0) in 50_scores.cf.

... a mistake happened apparently?

-- 
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
The 3 biggets disasters: Hiroshima 45, Tschernobyl 86, Windows 95

Re: BAYES_999 of score 1.0 (default)

Posted by "Kevin A. McGrail" <KM...@PCCC.com>.
On 2/25/2014 8:08 AM, Kai Schaetzl wrote:
> Kevin A. McGrail wrote on Thu, 20 Feb 2014 10:06:59 -0500:
>
>> 3.2.0 hasn't had updates since at least Jan of 2010 from looking
> I thought there may not have been any updates since then. Time to do
> upgrades :-)
> But the eval rule nevertheless works if you add it manually.
>
> Thanks for all your hard work on SA! It's nice to see that there are still
> improvements possible.
>
> Kai
>
Happy to help!

Re: BAYES_999 of score 1.0 (default)

Posted by Kai Schaetzl <ma...@conactive.com>.
Kevin A. McGrail wrote on Thu, 20 Feb 2014 10:06:59 -0500:

> 3.2.0 hasn't had updates since at least Jan of 2010 from looking

I thought there may not have been any updates since then. Time to do 
upgrades :-)
But the eval rule nevertheless works if you add it manually.

Thanks for all your hard work on SA! It's nice to see that there are still 
improvements possible.

Kai

-- 
Get your web at Conactive Internet Services: http://www.conactive.com




Re: BAYES_999 of score 1.0 (default)

Posted by Kai Schaetzl <ma...@conactive.com>.
Kevin A. McGrail wrote on Thu, 20 Feb 2014 10:06:59 -0500:

> 3.2.0 hasn't had updates since at least Jan of 2010 from looking

I thought there may not have been any updates since then. Time to do 
upgrades :-)
But the eval rule nevertheless works if you add it manually.

Thanks for all your hard work on SA! It's nice to see that there are still 
improvements possible.

Kai

-- 
Get your web at Conactive Internet Services: http://www.conactive.com




Re: BAYES_999 of score 1.0 (default)

Posted by "Kevin A. McGrail" <KM...@PCCC.com>.
On 2/20/2014 6:32 AM, Kai Schaetzl wrote:
> Kevin A. McGrail wrote on Mon, 17 Feb 2014 13:18:12 -0500:
>
>> body BAYES_99           eval:check_bayes('0.99', '0.999')
>> body BAYES_999          eval:check_bayes('0.999', '1.00')
>> score BAYES_99  0  0  3.8    3.5
>> score BAYES_999 0  0  4.0    3.7
> I've also just recognized the presence of BAYES_999 and searched my local
> copy of this mailing list for a discussion of it :-)
>
> The problem that I see with this rule is that it seems to *replace* the
> BAYES_99 hits *when* it hits and thus downscores the normal hits
> *significantly* if you don't take manual action.
Which was not the intention... The score of 1.0 for BAYES_999 was an 
error.  We fixed it and then rulesqa got stalled because ASF changed 
their SSL certificates.  I fixed that yesterday and we published new 
rules today with the correct scores.  They should be available right now.

We also have issues where 3.4.0 is not getting automatic revision 
updates for DNS.  I'm working on that issue still but manually ticked 
the revision and updates should be working now.

> Anyway, this lapse also made me look at the latest improvements :-)
Silver linings are always good!
> I have set 999 now to 6.0 and also added the body eval per your advice
> above. Generally, 999 is a welcome addition as it might send those spams
> over the border that used to get scored under 5.0 because of hits on the
> negative values for whitelist, RP_MATCHES_RCVD and other "positive" stuff.
Agreed.
> Which SA versions do get this new 999 rule? e.g. I have also older
> installations with 3.2.4 and 3.2.5 that would need careful updating. Am I
> safe to assume that these won't get this new rule?
3.3.0, 3.3.1, 3.3.2 and 3.4.0 as well as trunk should all get this rule.

3.2.0 hasn't had updates since at least Jan of 2010 from looking

regards,
KAM

Re: BAYES_999 of score 1.0 (default)

Posted by Kai Schaetzl <ma...@conactive.com>.
Lennart Johansson wrote on Thu, 20 Feb 2014 13:58:21 +0100:

> Which SA versions do get this new 999 rule? e.g. I have also older 
> installations with 3.2.4 and 3.2.5 that would need careful updating.

Just adding your rule seems to add 999 to the set of older setups as well, 
although it wasn't drawn in by an update. So, I can quickly take advantage 
of it there as well. Thanks.

Kai

-- 
Get your web at Conactive Internet Services: http://www.conactive.com




Sv: Re: BAYES_999 of score 1.0 (default)

Posted by Lennart Johansson <Le...@lj-teknik.se>.
fixar det

/Lelle




>>> Kai Schaetzl <ma...@conactive.com> 14-02-20 12:33 >>>
Kevin A. McGrail wrote on Mon, 17 Feb 2014 13:18:12 -0500:

> body BAYES_99           eval:check_bayes('0.99', '0.999')
> body BAYES_999          eval:check_bayes('0.999', '1.00')
> score BAYES_99  0  0  3.8    3.5
> score BAYES_999 0  0  4.0    3.7

I've also just recognized the presence of BAYES_999 and searched my local 
copy of this mailing list for a discussion of it :-)

The problem that I see with this rule is that it seems to *replace* the 
BAYES_99 hits *when* it hits and thus downscores the normal hits 
*significantly* if you don't take manual action. Many people have scored 
high BAYES values up, because there are almost NIL FPs on them. I have set 
95 to 4.0 and 99 to 5.0 (on some servers just to 4.0). Suddenly having 999 
replace those hits/scores with 1.0 (that is what I get here) makes a lot 
of spam go thru. It would rather have been better to add 999 as meta rule, 
so that the basic 99 still hits plus any additional scoring from 999. In 
that case I would have had 5.0 + 1.0 = just fine.

Anyway, this lapse also made me look at the latest improvements :-)

I have set 999 now to 6.0 and also added the body eval per your advice 
above. Generally, 999 is a welcome addition as it might send those spams 
over the border that used to get scored under 5.0 because of hits on the 
negative values for whitelist, RP_MATCHES_RCVD and other "positive" stuff.

Which SA versions do get this new 999 rule? e.g. I have also older 
installations with 3.2.4 and 3.2.5 that would need careful updating. Am I 
safe to assume that these won't get this new rule?

Kai

-- 
Get your web at Conactive Internet Services: http://www.conactive.com






Re: BAYES_999 of score 1.0 (default)

Posted by Kai Schaetzl <ma...@conactive.com>.
Kevin A. McGrail wrote on Mon, 17 Feb 2014 13:18:12 -0500:

> body BAYES_99           eval:check_bayes('0.99', '0.999')
> body BAYES_999          eval:check_bayes('0.999', '1.00')
> score BAYES_99  0  0  3.8    3.5
> score BAYES_999 0  0  4.0    3.7

I've also just recognized the presence of BAYES_999 and searched my local 
copy of this mailing list for a discussion of it :-)

The problem that I see with this rule is that it seems to *replace* the 
BAYES_99 hits *when* it hits and thus downscores the normal hits 
*significantly* if you don't take manual action. Many people have scored 
high BAYES values up, because there are almost NIL FPs on them. I have set 
95 to 4.0 and 99 to 5.0 (on some servers just to 4.0). Suddenly having 999 
replace those hits/scores with 1.0 (that is what I get here) makes a lot 
of spam go thru. It would rather have been better to add 999 as meta rule, 
so that the basic 99 still hits plus any additional scoring from 999. In 
that case I would have had 5.0 + 1.0 = just fine.

Anyway, this lapse also made me look at the latest improvements :-)

I have set 999 now to 6.0 and also added the body eval per your advice 
above. Generally, 999 is a welcome addition as it might send those spams 
over the border that used to get scored under 5.0 because of hits on the 
negative values for whitelist, RP_MATCHES_RCVD and other "positive" stuff.

Which SA versions do get this new 999 rule? e.g. I have also older 
installations with 3.2.4 and 3.2.5 that would need careful updating. Am I 
safe to assume that these won't get this new rule?

Kai

-- 
Get your web at Conactive Internet Services: http://www.conactive.com




Re: BAYES_999 of score 1.0 (default)

Posted by "Kevin A. McGrail" <KM...@PCCC.com>.
On 2/17/2014 12:48 PM, Bob Proulx wrote:
> RW wrote:
>> I have spam that's already hitting BAYES_999 with the default 1.0 score.
> I upgraded as well and am also hit by several problems causing more
> spam to be classified as an FN and passing a lot of spam through
> today.  One of them is the BAYES_999 rule hitting with a score of 1.0.
> In concept I like the idea of adding BAYES_999 to the BAYES_99 and
> BAYES_90 and so forth hits.  That part looks good!  But since
> BAYES_999 scores less than BAYES_99 it has the effect of reducing the
> points for very certain spam.
>
> And when I searched the net for information on BAYES_999 I couldn't
> find much about it.  It is new after all so that is expected.  But I
> think it will need a wiki page or something to describe the issues to
> users.  Otherwise there will be many people just like me that are now
> hitting many FNs due to it and will come here looking for information
> about it.  Such as asking why the score for BAYES_999 is separate from
> the other BAYES_* scores.  And why the default is lower than BAYES_99.
> BAYES_999 seems uniquely different from the rest.  A wiki page
> describing it would be a perfect and would keep the noise from people
> like me off the mailing list.  :-)
Yeah, I was expecting the ruleqa engine to score it appropriately and it 
didn't.

BAYES_999 is just a finer gradient on BAYES_99 allowing for a higher 
score on the top .001% of Bayes hits.

It'll be fixed with the next rule update but you might want these 
temporarily:

body BAYES_99           eval:check_bayes('0.99', '0.999')
body BAYES_999          eval:check_bayes('0.999', '1.00')
score BAYES_99  0  0  3.8    3.5
score BAYES_999 0  0  4.0    3.7

Regards,
KAM

Re: BAYES_999 of score 1.0 (default)

Posted by Bob Proulx <bo...@proulx.com>.
RW wrote:
> I have spam that's already hitting BAYES_999 with the default 1.0 score.

I upgraded as well and am also hit by several problems causing more
spam to be classified as an FN and passing a lot of spam through
today.  One of them is the BAYES_999 rule hitting with a score of 1.0.
In concept I like the idea of adding BAYES_999 to the BAYES_99 and
BAYES_90 and so forth hits.  That part looks good!  But since
BAYES_999 scores less than BAYES_99 it has the effect of reducing the
points for very certain spam.

And when I searched the net for information on BAYES_999 I couldn't
find much about it.  It is new after all so that is expected.  But I
think it will need a wiki page or something to describe the issues to
users.  Otherwise there will be many people just like me that are now
hitting many FNs due to it and will come here looking for information
about it.  Such as asking why the score for BAYES_999 is separate from
the other BAYES_* scores.  And why the default is lower than BAYES_99.
BAYES_999 seems uniquely different from the rest.  A wiki page
describing it would be a perfect and would keep the noise from people
like me off the mailing list.  :-)

Bob

Re: BAYES_999 of score 1.0 (default)

Posted by "Kevin A. McGrail" <KM...@PCCC.com>.
On 2/17/2014 12:40 PM, Daniel Staal wrote:
> Same here - it's causing a fair amount of FNs, as I have BAYES_99 set 
> with a 4.7 score, so this is lowering the spam score for a lot of mail.
Might want to temporarily set a score for bayes_99 of 4.7 and create a 
copy of bayes_999 also set to 4.7.

The fix is already committed.  Should see it in the ruleset tomorrow if 
all goes well!

Re: BAYES_999 of score 1.0 (default)

Posted by Daniel Staal <DS...@usa.net>.
--As of February 17, 2014 2:54:11 PM +0000, RW is alleged to have said:

> On Mon, 17 Feb 2014 09:09:33 -0500
> Kevin A. McGrail wrote:
>
>> On 2/17/2014 8:43 AM, Matus UHLAR - fantomas wrote:
>> > Hello,
>> >
>> > seems after last rule update we've got new rule BAYES_99 in
>> > 72_scores.cf but
>> > without score (and thus default 1.0) in 50_scores.cf.
>> >
>> > ... a mistake happened apparently?
>> >
>> I'll look and see.  I've never tried to promote a bayes rule so it
>> might need to bypass sandbox.
>
> I have spam that's already hitting BAYES_999 with the default 1.0 score.

--As for the rest, it is mine.

Same here - it's causing a fair amount of FNs, as I have BAYES_99 set with 
a 4.7 score, so this is lowering the spam score for a lot of mail.

Daniel T. Staal

---------------------------------------------------------------
This email copyright the author.  Unless otherwise noted, you
are expressly allowed to retransmit, quote, or otherwise use
the contents for non-commercial purposes.  This copyright will
expire 5 years after the author's death, or in 30 years,
whichever is longer, unless such a period is in excess of
local copyright law.
---------------------------------------------------------------

Re: BAYES_999 of score 1.0 (default)

Posted by RW <rw...@googlemail.com>.
On Mon, 17 Feb 2014 09:09:33 -0500
Kevin A. McGrail wrote:

> On 2/17/2014 8:43 AM, Matus UHLAR - fantomas wrote:
> > Hello,
> >
> > seems after last rule update we've got new rule BAYES_99 in 
> > 72_scores.cf but
> > without score (and thus default 1.0) in 50_scores.cf.
> >
> > ... a mistake happened apparently?
> >
> I'll look and see.  I've never tried to promote a bayes rule so it
> might need to bypass sandbox.

I have spam that's already hitting BAYES_999 with the default 1.0 score.

Re: BAYES_999 of score 1.0 (default)

Posted by Amir Caspi <ce...@3phase.com>.
On Feb 17, 2014, at 7:36 AM, Axb <ax...@gmail.com> wrote:
> 
> could we agree to set the ceilings on lower safer scores?
> 

In the interest of full disclosure, these rules are being tested because of me (or at my suggestion anyway). I set them up locally based on discussion on this very list from about 2 years ago. FWIW, I have been using these rules for nearly a year and have seen ZERO FPs caused by them, over tens or hundreds of thousands of emails for multiple users. In fact, I set them up because too many FNs were getting by Bayes because they were hitting on only a few other very low-scoring rules. Even today I still get FNs that hit BAYES_999, because they hit no other rules with meaningful scores.

I know everyone's spam is different, just offering my experience.

--- Amir
thumbed via iPhone


Re: BAYES_999 of score 1.0 (default)

Posted by Axb <ax...@gmail.com>.
On 02/17/2014 04:21 PM, Kevin A. McGrail wrote:
> On 2/17/2014 9:36 AM, Axb wrote:
>> could we agree to set the ceilings on lower safer scores?
> Yes, I set the BAYES_999 to the existing score for BAYES_99 +0.2 as a
> minor increase.
>> If possible use different rulenames so as not to tamper with the
>> existing BAYES_99 stuff which could cause issues on production boxes.
> In the end, all we are doing is adding a gradient for 99.9 to 100%. I
> will change this in the base rules for better clarity instead because we
> already have evidence it's a good move.
>> and not force publish till we have performance data
> I did not force publish.  The tflags publish is required for perceptron
> to promote the rule according to the information here:
> http://wiki.apache.org/spamassassin/SaUpdateBackend
>
> Beyond that, the entire point of the ruleqa is to get automatic
> performance data to promote rules. ;-)

ya.. I know that and am ok with it for rules but with Bayes stufff I'd 
be more than conservative.

imo, changing Bayes scores via auto promotion/sa-update  is not 
something I'd consider trivial.

> Making test on the changes and will commit shortly.

Thx

Axb

Re: BAYES_999 of score 1.0 (default)

Posted by "Kevin A. McGrail" <KM...@PCCC.com>.
On 2/17/2014 3:37 PM, RW wrote:
> On Mon, 17 Feb 2014 10:21:21 -0500
> Kevin A. McGrail wrote:
>
>
>> In the end, all we are doing is adding a gradient for 99.9 to 100%. I
>> will change this in the base rules for better clarity instead because
>> we already have evidence it's a good move.
>
> Score often don't follow the strength of a rule seen in isolation. IIRC
> when the scores were auto-generated they were pretty flat from BAYES_80
> upwards, with BAYES_99 actually being a little lower than BAYES_95.
> AFAIK this whole idea of having a gradient just seems to have been
> made-up.
You are entitled to your opinion but your email is a bit acerbic. Please 
reminder, I am a volunteer on this project and I've given a lot of time 
to help block spammers.  And I invite you to do the same because less 
rules/code/documentation/wiki/advice, etc. more than debate in my 
experience.

Beyond that, fighting spam is both an art and a science.  Far too much 
of what we have to do is identify patterns, throw things to the wall, 
see what sticks and then tweak often starting with Art and refining with 
Science.  In the case of BAYES_999, my expectation on this rule was to 
do an analysis on the validity of the change using our RuleQA system but 
the rule got auto-promoted in a way that was not intended.

Therefore, I suggest you score BAYES_99 and BAYES_999 the same. This 
will make the gradient irrelevant in your setup with an infinitesimal 
impact on the system.  However, I've been convinced that there is merit 
to the change or I wouldn't have bothered.

What is your specific concern with the gradients because all it does is 
add flexibility that some users are adamant will help combat spam?

regards,
KAM

Re: BAYES_999 of score 1.0 (default)

Posted by RW <rw...@googlemail.com>.
On Mon, 17 Feb 2014 10:21:21 -0500
Kevin A. McGrail wrote:


> In the end, all we are doing is adding a gradient for 99.9 to 100%. I 
> will change this in the base rules for better clarity instead because
> we already have evidence it's a good move.


Score often don't follow the strength of a rule seen in isolation. IIRC
when the scores were auto-generated they were pretty flat from BAYES_80
upwards, with BAYES_99 actually being a little lower than BAYES_95. 
AFAIK this whole idea of having a gradient just seems to have been
made-up.

Re: BAYES_999 of score 1.0 (default)

Posted by "Kevin A. McGrail" <KM...@PCCC.com>.
On 2/17/2014 9:36 AM, Axb wrote:
> could we agree to set the ceilings on lower safer scores?
Yes, I set the BAYES_999 to the existing score for BAYES_99 +0.2 as a 
minor increase.
> If possible use different rulenames so as not to tamper with the 
> existing BAYES_99 stuff which could cause issues on production boxes.
In the end, all we are doing is adding a gradient for 99.9 to 100%. I 
will change this in the base rules for better clarity instead because we 
already have evidence it's a good move.
> and not force publish till we have performance data
I did not force publish.  The tflags publish is required for perceptron 
to promote the rule according to the information here: 
http://wiki.apache.org/spamassassin/SaUpdateBackend

Beyond that, the entire point of the ruleqa is to get automatic 
performance data to promote rules. ;-)

Making test on the changes and will commit shortly.

Regards,
KAM



Re: BAYES_999 of score 1.0 (default)

Posted by Axb <ax...@gmail.com>.
On 02/17/2014 03:24 PM, Kevin A. McGrail wrote:
> On 2/17/2014 9:13 AM, Axb wrote:
>> On 02/17/2014 03:09 PM, Kevin A. McGrail wrote:
>>> On 2/17/2014 8:43 AM, Matus UHLAR - fantomas wrote:
>>>> Hello,
>>>>
>>>> seems after last rule update we've got new rule BAYES_99 in
>>>> 72_scores.cf but
>>>> without score (and thus default 1.0) in 50_scores.cf.
>>>>
>>>> ... a mistake happened apparently?
>>>>
>>> I'll look and see.  I've never tried to promote a bayes rule so it might
>>> need to bypass sandbox.
>>
>> seems the scores are way to high as well
>>
>> score BAYES_99   0  0  4.3    4.0
>> score BAYES_999  0  0  4.8    4.5
>>
>> I'd test with no publish
>
> Scores in the sandbox are ceilings.
>

could we agree to set the ceilings on lower safer scores?

If possible use different rulenames so as not to tamper with the 
existing BAYES_99 stuff which could cause issues on production boxes.

and not force publish till we have performance data

Re: BAYES_999 of score 1.0 (default)

Posted by "Kevin A. McGrail" <KM...@PCCC.com>.
On 2/17/2014 9:13 AM, Axb wrote:
> On 02/17/2014 03:09 PM, Kevin A. McGrail wrote:
>> On 2/17/2014 8:43 AM, Matus UHLAR - fantomas wrote:
>>> Hello,
>>>
>>> seems after last rule update we've got new rule BAYES_99 in
>>> 72_scores.cf but
>>> without score (and thus default 1.0) in 50_scores.cf.
>>>
>>> ... a mistake happened apparently?
>>>
>> I'll look and see.  I've never tried to promote a bayes rule so it might
>> need to bypass sandbox.
>
> seems the scores are way to high as well
>
> score BAYES_99   0  0  4.3    4.0
> score BAYES_999  0  0  4.8    4.5
>
> I'd test with no publish

Scores in the sandbox are ceilings.

regards,
KAM

Re: BAYES_999 of score 1.0 (default)

Posted by Axb <ax...@gmail.com>.
On 02/17/2014 03:09 PM, Kevin A. McGrail wrote:
> On 2/17/2014 8:43 AM, Matus UHLAR - fantomas wrote:
>> Hello,
>>
>> seems after last rule update we've got new rule BAYES_99 in
>> 72_scores.cf but
>> without score (and thus default 1.0) in 50_scores.cf.
>>
>> ... a mistake happened apparently?
>>
> I'll look and see.  I've never tried to promote a bayes rule so it might
> need to bypass sandbox.

seems the scores are way to high as well

score BAYES_99   0  0  4.3    4.0
score BAYES_999  0  0  4.8    4.5

I'd test with no publish

Re: BAYES_999 of score 1.0 (default)

Posted by "Kevin A. McGrail" <KM...@PCCC.com>.
On 2/17/2014 8:43 AM, Matus UHLAR - fantomas wrote:
> Hello,
>
> seems after last rule update we've got new rule BAYES_99 in 
> 72_scores.cf but
> without score (and thus default 1.0) in 50_scores.cf.
>
> ... a mistake happened apparently?
>
I'll look and see.  I've never tried to promote a bayes rule so it might 
need to bypass sandbox.

Re: BAYES_999 of score 1.0 (default)

Posted by "Kevin A. McGrail" <KM...@PCCC.com>.
On 2/17/2014 12:43 PM, Matus UHLAR - fantomas wrote:
>> On 02/17/2014 02:43 PM, Matus UHLAR - fantomas wrote:
>>> seems after last rule update we've got new rule BAYES_99 in 
>>> 72_scores.cf
>>> but without score (and thus default 1.0) in 50_scores.cf.
>>>
>>> ... a mistake happened apparently?
>
> On 17.02.14 15:07, Axb wrote:
>> BAYES_999 is *not* BAYES_99
>
>
> sorry,it's BAYES_999.
> ... and since the score for BAYES_999 is _commented_ _out_, all spam 
> hitting it
> will only get 1.0 score.
>
Might want to score that temporarily in your local.cf.

Re: BAYES_999 of score 1.0 (default)

Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
>On 02/17/2014 02:43 PM, Matus UHLAR - fantomas wrote:
>>seems after last rule update we've got new rule BAYES_99 in 72_scores.cf
>>but without score (and thus default 1.0) in 50_scores.cf.
>>
>>... a mistake happened apparently?

On 17.02.14 15:07, Axb wrote:
>BAYES_999 is *not* BAYES_99


sorry,it's BAYES_999. 

... and since the score for BAYES_999 is _commented_ _out_, all spam hitting it
will only get 1.0 score.

-- 
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Linux is like a teepee: no Windows, no Gates and an apache inside...

Re: BAYES_999 of score 1.0 (default)

Posted by Axb <ax...@gmail.com>.
On 02/17/2014 02:43 PM, Matus UHLAR - fantomas wrote:
> Hello,
>
> seems after last rule update we've got new rule BAYES_99 in 72_scores.cf
> but
> without score (and thus default 1.0) in 50_scores.cf.
>
> ... a mistake happened apparently?
>

BAYES_999 is *not* BAYES_99



# Enhance Bayes scoring for super-spammy mails
# see /var/lib/spamassassin/3.003002/updates_spamassassin_org/23_bayes.cf
# and $samedir/50_scores.cf
ifplugin Mail::SpamAssassin::Plugin::Bayes
   body BAYES_99           eval:check_bayes('0.99', '0.999')
   body BAYES_999          eval:check_bayes('0.999', '1.00')
   tflags BAYES_99	learn,publish
   tflags BAYES_999	learn,publish
   describe BAYES_99       Bayes spam probability is 99 to 99.9%
   describe BAYES_999      Bayes spam probability is 99.9 to 100%
   score BAYES_99   0  0  4.3    4.0
   score BAYES_999  0  0  4.8    4.5
endif

Not sure I like this, but then....