The number that travelled was 667 megabytes: the size of the Windows 11 ISO that NTDEV — the developer behind the Windows-slimming project Tiny11 — built with an unreleased tool called Pico11. Exactly 699,811,840 bytes, a few megabytes under the capacity of a 700MB CD-R.
The more interesting question is not how the number got that small. It is what had to be deleted to get there, and what that says about the operating system.
What works
In the demonstration the image boots to a desktop in a virtual machine with 4GB of RAM. Task Manager shows roughly 883 to 900MB in use. Calculator does 2+2=4. Settings opens. Notepad saves a text file, Paint draws, Explorer shows drive C: and the drive list. As proof that this is a bootable Windows, it is a complete demo.
What doesn't
To reach that size, NTDEV removed the machinery that keeps Windows alive: Windows Update, and the servicing and recovery functions. The system therefore cannot be patched in the normal way. It is not a replacement for Windows 11 and not intended for daily or long-term use — the developer says so himself.
That is the actual finding here. Most of what makes a modern Windows installation big is not the desktop, the apps or the graphics stack. It is the machinery that keeps the system patchable and repairable. Delete it and you save roughly 90% of the volume — and give up the property that makes the system operable at all.
The tell Tom's Hardware spotted
In the demo, Task Manager looks old. Tom's Hardware noted that an older, lighter version of Task Manager may have been substituted. That is not an accusation of fraud, but it is a description of how projects like this work: when the target is a number, components get swapped until the number is met. What remains "Windows 11" is then defined by branding rather than by a verifiable build.
Consistent with that, NTDEV had not published the method as of the demonstration. An image without a reproducible build recipe cannot be audited — neither for tampering nor for what was actually removed.
Why this is more than retro charm
Tiny11 ships three modes: the standard one, which keeps Update, Defender and recovery; a Core variant that strips those too; and a Custom mode. Pico11 is the fourth and most extreme step, and NTDEV says he intends to fold it into the Tiny11 Builder.
That is when it stops being a curiosity. There is a long list of machines where an unpatched Windows looks useful: thin clients, kiosks, test VMs, old lab hardware. A 667MB image that fits on a CD-R is tempting in all of them. A Windows without an update channel is not a slim Windows; it is a permanently vulnerable one — and on a network, that is not a problem confined to the device.
What to watch
- Whether the technique actually lands in the Tiny11 Builder, and whether the method is then disclosed. Without a published recipe an image is a trust exercise. - Whether independent rebuilds hit the same size. For modified OS images, reproducibility is the only form of assurance that exists. - Whether anyone deploys it. The temptation is strongest exactly where security work is thinnest.
