What can you legally do with the variable `box` here?

List<?> box = new ArrayList<String>(); // which operation compiles?